WEBVTT 00:01.448 --> 00:20.585 [SPEAKER_02]: [Automatic captions by Autotekst using NB Whisper. May contain recognition errors.] Ok, let's get started. Everyone gets a little buzz. Brilliant. My name is Gard. I am an IT director at the University of Oslo. And have been since the summer of 2023, approx. 00:21.749 --> 00:50.875 [SPEAKER_02]: We'll get to warm up a bit before we get three speakers who are much better at privacy, law and IT security than I am. And that's they who help me make sure UiO is inside. But if we move back a bit, there's only one question in the quiz. And it has to do with some Christmas calendar stuff. It was a dark and stormy evening. 00:52.580 --> 01:04.358 [SPEAKER_02]: Which Christmas calendar is it? The Christmas calendar! Very good. Because it was a dark and stormy evening in 1995. Then I was young. 01:05.152 --> 01:32.337 [SPEAKER_02]: And had just created my first website on something called Geocities. Which was a free hosting service. And then you had to code yourself. And it was quite fun. And then I went home. Had moved away from home and stuff. There was no way. Lived in a small place in Northern Norway where you had to move away from home to go to school. And the internet stuff was cool. 01:32.354 --> 01:59.827 [SPEAKER_02]: And in 1995 HTML was approx. a small year old. Or something like that. And then it was a cool place to be. And then it became a educational place to be. And today, on the one hand, the Internet is a place you have to be. Because you can't fix the bank, the insurance, you can't apply for education, you can't get yours, you can't fall without being there. 01:59.843 --> 02:21.815 [SPEAKER_02]: At the same time, it's a bit like being a place. Has anyone seen Die Hard in New York? It's a bit like when he has to walk down that street. And it says that he hates black people walking through one of those districts in New York. Because the Internet is extremely full of criminals. 02:24.177 --> 02:54.012 [SPEAKER_02]: And no one is out hunting you, but you are one in quantity. It is unlikely that anyone will hunt UiO, but UiO is one in quantity. And that's incredibly simple. I can be a cybercriminal. Sit in my cabin. Sit anywhere. The risk is almost zero. And as long as I meet enough people, someone will go on something or other. Then I push someone out because they think they've been on some web pages. And then we cheat some money from someone. 02:54.974 --> 03:24.218 [SPEAKER_02]: So many people say that there is war on the Internet, and that is true. And then comes all this fake stuff. You don't know if it's your own child who calls home from the South and says they have been robbed and sends some money. And then you have artificial intelligence which gives us much better tools, but at the same time also the opponents much better tools. The other day I learned about a Russian troll factory. 03:24.235 --> 03:32.538 [SPEAKER_02]: Where you take in the smartest people from the IT communities. And then you have scoreboards. And the more mob you do ... 03:33.803 --> 04:02.542 [SPEAKER_02]: The more you get on the scoreboard, the more you get paid. And the ten worst get fired. So we have it going. So here we have finally got a compulsory course in place. Fantastic. That doesn't make us IT security experts or privacy responsibles. But it does make us come up a little and this one we can sort of take away. 04:03.352 --> 04:32.798 [SPEAKER_02]: We are incredibly pleased with the study department and the canvas gang, who have helped us get this in place. We will trouble you in the future with security measures. We now see that the villains are starting to find their way around it. Then we have to come up with something new. But we have also tried to remove the fact that you have to log in all the time. 04:34.098 --> 04:50.686 [SPEAKER_02]: Built-in privacy and security are extremely important to us. And it makes it difficult to create IT services. It is more difficult than in 1995, when I made the hot ml site. And that also means that we unfortunately get queue functionality on ... 04:50.703 --> 05:09.721 [SPEAKER_02]: We are unable to take away this. Because there are 7,500 employees and x number who are connected and who want IT things. So bear with us a little for that. So I really want you to take a course. 05:11.172 --> 05:36.940 [SPEAKER_02]: Then I give up and say that we will now have three great introducers. Or main speakers, they say more. Which means that we can get a little strengthened out of this. And that you are perhaps more ready to take the course and have a little more understanding of why we want this relatively simple course, which takes 20-30 minutes, is also very important. Then I just want to wish people ... 05:36.957 --> 06:01.696 [SPEAKER_02]: I might come back for some cheating talk, but everything you've said, you've said. Now everyone with cybercriminals knows it's Christmas. That you have ordered so many packages. So when the email comes, pay a hundred Swedish kroner because customs, then check that it was actually a real package. So the next speaker is Vilde. Please. 06:11.095 --> 06:36.610 [SPEAKER_00]: There we are three IT lawyers who work with IT law. But most of all within privacy. And that electronic data processing creates some problems now and then . It was already discussed on NRK in 1967. 06:36.627 --> 06:53.755 [SPEAKER_00]: And that is still the case sometimes today too. Nevertheless, we have provided access ... Everyone has received a user account at UiO without any information or training when they get it. But we have now changed that. 06:53.755 --> 07:14.140 [SPEAKER_00]: And one of the reasons for that is that UiO is not quite like all other businesses. UiO is a special place. We have over 7,000 employees. Over 26,000 students. It is a wide university with completely specialized ... 07:14.140 --> 07:38.913 [SPEAKER_00]: People who need something very concrete within IT somewhere, while in the neighboring building they need something completely different. So you need a lot of different things. We have an incredible amount of data stored everywhere. In services for sensitive data, which is the service where the most protective data of the UiO is located. 07:39.318 --> 08:07.178 [SPEAKER_00]: We have 2,000 ongoing research projects. And we have at all times 2,500 ongoing research projects which process personal data. And the researchers get personal data from patient records. Or can obtain personal data about everyone in Norway from Statistics Norway. 08:07.178 --> 08:29.521 [SPEAKER_00]: Often without speaking directly to the person concerned. But GDPR is a very research-friendly set of regulations, so it's fortunately perfectly OK. But how can we have all these the information also, sometimes without speaking directly? I asked UiO-GPT about this, so ... 08:29.521 --> 08:45.367 [SPEAKER_00]: But if you had printed out all the data in TSD and placed them on top of each other on A4 sheets, it would have gone up to the moon. And even further. So all these data worthy of protection, how can we have them?.. 08:46.042 --> 09:04.469 [SPEAKER_00]: Much because we have safe IT systems. And the IT department VU is also a special place. There, the IT department has developed some flagships which have very well built-in privacy and very good information security. 09:05.262 --> 09:27.503 [SPEAKER_00]: Services for sensitive data, online forms or UiO-GPT, which precisely have good privacy at hand, enable us to sit on these the data, and not least that people have confidence that we process their data properly. 09:27.503 --> 09:56.579 [SPEAKER_00]: Because privacy is no longer just something lawyers talk about. It is a prerequisite that you can conduct research and get research participants who are willing to give up sensitive information to research projects. And then you can have, now that there is this basic course in privacy and security, some excuses for not wanting to take it. 09:57.946 --> 10:23.866 [SPEAKER_00]: E.g. it is very easy, and you already know everything. And it is a basic course. It's like very much like that ... need-to-know level on information security information and privacy. So some people know this from before and already know it, and it's absolutely great. Then you will get the quiz that allows you to register the course implementation. 10:23.866 --> 10:47.052 [SPEAKER_00]: But we also want people to go into it with an open mind and think. Is there anything I can repeat here? Or is it shown to any routines here that I didn't know about before? Because it is like that a good fishing wave at UiO. This is an example from previous years. 10:47.069 --> 11:16.988 [SPEAKER_00]: Then it is like that approx. 2% of the users who receive good phishing, they want to click on it. And 1% who receive, will give away some information. Either user name, password or account information. So by raising the level of recognizing phishing a little, we will be able to prevent user accounts from going astray. 11:18.592 --> 11:47.465 [SPEAKER_00]: And then you have other excuses. Like this one. And this is a fictitious quote, but it is based on actual events. And then it is a bit like what Gard was talking about, that we must start from the digital reality we live in in 2025. 11:47.482 --> 12:17.013 [SPEAKER_00]: And a lot has happened from Usit publishing an ABC about communication services at UiO in 1992, to today. Where we have our email in the cloud. We use many American ski services. We use many different ski services and have our data spread in many places. And the geopolitical situation is also different today. 12:17.030 --> 12:43.355 [SPEAKER_00]: We live in a digital reality that I perhaps just five years ago felt was a bit like science fiction, then. That yes, now when the public sector in Norway buys buses, routes in the middle of the night under the cover of the buses must be included in a film recording, drive these into the mountain and test who has control. Who can ... 12:43.372 --> 13:10.574 [SPEAKER_00]: Remote control or know where these buses are. If they are to be used in an evacuation situation, e.g. If I'm going to have a conversation with someone who I want to be absolutely sure no one else gets access to, then I wouldn't have that conversation at home in my own living room. And part of the reason for that is that we have bought such robot vacuum cleaners. 13:10.591 --> 13:40.342 [SPEAKER_00]: And then I haven't been able to bear to read its privacy statement. And it's not because I can't enjoy a good privacy statement in private too. I was just afraid to read it, and then I see something that made me not want to buy that robot sucker. And then it's very cool with robots. But yes, the digital reality today is a little different from 10-15-20 years ago. 13:40.358 --> 14:06.110 [SPEAKER_00]: When everything went well with this sensitive data in the suitcase in the office. And then it is also the case that we do not want to put the data, the work data , the research data or administrative data into all possible IT services found online. And the reason for that is that ... 14:06.127 --> 14:20.555 [SPEAKER_00]: Then you put the data with someone else, and they can have a lot of strange user conditions. They can e.g. say that they train your data on artificial intelligence. 14:22.276 --> 14:40.433 [SPEAKER_00]: And also apps we have on our phones and use, you don't necessarily have complete control over who they share our data with. Also sensitive data about ourselves. And this is a completely new judgment from the Court of Appeal. 14:42.188 --> 14:57.882 [SPEAKER_00]: But privately, of course, you can take some risk more than you can on the data at work that we have to protect extra well. Like I did with this robot housekeeper at my home. And we also see that ... 14:57.899 --> 15:26.350 [SPEAKER_00]: The most common deviations we report to the Norwegian Data Protection Authority from UiO, are mostly about incorrect access control. That you have thought that you shared a document perhaps with five other colleagues, and then it turns out that you shared it with the whole UiO. Or sometimes that you shared it openly on the internet. Also missent personal data by email or letter. 15:26.367 --> 15:54.599 [SPEAKER_00]: And also user accounts going astray because someone has gone to Fishing, e.g. The common denominator here is that with a bit of user training, a part could have been prevented. And then it's not like you don't want to continue sending an email wrongly every now and then, and mistakes will happen. 15:56.303 --> 16:17.279 [SPEAKER_00]: Although we have this course. But then perhaps one of the most important things to learn and take with you from this course, is what you should do if a mistake has first occurred. And you have shared some personal data in the wrong place or ... 16:17.296 --> 16:46.439 [SPEAKER_00]: And then you must report to the nearest manager, who in turn must report to UiOCERT as soon as possible. Because they can clean up quite a bit technically. And not least we have a short deadline to assess whether this must be forwarded to the Norwegian Data Protection Authority. And ... Yes. Then the IT security manager will be allowed to take over. 16:53.982 --> 17:23.969 [SPEAKER_01]: Can you hear me? My name is Espen Grøndal. I am IT security manager. I will talk a little about IT security. No big bomb. Starts with an easy question. What are we really afraid of when we talk about attacks and things that go wrong? The answer is most things. But I'll drill into it a bit more. Some things that might be mine. 17:23.986 --> 17:44.185 [SPEAKER_01]: My and perhaps Gard's biggest nightmare is what is the ultimate consequence of a security breach. On the top list there is the loss of research data. Especially irreparable damage. One thing is if you lose data that you can reconstruct and recover from the source. 17:44.202 --> 18:11.202 [SPEAKER_01]: Are we losing data that we cannot withdraw? That is the great horror where we cannot correct the damage. Or if we lose physical things that cannot be reconstructed. Which may result from an attack. It will lead to a loss of trust. Permanent damage to research. 18:11.219 --> 18:34.203 [SPEAKER_01]: If people don't dare to join because we can't take care of the data, it will take a long time to rebuild that trust. You build trust millimeter by millimeter and tear it into meters. That is for me the biggest horror. Whether we had a huge loss of data from TSD or large medical data sets had disappeared, that is the real horror. 18:35.823 --> 18:57.625 [SPEAKER_01]: We are also afraid of ransomware virus, which is also a classic in the media. It has almost passed a little, but it is still a steady flow. It looks like that trend has decreased a bit in Norway. Solvent virus is where someone hacks in, encrypts all your data and says that if you pay us a few million, you will get the data back. And we promise not to release it online. 18:57.642 --> 19:25.030 [SPEAKER_01]: The trend has declined a bit there. It is still quite active in the world. I think we are a little better technically than a number of other countries. But there is still a danger. Fortunately, most of those players are a bit of opportunists. They take the easiest goals and then encrypt them. If they manage to get in, and if they don't, they skip the next one. 19:26.836 --> 19:54.798 [SPEAKER_01]: Compromising WIO, classic hacking where someone got inside, is also something we are afraid of. An advanced threat actor. Typical state espionage or an actor with somewhat more resources than the typical ransomware attacks. If you have enough resources, it is almost impossible to detect them. And it will take quite a lot of time to try to find them. 19:54.815 --> 20:13.276 [SPEAKER_01]: Then the threat picture is changing. Are we well enough rigged for an inside? We have always rigged for a large degree of trust, and we should have that at a university. But now it may have started to change. Perhaps we have to think a little differently. 20:15.250 --> 20:35.315 [SPEAKER_01]: Will take some examples. Here we have Giant, which is the research network in Europe. They say that the top three in Q2 in 2025, with an increase in the most exposed sectors ... 20:36.125 --> 21:02.753 [SPEAKER_01]: I'm not sure if I see the same as those numbers. I called it cyber shampoo. In shampoo advertisements, they say it gets 20% better every year. I'm not sure if I agree, but it changes. You have the same with Ederkaas. There we have training on top ten for 2026 about things that should be focused on. 21:03.901 --> 21:26.885 [SPEAKER_01]: A blog post talks about the fact that if cybercrime were a state economy, it would have been the third largest in the world after the USA and China. And they sell for more than the total turnover for drugs etc. in the world. So it's big business. 21:26.902 --> 21:44.705 [SPEAKER_01]: How can it actually happen? Is it dangerous to click? As we say in the course, be skeptical. And then, as the lawyers say, it depends. If it is dangerous to just click on a link, we have technically rigged things incorrectly. 21:44.722 --> 22:12.245 [SPEAKER_01]: It shouldn't be dangerous to click on a link. But it could still be what triggers an event. If you have an unknown vulnerability or a poorly updated software, then that click could be what starts that chain reaction. Another thing we see a lot of now, which has become a new trend after we switched to multi-factor autodisation. 22:12.262 --> 22:39.937 [SPEAKER_01]: It's a new way of deceiving people. Before, when you came to a website, you were told to put down your username and password. Now they set up a machine that works as an LE. So when you get to a place, it looks like you're going to log in. But it's just a website that sends all that transparently on. 22:39.937 --> 23:09.046 [SPEAKER_01]: Then they have the same access as you. Here we may be a bit lucky. We are a little different from many others. We like to do things ourselves, so we have changed a bit on the webloggen 2 point with us. I'm not sure if the tools they use here work on that. So maybe we're steering away the big masses for now. 23:10.582 --> 23:33.329 [SPEAKER_01]: But the attackers are adaptable. They observe changes and trends. They observe when we introduce a new email system or change archive systems. We are quite open. We publish news, and they match email campaigns and the like to the events taking place in our infrastructure. 23:36.620 --> 23:59.536 [SPEAKER_01]: I'll look into what we see of attack. There's no big bomb there either. It's phishing. You'll probably get your dose of it. Fortunately, we've got some new mechanisms that make it a little easier to remove the pencils. 23:59.553 --> 24:15.331 [SPEAKER_01]: Microsoft catches up as Fishing, so it has helped quite a bit. But we are now entering the period of package fraud. They will surely come Christmas signs together with Christmas calendars on TV. 24:15.331 --> 24:45.048 [SPEAKER_01]: We are seeing attacks against end users. E-mail, SMS, phone ... And much of the reason why it goes that way, is that it is getting pretty good technically in some places. And then it's easier to trick the user. It's much easier to trick a user into doing something he's not supposed to do. 24:46.415 --> 25:13.567 [SPEAKER_01]: Classic hacking, we don't see much of it anymore. But we see some of it. And it's typically outdated and forgotten systems. Fortunately, it's still cleaning faster than it's being messed up. So long. But someone has set up a website to present research material. And then they might have resources to build it up, but not to maintain it. 25:14.393 --> 25:18.038 [SPEAKER_01]: There we made a move last year which was a bit funny. 25:18.055 --> 25:44.937 [SPEAKER_01]: We introduced a bug-bounty program. Some commercial companies have it. We are a state organization. We can't give out money, but we can give out some praise. We set up a program where if you find a mistake with us, you get a thank you note. And if there is an extra important mistake, a list of the Hall of Fame is set up. This became very popular. It looks like half of Asia got it. 25:44.937 --> 26:14.283 [SPEAKER_01]: So we've got a lot of inquiries from there where people spend infinite free time finding vulnerabilities in old systems and reporting us. There's even a picture of people printing out the diploma they got from us, and are very proud. Advanced players. I guess I have to say that I don't know. It is perhaps naive to think that we don't have anyone with us. But for now, I hope that we have built our infrastructure 26:14.300 --> 26:35.613 [SPEAKER_01]: So solid that it is difficult to operate completely invisible. But we can spend less time on the slightly boring, classic attacks. We can spend more time digging into the perhaps slightly more dangerous things that we should look for.