WEBVTT 00:00.031 --> 00:23.977 [SPEAKER_02]: [Automatic captions by Autotekst using NB Whisper. May contain recognition errors.] So the mandatory KI slide comes with KI and takes us. The answer is probably not yet, but quite soon. We see increasingly error-free text. When someone sends phishing apps, it is much easier to write perfect Norwegian than before. 00:23.977 --> 00:50.234 [SPEAKER_02]: It is also easier to adapt to style and chargon. For those who may have an everyday life where they use email. If someone had obtained some of those emails and managed to imitate your language, how many people double check that the email where someone asked you to do something, actually comes from the person who sent it and is not a tricky email? 00:50.251 --> 01:15.884 [SPEAKER_02]: And some manual work can now be automated. So there will probably be a number of things there. But you don't need fighters if you can manage with a slingshot. The attackers are still where they jump over the fence where it is lowest. Last week it was sound and image in Norway that were hacked. 01:15.901 --> 01:44.960 [SPEAKER_02]: The attack was to show a textbox that gave instructions to open the run field on the window. Then it should glue in a text and press enter. It is easier to write that instruction than to make that attack technically. But when will they come and get us? That's also a good question. 01:46.192 --> 02:16.178 [SPEAKER_02]: KI is just a new tool and can change the balance. Open AI, which is behind ChatGPT, is now working on a project called ArdVark. African for groundhog, I think. It's someone who lives on bugs. But then they've used their technology to create a full machine looking for vulnerabilities in software. 02:16.178 --> 02:43.533 [SPEAKER_02]: Rigging up, trying to exploit the vulnerabilities, making patches and running it in a loop. So it works as a team of good security researchers. If they get it here to go, then it can go both ways. If they end up in the hands of someone, they can find vulnerabilities and attack the world much faster than they could before. And if they use the kind side, you can close security holes very quickly. 02:43.550 --> 03:07.462 [SPEAKER_02]: Open source projects pro bono so they can clean up vulnerabilities. But which in turn can settle in another place. And then maybe you have a few poor developers who suddenly receive reports with hundreds of errors. Then it is not certain that they have enough free time to fix it. Codemander from Google is a bit of the same thing. 03:08.980 --> 03:36.925 [SPEAKER_02]: Then there are also things like clode code and codex. Codex is from OpenAI. It is a tool for programming which takes normal programming with KE a notch further. Instead of writing text and getting text that you have to glue in, this does it more automatically. Then you can describe in text what you want it to code for you. 03:36.925 --> 03:40.064 [SPEAKER_02]: Now I'm done with the software. 03:40.081 --> 04:09.460 [SPEAKER_02]: It makes it easier for attackers to create codes. And for security officers to protect themselves. A rather exciting time we are entering. Deepfake sound and image Gard mentioned. There have been a number of incidents there. Not long ago they spoke from DNB. There a deepfake video had been made by the director of DNB, who was present at a Zoom meeting. 04:09.460 --> 04:16.632 [SPEAKER_02]: And it was with old technology. So if you start with newer technology. 04:19.585 --> 04:43.919 [SPEAKER_02]: Another question is whether anonymous data will remain anonymous. With the enormous possibilities that KI provides, you suddenly have old assumptions that are no longer true. He finds some data points, and that is enough to reidentify data. 04:47.041 --> 05:13.298 [SPEAKER_02]: Perhaps KI can also create new and good enough data sets. Can train a KI on the entire population and get the same demography? And then it has suddenly created some new opportunities to be able to research data that is not personal data at all. Yes ... New security challenges. 05:13.315 --> 05:42.374 [SPEAKER_02]: It's probably a lot of the same old. Something I'm also afraid of, is if you suddenly get a machine like that which can exploit all your vulnerabilities. Usually they have said that an attacker needs to find one hole, while defending a network needs to block everyone. And if the attacker can try to find all the holes and exploit them at the same time, it can be quite challenging. 05:42.391 --> 05:44.078 [SPEAKER_02]: We will see how it goes on time. 05:47.858 --> 06:16.259 [SPEAKER_02]: Then I can jump a bit on why training is important. We lift the floor. We have a minimum level. Everyone has heard of something, and they know where to go if there are things they don't get from that training. The end user has become the new firewall. 06:16.698 --> 06:40.002 [SPEAKER_02]: There is the final user, which must be the first rod. Then there is finding a balance. Because technology provides wonderful new opportunities. And often technology runs a little faster than training. When you think about training or security things afterwards. 06:40.002 --> 07:06.513 [SPEAKER_02]: Last week there was a serious vulnerability in a library called React. It is a library that Facebook has created for fancy websites. It got a score ten out of ten. It was quite critical. The problem is that when many people have started coding with KI, they don't even know they're using it in the library. 07:09.668 --> 07:39.638 [SPEAKER_02]: Last slides. Predictions for 2026. I would like to believe that the number of vulnerabilities detected fixed will increase. It is quite easy and no bomb. The number of incidents due to unwitty and immature use of KE I think will also increase. We have seen some in the media with Tromsø municipality and you have other vulnerabilities. The fact that KE makes it easier to code also means that some who might not should code, starts to code. And that keeps people like me at work for a while longer. 07:39.655 --> 08:04.563 [SPEAKER_02]: Geopolitical changes will put IT under more pressure. Can we trust the cloud services? Where do we have our data? How will this change? We are starting to use technology and products more as a political means of pressure. Will Europe be independent of the big American IT giants? There are good questions that don't have very many good answers. 08:04.563 --> 08:33.757 [SPEAKER_02]: There is a point there too that is a bit like a cross of thought within the security world. That fewer and fewer reports are coming out about hacking from China and Russia. And then it is speculated whether a number of companies are starting to gain so much economic interest that they are afraid of teasing someone. So when it gets a bit quiet, a number of things take place below what we see. 08:33.773 --> 09:01.752 [SPEAKER_02]: Supply chain attacks are coming. It's a bit of a technical term. Value chain attacks. If you program something, you often use many components. If someone suddenly has a vulnerability in one of those components, can you have an overview of where it is? If a baker suddenly learns that one of the bags of flour was toxic, can you find all the cakes in which you have used that flour? 09:02.630 --> 09:21.867 [SPEAKER_02]: And then there will be more fishing. Yes, that's what I had. Then I'll put the word over to Linn Karine. Yes, hello. I'm on. Great. 09:24.010 --> 09:33.460 [SPEAKER_00]: Then we will help you get started with the basic course in privacy. Or I will help you get started. 09:36.228 --> 10:05.472 [SPEAKER_00]: You will find our course in Canvas, i.e. UiO's learning system. Perhaps best known among students and teachers. But now all employees will enter Canvas and take the course we have created. All employees must have received a link by email. And our future colleagues will also get a link by email in connection with their user accounts being created. 10:06.350 --> 10:31.865 [SPEAKER_00]: The Norwegian version of the course is directly available in Canvas. So if you already know Canvas, just log in and it will be there. If you need the English edition of the course, there are a few more steps. But they are well described on the information page for the course. It looks about like this. 10:32.675 --> 10:53.178 [SPEAKER_00]: And if you scroll down a bit, you will find the button that takes you directly to the course. When you enter CANVAS, it looks roughly like this. 10:56.232 --> 11:20.414 [SPEAKER_00]: As mentioned, it is a fairly short course. It will take 20-30 minutes. It consists of three main modules, five including introduction and conclusion. And then there is a quiz at the end of each of the three main modules. There is a part text, there are some videos with sound, and then we have some illustrations. 11:20.414 --> 11:46.115 [SPEAKER_00]: And navigation in the course is done at the bottom of the text. Possibly in the menu on the right. Then we have been around a bit and informed about this course. And some questions have appeared, so I thought we could take the questions right away. Has my implementation been registered? Many people wonder about that. 11:46.891 --> 12:02.399 [SPEAKER_00]: It is registered in the part of the fetus that managers and HR personnel have access to. So that means that if you want to be absolutely sure that it is registered in the right place, you can ask the nearest person. 12:02.399 --> 12:30.985 [SPEAKER_00]: And if you are now a manager and think:"Oi, where do I check that?", then we have been informed about this at several meetings, i.a. in the HR leader network and networks for administrative managers. So ask someone who has been there, and you will hopefully get help to find out. If not, I would just have confidence that it is registered. 12:33.787 --> 12:42.072 [SPEAKER_00]: Yes. Does this course replace the existing course scheme? Someone is wondering about that. 12:42.089 --> 13:06.895 [SPEAKER_00]: And the answer to that is no. This is a basic course for everyone. But it is still highly relevant to take relevant deepening courses. Because people have different roles, you need different skills. And other courses may have been adopted mandatorily locally on your unit. 13:10.507 --> 13:35.262 [SPEAKER_00]: then people are concerned about sanctions. And we've talked about that a bit. And then you have to change the password once a week until you've taken the course. No then . We have confidence that people will take the course without more about and but. So we hope that it will go very well. 13:35.279 --> 14:01.655 [SPEAKER_00]: And then we will report the completion rate of the units to the university board. So that we have incentives here to do well anyway. So then we thought maybe we should have a little taste of what we have in store for this course. I have made a small selection here from the part called Simple security rules everyone can follow. 14:03.882 --> 14:29.279 [SPEAKER_00]: Security rule number one - classify information and store it correctly. I hope many people are familiar with the classification guide from before. As Vilde and Espen were talking about, Ujo has huge amounts of data. Then we have everything from the data we publish openly on our websites, to large data sets with sensitive information that we store in. 14:29.279 --> 14:57.173 [SPEAKER_00]: To help employees and students place the information correctly, depending on the information's need for protection, we have this classification guide. Based on the classification of the data, we then have the storage guide and the sharing guide, which show where you can store and share data, depending on how sensitive the data is. 14:57.190 --> 15:11.990 [SPEAKER_00]: And the service catalog is also very useful to navigate in. If you are wondering what kind of services you can use. So read these guides. Have an active relationship with them. It is very useful in everyday working life. 15:14.369 --> 15:33.674 [SPEAKER_00]: Take passwords seriously. Have strong, unique passwords in accounts where you have important information. And that will of course apply to your UiO account. If you are unsure how to create a strong password, there is a link to UiO's password guide in the course. 15:34.366 --> 15:53.097 [SPEAKER_00]: We have two-factor in our UO accounts, and it is a useful measure. But there is fishing today that also bypasses two-factor, by tricking you into giving away both your password and your two-factor antentization. So be alert, is the message. 15:56.725 --> 16:09.466 [SPEAKER_00]: Take care of your devices and lock the screen. But if you close the PC again, it will lock. So you can test that on the occasion. 16:09.483 --> 16:37.023 [SPEAKER_00]: It therefore pays to learn the quick paws. And then I just want to remind everyone to take care of their devices. We see waves of theft, and it's actually only a short trip to the toilet before that PC is gone. So lock their offices by all means. And more simple security rules you will find in the course. 16:39.520 --> 17:06.048 [SPEAKER_00]: So I thought I'd just take a small status. How are we really doing here? We've been talking about 7,000 employees. I hear slightly different numbers depending on how you count. But here we were, approx. at least, on Friday. 1890 employees have taken the course. And then we hope that this number grows quickly until we reach the ceiling on the number of employees. 17:06.065 --> 17:33.217 [SPEAKER_00]: And I hope everyone who showed up here today will be good ambassadors and encourage colleagues to take the course. Yes. If you want to get in touch with us, you can do it at ujo.no. As we take feedback on both the course and ... Yes. Sikkerhets-Simen and whatever you have feedback for. 17:34.364 --> 17:58.748 [SPEAKER_01]: And then it's you again. Yes, thank you very much to the three of you who chatted. Then it's time to brag a little. I said 'Merry Christmas' instead, so what to say then? Yes, Arne and Ragnhild said that ... 18:00.959 --> 18:21.395 [SPEAKER_01]: We are very good. I was included in it, so I dared to say it now. But you are very good. We don't have much nonsense. It's mostly mishaps and stress that make us do the obvious things. Which is crazy from time to time, which occasionally appears. But think about this further. It is incredibly important. 18:21.395 --> 18:48.783 [SPEAKER_01]: We have the moment attackers, who are only interested in clusters here and now. That is what this course can counteract. While you read in the newspaper that when other state actors make things that go into production for many years before you start opening the back doors, Espen will take care of that. So we'll take what's right in front of us then and there. That helps this course a lot. 18:48.783 --> 19:03.785 [SPEAKER_01]: I think it is extremely important, also in private, to take some of this on to children. And not least people like me who have old parents who may be a little eager to press things. 19:03.785 --> 19:25.334 [SPEAKER_01]: I want to brag about our CERT team. They are incredible. They are on 24-hour duty, so don't worry. If you have doubts, it's as the pilots say. Then you contact CERT. If you have some doubts, we have a fantastic local IT, area IT and helptesk. 19:25.334 --> 19:45.449 [SPEAKER_01]: Contact them. And if they have doubts, it's SERT. There is no danger in reporting once too much. If you get a phishing email, send it to SERT. And they have good systems. You don't bug them down. They handle that, they automate. 19:45.466 --> 20:07.505 [SPEAKER_01]: Then we have a group building infrastructure. And one of the most popular things to build today is log solutions. The two or three large companies that make log solutions, they have bought up all other systems that make logs, and then they have turned up the price also into the spruce forest. 20:08.062 --> 20:33.138 [SPEAKER_01]: So what the people do is deliver a log solution which is such that the Norwegian public sector and a number of private individuals follow it. And they know everything about you. But we don't go in and look at everything you do before there is a crisis. 20:33.155 --> 20:59.767 [SPEAKER_01]: Someone has logged into Lill's account from USA and South Africa within ten minutes. It was probably too quick a flight. And that's how Espen discovered that there were suddenly 50 people who had lost their login with two factors. And then they can dig into this afterwards and see. Absolutely fantastic. And then I want to brag a little about these infrastructure people too. 20:59.767 --> 21:24.961 [SPEAKER_01]: There has been a lot of talk about TSD. Want to brag a little about it too. We have been pointed to by the Ministry of Health and Care and the Ministry of Education to create a national infrastructure for sensitive data. It leads UiO together with NTNU and Bergen. And that is because we have had a long work for security, not least trust-building work when it comes to IT. 21:26.885 --> 21:49.396 [SPEAKER_01]: There is a reason. It is often concluded that it cannot be done because IT security and privacy. But it is a reason. It is not just because they are difficult and want power. It is because you do not want to end up in a quagmire. Either at VG or in the Norwegian Data Protection Authority or with encrypted hard drives and a bill in bitcoins. 21:49.396 --> 22:06.389 [SPEAKER_01]: So that's a good reason. And we try to take a sensible amount of residual risk. We may not always have dared to take enough risks. But we work with what is the right amount of risk. And it is incredibly important to be on the right side of the right amount of risk. 22:07.132 --> 22:26.572 [SPEAKER_01]: Part of the IT department is outside when we are done. They are wearing signs. I was proud to show it to Gyda, who made the signs. But I managed to leave it in the office. On mine it said 'knows a little about everything, but not very much about anything'. 22:27.331 --> 22:37.405 [SPEAKER_01]: We are approx. 20 pieces. Feel free to get in touch. And since you said 'Merry Christmas' instead, it's time to say 'Happy New Year' eventually. Thank you very much.