In this episode, we chat with the people in charge of the healthcare and sensitive data collected in what is amongst the world's largest COVID-19 studies to date.

The study known as the Corona Study, is lead by the Oslo University Hospital and aims to examine how the coronavirus spreads in Norway. At the time this episode was recorded the study had been available for 19 days and more than 122 000 people had already answered the questionnaire. 

Dr. Gard Thomassen and Leon Charl du Toit work in an organisation called TSD at the University of Oslo. TSD (in Norwegian) is an abbreviation for "Service for sensitive data" and is a big data/ security platform that researchers use to carry out their studies. 

We talk about how the sensitive data collected is handled in terms of security, and how they were able to set up the infrastructure for the study in less than 24 hours. 

Technical level: 2/5

Show Notes:
https://tv.nrk.no/serie/nyheter/202004/NNFA41017520/avspiller (from minute 12:20)

https://www.uio.no/english/services/it/research/sensitive-data/ 

https://www.usit.uio.no/om/aktuelt/2020/koronastudien.html 

Host: Robby Peralta
Producer: Peter Harket

Send us a text

Who should own Identity and Access Management in an organisation?

In this episode,  Robby speaks to Espen Skjøld from Sailpoint about the evolution of Identity and Access Management - and he also found some interesting people to discuss this with from Equinor and UCPH on the floor of the Nordic Cyber Series in Copenhagen. 

Technical Difficulty: 1/5

SailPoint: Espen Skjøld 
Equinor: Deric Stroud
UCPH: Poul Halkjær Nielsen

Host: Robby Peralta
Producer: Paul Jæger

https://mnemonic.no/podcast 

Send us a text

In this episode, we speak with a security expert that is actually willing to pay money to "hackers" - the Product Security Director in Visma, Espen Johansen.

As you can imagine, eliminating software vulnerabilities in a company with 5,000 developers is no easy task. Mr. Johansen and his developers always aim to improve the security of their software, among other things through organising both private and public bug bounty programs. If you are interested in bug bounty programs, this interview is a great place to start! As he shares his advise for when and what it takes for an organisation to be ready for bug bounty.

Technical difficulty: 2/5

 Host: Robby Peralta
 Producer: Paul Jæger

Related reading:
https://hackerone.com/visma

https://www.visma.com/trust-centre/smb/security-and-privacy/operational/responsible-disclosure/

https://www.visma.com/trust-centre/smb/security-and-privacy/operational/responsible-disclosure/hall-of-fame/

Send us a text

In this episode, we chat with the former Head of the SOC at the Norwegian National CERT, and current member of mnemonic’s Threat Intelligence team. She also happens to have a personal interest in the "Internet of Things" and medical devices. 

In 2011, Marie Moe received a pacemaker to help her heart maintain a consistent beat. As a security researcher, she felt the need to do her homework and figure out everything she could about the device that had newly been introduced to her body. What she found prompted her to join the "I Am The Cavalry" group,  an organisation focusing on the impact computer security has on public safety and human life, which since then has lead a revolution in the medical device industry. 

Technical level: 1/5

Host: Robby Peralta
Producer: Paul Jæger

Show notes:

Hippocratic Oath for Connected Medical Devices: https://www.iamthecavalry.org/domains/medical/oath/

Software Transparency and the SBOM multistakeholder process at the US NTIA: https://www.ntia.doc.gov/SoftwareTransparency

New EU regulations for medical devices: https://ec.europa.eu/growth/sectors/medical-devices/new-regulations_en

Send us a text

In this episode, we chat with the CISO of consumer goods conglomerate Orkla - Antonio Martiradonna. 

In 2017, he accepted the task of building up a security organisation to secure 300 brands, helping us to keep food in our fridges and beauty products in our bathrooms. In our conversation, we discuss the following:

·       How it has been to build a security organization from the ground up

·       How to work with the governance of so many brands

·       Security around the physical production of products

Technical level: 1/5
 
 Host: Robby Peralta
 Producer: Paul Jæger

Send us a text

In this episode we pick the brain of a Senior Vice President and CISO for a multinational insurance enterprise – Bjørn Watne of Storebrand. 

In our discussions with Mr. Watne, we touch upon the topics of:

-          3rd party risk management,

-          “Selling” IT-security to the business, and

-          Security awareness training & programs

Technical level: 1/5

Host: Robby Peralta
Producer: Paul Jæger

Send us a text

In this episode we chat with two of the main contributors to the #OutofControl report, Finn Myrstad, Digital Policy Director for the Norwegian Consumer Council and Tor Bjørstad, Application Security Lead in mnemonic.

The report uncovers how every time we use apps, hundreds of shadowy entities are receiving personal data about our interests, habits, and behaviour. This information is used to profile consumers, which can be used for targeted advertising, but may also lead to discrimination, manipulation and exploitation.

Want to read the report? Click here: https://www.forbrukerradet.no/out-of-control/

Technical level: 1/5

Host: Robby Peralta
Producer: Paul Jæger

Send us a text

In this episode we chat with a cyber insurance underwriter for one of the largest insurance enterprises in the Nordics - Erlend Hjelle from Gjensidige.

We discuss the development of the market, and which types of organizations have been early adapters. Erlend also shares some insight into the types of discussions he has with his clients, and the important considerations which should be taken into account for a company that is interested in such an insurance.

Technical level: 1/5

Host: Robby Peralta
Producer: Paul Jæger

Send us a text

In this episode we chat with a hacker for hire aka pentester for mnemonic - Harrison Sand.

We start out with an update on how it is to work as a pentester these days, where Mr. Sand explains how he works with his customers and what his typical engagements entail. We then move into the concept of crowdsourcing security testing, and Harrison shares his opinions on when an organization should consider using such services, and the differences they should expect when crowdsourcing as opposed to using a "traditional" security consultant. 

Technical level: 3/5

Host: Robby Peralta
Producer: Paul Jæger

Send us a text

In this episode we interview one of the founding fathers of the Argus platform - Joakim von Brandis.
 
He tells us about the background of the platform, why it was created, what it does, and how it is used by security analysts working within mnemonic and its customers. He also touches on the differences between Argus and other security solutions, such as SIEM, IDS and SOAR systems, and how they all work together to detect and respond to security incidents.

Technical level: 4/5

Host: Robby Peralta
Producer: Paul Jæger

Send us a text