Hey everyone, it's Gabrielle over here today at Oxmer Toyota. You all Toyota has released some amazing incentives first time ever. They are doing complimentary first payment for qualifying leases. On a 2021 Toyota Corolla gas, hatchback or hybrid up to $300 complimentary first payment. On a 2021 Toyota Camry gas or hybrid up to $400 complimentary first payment. On a 2021 Toyota Highlander gas or hybrid up to $600 complimentary first payment. And you can get all of this at OxmerToyota at OxmerToyota.com or call us at<PHONE_NUMBER>. Bye guys.


Okay, I warm welcome everyone to this session on bridging science and policy making within the 2030 agenda. The session is organized by Sweden, the Swedish Development Researchers Network and Ministry for Foreign Affairs and myself, Janet Vahemecki and Måns Fellesen are moderating the session. And we have a very nice audience here and I would very much welcome you to interact with us on this topic and a very prominent panel that we will present later. So why this topic? It's science-based decision making is highlighted as very important in both the 2030 agenda and financing for development agenda, Addis Arbeba Action Agenda. It's argued that science and research are needed for innovation but also for helping us to understand why something succeeds or something does not succeed and what happens in implementation of different policies. Therefore, both in the international agreements as well as in the Swedish policy platform for development it is said that Sweden should build broad engagements with academia, research institutes and education institutes and that these institutions should possess knowledge of complex context that links partly explain the varying causes of poverty and the form it takes. So the commitments both stress the importance of possessing and development knowledge but also increasing partnerships and interaction with academia. For Sweden these questions have been a basis for our work. We are a network trying to connect both researchers in between each other and researchers with policy makers. And we currently have around 800 researchers connected to the network and around 200 registered members. We are led by a steering committee consisting of 12 institutional support members and have a secretariat at SCI. So as a basis for this dialogue and for Sweden we have conducted two studies. One was a study where we did a survey on the development research community a survey that went out to the 578 practitioners of researchers who responded to the survey and another one that went out to the policymaking community on how they perceive research. And both of these studies address similar findings. A finding is that neither the research community nor the policymaking community knows what is like topical within the other. So researchers don't know too much about what's happening in the policy framework and policymakers don't know too much about what's current in research. In the research study researchers place increased interaction with the policymaker community as their priority number one. Whilst the policymakers 89% of them respond that they perceive research as very important 72% say that they don't actually have time to keep up with research and interact with the research community and read research. And majority of them also say that they don't know where to find Swedish research or research and how to interact with the researchers. So both communities say that they engage too little with each other and they wish to be more connected to each other. A topic that also discussed in both of the studies is then that how does actually research innovation happen where and how does it actually take place and arise. And a clear response from both is that co-creation is needed that we need to be very engaged with each other. The researchers need to be engaged in the policymaking process very early and policymakers need to be open about the policy problems that are there and that's how innovation actually happens and also knowledge of each other's communities increases. However both studies both that there are lots of bottlenecks and hinders the current financing rules, procurement rules and incentive systems in both of communities are hindering this type of co-creation. And this is of course something we want to raise here that how can we do more about that and how can we increase the interaction between these two communities. So motivation from MFA side for this seminar. Yes, some motivation. Thank you Janet. I think you have set very much the scene, the frame for the discussion today just from the policy side I would like to emphasize the importance of including research in the work of the 23rd agenda and that is about action agenda as well which is very much the implemented means of implementation agenda. Particularly looking at the last agenda which is the sort of means of implementation. We have a separate action area in that that talks about research and innovation. So it's very much a central component in the work on the 2030 agenda. We know also later this afternoon that will be a separate seminar for the launch of a new research strategy within the research corporation. I guess most of you have been around for a while. You know that research is a very long tradition. Support to research is a very long tradition within development aid. And this is because I believe that the Swedish government believes in research as part of societal development. This is not just about producing research. It's also to try to build research capacity and this is very much the objective of this new strategy also for development countries to be able to identify and carry out research be part of the international research community. This is very much also of course the main argument for the Swedish support to research in Sweden. So it's very much based on the same rationale. We know that we have a lot of research going on at the Swedish universities. A large proportion of this research has direct bearing on the work on the 2030 agenda. So but it's not just about producing research. We also need to to some extent make use of this research. So the interaction between the research side and the policy side is central. This is why and this is the rationale why we are organizing this seminar this panel today to discuss the interaction between research and the work on the 2030 agenda. We will circulate around questions of how is the situation now. What are the main challenges of barriers that we encounter in this interaction but maybe importantly also discuss with the panel and also in interaction with you the audience on what is the way forward. How can we increase the interaction of research into policy making? What do we need to do? So for this without further ado I think we will enter into the panel discussion and we have prepared the panelists with a few questions. First with the audience, sorry. I'm jumping ahead the program here. So we have a few questions for the audience first. I first want to know who you are here and what you think of these questions by just raising your hands. Just checking who is from who are researchers research community here. Good, quite many majority perhaps and who is representing the policy community here. Anything else? Third option. Yeah, you are in between. Yeah, good. Great. So what do you think? It is important to bridge research and policy making in the implementation of 2030 agenda. Raise your hand if you think it is important. Very good. Almost everyone at least. Good. Next one. Research is well integrated into Swedish development policy. Like two or three hands. Okay, good. There we have some questions to discuss then. Then for the researchers, as the researchers I know how to contribute with my findings to Swedish policy. One. Okay, rest of you don't know. Now it's a very similar finding in our study that the researchers say that they don't actually know who are the policy makers. So it's very good to know that. Okay, as a practitioner then, those who are practitioners, I know how to access relevant research to feed into my work. Two. Okay, good. Three, great. Then we know a bit about how you think of it and I hope we can discuss more. Now to the panel. Sorry for jumping ahead. This was some food for thought and for the panel also to see the response on these questions. But I will start by presenting the panel that we have here today to discuss this topic. We have Thomas M. Christ, chair of CEDA scientific advisory board. Welcome. Ingrid Öhrborn, chair of committee for development research at the Swedish Research Council. Anders Haagfeldt, vice chancellor at the Psalm University. Olle Peter Uttersen, president av Karolinska Institut. And Gabriel Bixram, government national coordinator for agenda 2030. So very welcome to you all. I will start on sort of a question that addresses the situation. And I think I will pass this one to the policy side, which means Gabriel in the first place. But maybe also for the vice chancellors to reflect on this question as well. The question follows, how are you at your institute organization integrating science into policymaking on the 2030 agenda? Could you provide some concrete example of successful project programs? Yes, well, first of all, thank you for having me at this eminent panel. I would say that for me, I am actually formally I'm working as an inquiry, independent from the government office. And in that capacity, me and my team has focused quite a lot on research and how to start a dialogue with the research community but also how could we promote projects that take on the very difficult question on how to speed up the transformation process in society. So I have actually two examples of what we are doing currently. And the first one is that we are working with Stockholm Environment Institute, who has developed a model that they call SDG synergies. I'm sure that many people in here know about this model, but it has primarily been directed towards countries and national governments. Because the aim of the model is to see how few of the SDGs do you need to work with in order to reach as many of the SDGs as possible. But we have seen that this is a demand also for the municipalities in Sweden. They also have this difficulty. And now we have worked with five municipalities and we have linked them to SEI and they have developed this model at a local level with quite a high degree of success. And the other thing that you actually addressed in your introduction is about how do you create policy? And I think that one of the problems is that the government office and the parliament still believes that policy is formed as it is in the theoretical model. You have a problem and then you have all these steps and then you have a proposition and then you change reality. But everyone here probably knows that this is not the case. That you have all these steps and you mix them depending on which problem that you are facing and which one that is addressing the problem. So we are trying to work well realize an idea that has been discussed quite for a long time about policy labs. A policy lab where you could actually put all the actors around the same table and identify problems and identify solutions and then you identify on which political level they should be implemented and addressed. And we are doing this around the very difficult question of promotion and prevention. This is two examples of what we are doing at the moment. I think you addressed as well. Okay let's first say on a very general note that I think this is exactly what we need to do to bring science and policymaking together. These events, this type of event is essential. I think Ruder Kipling said that this is east and west is west and never the twain shall meet. I think he thought about this very question when he wrote this long time back. So this is really key. And I must say on a personal note that the essence, the importance of this issue is very close to my heart. As some of you know I was working as a chair of Lancet commission some years back in time. And what we saw quite clearly is exactly this, the need for a better integration between policy and science. The topic of this Lancet commission was exactly the same as the topic we are discussing today. Inequities, how to deal with inequities in a long term perspective. So congratulations to Global Life for hosting this particular event. It's a very seminal and important event. So how do we proceed from this very overarching principle. Well, at KI we are trying our best but we have to be a bit humble. It's an uphill struggle. And one thing that really represents a challenge is the difference when it comes to timelines. We are talking about the difficulties of having time zones in science because we have to deal with scientists in all the parts of the world. But this is nothing compared with the different timelines that we have to get attentive to when it comes to science and politics. I mean we as scientists we have the privilege to be long termists that's a new word to adhere to long termism. I mean we have the possibility of working with a very long time horizon. But in every encounter with politics of course you realize that this is a privilege that is not shared by the politicians that have to work on the shorter timeline. I think this is one of the major obstacles for getting science into politics and but at KI one of the things we are trying to implement is a new mode I would say a cooperation with other countries and not in this case South Sahara and Africa. We have as many of you perhaps know we have established a new center the center of excellence for sustainable health where the term sustainable health is doing exactly this pointing to the long termism the need to have a long time horizon for everything we do and in this particular project involving not least Uganda and Macarete University we are trying to look beyond the first publication to see how can we go one step further don't leave the research project when the first publication is out but to see how the results can finally be implemented in new policies. So one term that I would like to see being in place but I don't see that so many respond positively to this but well repetition is an arch implementation red in this level that when we engage in a research project we should from the very beginning ponder what will it take to implement these results into new policies and of course implementation research is key in this particular issue when it comes to this particular issue I have some concrete projects that I would like to mention but now I spend too much of your time and perhaps my time so I leave it for the next intervention. Thanks and it's a very important question of course and I think about it it's at different levels one level is what do we do as much specific concrete as possible one sort of low hanging fruit in a way is to work on our with ourself our campuses, our buildings and there I do see a lot of things happening with the collaboration with the academic schools for example how do we think about energy production or energy savings in the buildings and there is a lot of actions going on there biodiversity on our campuses and also to think about production and consuming how do we buy things and so on so that's very concrete I would say with our administration in a sense and the planning building division and then I think about what are we doing in a more research educational aspect and I do here when I go and meet research centers or departments that this is our research and I remember for example the pharmaceutical department developing new drugs and so on and they immediately when I say this is our sort of goals and targets and this how we link it to this SDGs and so on so that's very interesting to see and I see that quite often actually on more futuristic and then we have education and long term sustainable platform run by students for many many years called CMOS I think that's a very interesting platform in terms of more coming up things we are at the moment planning for let's say a strong initiative on bringing together sustainable development questions of course you realize when you become Vice Chancellor that it's a lot of things going on but can we coordinate this and make it powerful can we make it stronger and that's what we are looking into and I would like to see quite powerful support from Uppsala University I have when I sort of put the groups together to work with it I had a very loose let's say Direktiv as we say in Swedish make something different just is probably what I said something like that what could be a bit unique with Uppsala in working with these issues and I think one thing which we discuss here is the conflicts of goals you have different goals and then you have to how do you meet them I think that almost requires research in itself how do you work with complex issues where you have so many conflicting goals and how do you sort of create something from there I think that's interesting another support we are looking into is to work with Africa as a continent we have also there several initiatives I see back over from international science programs who have done this for 60 years and others also work with that and can we coordinate this effort a bit and create something interesting in Uppsala on Africa as a continent to collaborate with and so on I see this is very exciting to come up I think also when we discuss co-create, working with policy and politicians industry we are a little bit stuck in our boxes in a way we discuss it over lunch we talk from the university a lot of our autonomy we should not let anyone tell us what to do the politicians are things the same we should do this and sort of I think we have to lose a little bit and also be humbled that we also have to engage and include others when we discuss we can't just do research for five years I think now we know everything now we can tell the politicians what they should decide and the politician has maybe two days to discuss this so we have to be part of this together also when we build up what we are doing and implement it's not only to create but also to implement and I think we need long term aspects this takes time to develop trust, collaboration not the least when we are collaborating with other countries and our institute so I would think that that one thing we need to ask for when we ask for funding and so on is that think about this this takes time it's not only three years project from VR or from SIDA or what we think we have to build up things in long time thank you, stop there thank you so much anyone from the panel that would like to supplement or add something to the discussion from SIDA or I think I heard some very interesting ideas coming up here and just some reflections from I'm representing the research community and the SIDA scientific advisory board so the word co-creation came up and I think it's really a key concept when talking about bridging science and policy but I think three very important parts of co-creation one is the co-design where you together identify what is the problem and how are you going to solve that then you have the process of co-production where you together interpret results and produce the knowledge needed but the third part I think is crucially important and has been overlooked and that is the co-implementation implementation has been mentioned but I think we still lack very much clear incentives for research community to engage in implementation processes, particularly long term even though we know they are so important it's a very important learning part of what succeeded what failed and so I think that's where we have a mutual interest among policy maker practitioners and if we have the incentives for the research community to engage I think a very fruitful process so when we talk about co-creation and importance I think we should reflect on these three dimensions and the last one still we need to push much harder for and develop incentive structures for Ja, and I can add a little bit to this with some of the experiences and work we are doing in the Swedish Research Council just now so looking at it from the researchers perspective I think to start I mean projects of three years but I mean your career scientists are usually many more years to keep learning and sort of adding on from one project to another and build groups and so on so what we have been doing now I mean is to work further on the relevance if you have applied for money from the research council you know that you need to say if this is relevant for development for poverty elevation eradication and sustainable development but we have taken it much further to be much more concrete so think when you plan your project how will this contribute and even think about so what will be the pathways to impact for this project so this is the first year I mean now when we asked scientists to do that in their applications and we are looking forward to see I mean some of you might have read the applications I have not so how did they manage because if we think about this from the beginning and it's graded with as many grades and all other criteria science quality out of the evaluation so I think that will really lead to a learning among the scientists to start to think another way which we haven't managed because it requires more funding but which I have experience from other bigger projects is to actually bring on board both the communication people and policy institutions in the research team from the beginning I mean in the beginning they might have a low profile or high in the design it depends a little bit on but very soon when they see we work for example with EGAD in the Horn of Africa in the first year they were only like say something about sites but then after a year and a half when we met again and they said okay you are actually doing something concrete examples and now they approach us so we easily or our research partners in Kenya, Uganda very early before any publications but just see things on the ground so I think if we manage to get at least some calls big enough to actually bring in policy actors and communications people from the beginning because we are not always that good in communicating so without them maybe EGAD wouldn't have understood how they could benefit from the researchers after one year so that just some examples how to work Thank you very much just if you can very short reflect upon what you think are the main barriers for the intro, you have been touching on this but if you can just put some words on each of you what are the main barriers now or challenges that are now hindering the interaction between science and policymaking specifically in relation to the agenda Maybe you can start Yes, so one thing I think scientists were not really trained at thinking about sort of the learned term effects because we have become so tactical and strategic in getting new research grants and new PhD students in so we need to have incentives for different behavior I think and of course the leaders of the universities can sort of help to see how to develop that I also think it is to to be able to have a bigger funding for the different projects and also bring in components of communications and other things from the beginning so I think the short term thinking even if you talk about long term and what did you call it scientists are living in a three year cycle word and I think that is hindering Shall I continue I agree with what you said I think overall barriers are linked to incentive structures or lack of incentives both in the academic community and policy community so for example you would need much more engagement from policy and practice in the academic part in sort of reviewing papers in sort of the academic publication process but there are no incentives for someone in policy and practice too of a day of reviewing a paper and you get no reward so there is a need for rethinking how we could reward people from policy and practice in sort of increasing the quality of the academic part and therefore in the academic community we need a new incentives as I said before for participating in the implementation process particularly in the long term I think that is very crucial and we need to think hard Ja, I also agree on the long term as we discussed and I think a little bit more on the sort of different boxes we are using I think the government in a way says well we say that here is the amount of money we send it to let's say the research council to distribute it or make calls and the funding agency says when we make a call and then researchers apply and then we don't talk with each other and we shouldn't talk with each other and there also is I think we need to rethink that a little bit and we say sometimes when we do that we call it lobbying and that's a negative word but it doesn't need to be that if we say co-creation is a positive word and I've seen also European networks which has much more lobbying in a positive way and I think we can learn from that also in Sweden actually so to be a little bit more open and humble to say that we can actually learn from each other and create something together and be on the same journey in a sense and I don't know kind of new hardip soon in a way could be interesting in politics and science for example I would like to underline something that Thomas said or the point you we are making incentives especially in politics nowadays where science is not on the very top of the political agenda to say the least but also in the research community I would think that this is quite hard to make a career of getting involved in policy and getting involved in policy requires you to make compromises and making compromises with your own research I could imagine not that easy so co-creation you and many other point too I think that is really the way forward and trying to find organized ways of scientists to be employed in municipalities in government and so on and politicians too I think that is really harder to get out the way around to get the scientists in government and in municipalities and regions is the easy part I think it was a very interesting thing to hear that we as scientists we have a shorter term in our thinking and planning than the funding bodies it's an interesting discussion the thing is no scientist is an island that's the essence it's true of course that an individual scientist might have a short term ambition for his her own career development but the point is that every scientist is part of a research community and the essence is that this research community in this case for example of a center for sustainable health if this scientific community has a long term vision this will be reflected in the research carried out by the individual scientist so there is a huge difference between what is the time perspective of an individual scientist and what should be the time perspective the time horizon for the community of which this scientist is a part so I think that the scientific community has an obligation duty I think to ensure that scientist is part of a community with this long term vision that in fact ends hopefully in the implementation of research into better policies as you know there have been people saying that you can stop all research and just focus on implementation and that will be good enough for afrika for example for 5, 10 years to come I mean there is a tremendous lag when it comes to the implementation of new results for example one thing that came up just a few days ago is the lag when it comes to the implementation of knowledge on schistosomiasis in South Saharan Africa that's just one example and there are many many others one obstacle that I see very well is in fact and we have touched upon this is that we should this is something we should be self critical of we as a scientific community should be even more willing than we are today to get out of our comfort zones and to work on an interdisciplinary level I mean there are some very good examples that came up in an earlier panel today for example I mean the Ebola epidemic in afrika is just one example I mean how can you deal with such a disease without knowing the tradition of the community in which Ebola arises that's just one example there are many other examples which certainly require not only that we respond to the local needs but that we understand the local possibilities when it comes to implementation so there is a need also in Sweden I think to increase substantially the interdisciplinary interdisciplinary effort today I was alluding to the possibility of increasing over ambitions to form a sort of parallel to Davos to really have a global forum for discussing interdisciplinary when it comes to these very tricky and difficult questions and I don't think I'm naive I think there is a way to really increase over ambitions when it comes to this but one final thing an obstacle we should not only think across disciplines I mean we have to think along the entire sort of value chain when it comes to the way from education to research to implementation we have to ensure that we can engage the global players what happened now in South Africa they came up with production facilities for vaccines and they saw that the market mechanisms were not in place to sustain the production of new vaccines in South Africa that means that we have to engage the world bank or whatever the global players that need to be in place so that we have the entire value chain intact we are far from doing this and that means that many projects even driven from Sweden they fail because we don't engage the entire sets of actors that need to be in place to see research being implemented thank you thank you so much very interesting reflections there seem to be a consensus in the panel around the problem of shell at the barriers and so on we know also at least when talking from the policy side that we have a lot of different policy processes not least within development aid all the country strategies and so on that we are producing regularly we know that we are talking very much about the need to engage with the research community and to have so called science based knowledge into the process we also know that the scientific community is pretty absent in these different processes when we have start up meetings the last question is very much going to more hands on the situation we know the relevance we know also the barriers and the challenges concrete examples of what can we do what can we do to increase the interaction between policy and science but also from the policy side I give the floor to Ingrid to start again if you want yes, of course it's not exactly easy to say what can we do and I also know scientists actually try to engage for example the country programs where they were quite uninterested in research because that was in another strategy so maybe you also need to think about how these different government strategies relate and because people really should know this is our money and this is your money don't try to push research into the agenda for this and that country because it should be paid by another box so I think also people have tried but not so successful a year or so ago but of course we should not give up but I would also like to see it from another direction I mean in the new strategy and it really says that we are going to work on equal terms with our collaborators in the least developed or some middle low and middle income countries and I think that also needs to be the point of departure for the policy because if we just see it from the Swedish perspective and it is about the development policies and so on I don't think we get anywhere so most of the things I've learnt in interdisciplinary work in working like from science to innovation policy and practice it's very much been both in international research organizations and in collaboration with national partners in the least developed or middle income countries so I would like, I think if we take it from there we can bring scientists on board being very engaged in those different national and regional collaborations and like not only think about the Swedish side because I think we are more stuck on the Swedish side than we actually are in the development on the ground Thank you so well I've been thinking a lot about what to actually to do to promote more interdisciplinary and transdisciplinary research and what you could actually do to have more success and I think I come to the conclusion that it's a question about mindset to a large extent and maybe by using what I call framed creativity it could be a way forward and what I mean by framed creativity is actually you define sort of the game plan but then you let actors be very creative within that within that frame and I could give you one example we in the scientific advisor board are discussing as part of perhaps what could be part of to operationalize the new strategy which you will hear more about this afternoon the concept of one health and I think all of you might agree that it's a very exciting concept that would create a mindset for a framed creativity because it sort of emphasize how you link planetary health with human health anything in between so it would include natural science, technology but social science, economy human science and medicine of course but in a new way where you actually emphasize the linkage between planetary health as you understand it and human health and how you're going to go to maintain that health in the long term so I think that's an example how you could create something that will perhaps induce more collaboration among scientists that haven't collaborated and also be very policy relevant Thank you We have in Uppsala a very interesting center called Cedricus and that is dealing with interdisciplinary which we all agree is very important but this is not on a specific topic but how to do interdisciplinary research and support that and I find that very interesting as a topic and it's been very successful and in support to create interdisciplinary center for various things but also looking into research and when I mentioned that to directors of funding agencies or politicians, people get quite excited and interested, what is this so I think there is for example a chance to invite politicians to start to discuss we are handling complex issues, how do we actually do it, well it's a topical interdisciplinary but it's also intersectoral effort we need to do and I think that could be a starting point to also invite politicians to do that there is another discussion going on in the country on the enormous need of competencies in new technologies, for example electric cars I need 10,000 new engineers to handle batteries, the combustion engineers are old and it's a complete transformation of the need of new engineers, how do we support as a country that many engineers and you can go through the pharmaceutical industry and others and sustainable development of course and there is a discussion actually going on between researchers and our ministry for example how do we handle such we can't handle that alone completely and what is nice also not only one university can handle so many students so it has to be a national effort at many levels so there are examples coming up I think there are a couple of things that we can do and first of all we have a tendency to focus at the national level and you equalize policy with national politics, I think that we should start with the local level municipalities we have many small municipalities not only in Sweden but around the world and they lack knowledge and they lack many times resources and for them to have access to the latest research science is tremendously important it could make the difference for them when it comes to how to use the resources wiseful and to in so many areas so focusing on the local level should be key the next thing is that we have many fields disciplinärer where we do a lot of research and then we don't take care of what we have found and you were talking about implementation and this is of course especially true when it comes to promotion prevention in health where we do a lot of research and then we have no national body that will take care of this research and that will see to it that it is updated and so on and we have the same situation in many other fields and this is a waste of money and the third thing is that if we should focus at the local level and if we will do more inventions at the local level we have a problem that we are quite bad at sharing and spreading good examples around the country and we are in this country at least we are also not that very good at importing good policy solutions from other countries we are more focusing on exporting policy solutions and I think that we really need to do something about it because it won't work in a world that is facing such huge challenges thank you Yes, so the question is what can we do to increase this interaction I must say I was shocked when when you mentioned the result of your survey here if I understand correctly you said that policy makers 72% said that there is no time to keep up with research was that correct think about it what this means this is really serious business and it tells us that we have to improve my suggestion is very simple and that is that this should not be a singular event we should establish in Sweden a multi stakeholder platform where we discuss these issues but there is one stakeholder that is I think missing here and that is a stakeholder that often falls into disresput when we discuss these matters but industry has to be brought along I didn't see a single representative from the industry is that true not a single one but look at what happened during the pandemic there are part of the problem but there must also be part of the solution a multi stakeholder platform it can be established tomorrow but it has to engage of course the local community aspects but also as I said the global aspects so this multi stakeholder platform must invite and challenge for example those that are responsible for establishing functioning markets in law registrar settings we have to invite the world bank we have to invite the global governance system I mean we can do that tomorrow and this could be the beginning there is one thing one additional thing which I think is very very important and this is a touch of self criticism and I think over funding bodies alluded to this issue we as universities scientists and I include myself we are so concerned about our status in society with reference to what we are good at but perhaps we should ask ourselves what are we good for and we can do that without encroaching on academic freedom because it's part of the third task of the universities ask not only what you are good at but what you are good for and then we will see that we can make progress and establish also a prior contacts with policy makers without fearing losing out on academic freedom there is no automatic contrast between the two thank you so thank you very much time is running maybe we should just give the panel round of applause for their contributions thank you hand over to Jant yes, we will continue of course with you and want to know any ideas that have come, we have a couple of minutes any ideas from you or questions to the panel please yes I've heard a lot about getting research into policy and practice but I was really wondering can research questions come out of policy and practice and how let's take a couple more Claes, please kring or the real world and there we need other incentives both for co-creation and for using research for societal development let's take one more hi my name is Kaylin I'm a student here at Upsill University and I was sharing your smile when you said you seemed to have a discrepancy in timelines and opinion on that timeline so I just wanted to ask the question again to the panel is the solution or one of the solutions faster research because there seems again to be a discrepancy in who has the short term goals and who has the long term goals so I just wanted to ask that question back to the panel good thanks and I think one Lisa there as well thank you I'm Lisa Ramon from SIDA I think it's great when policy and research meets like this we need to do that much more collaborate but I would also like to stress that it's very important and the problem for the bureaucracy to be literate research literate to actually understand the body of knowledge out there and of course the research community can help in enlarging that given that the incentives are there from both parties and also very important in countries low income countries actually are the object for this type of research and that there are research literacy there among research decision makers and that's where Swedish universities can also be of assistance in order to build that sort of capacity in these communities as well as important as our internal dialogue and the last one there thank you so much for the discussion but it's a little bit disturbing given the opinions in the plenary earlier this morning about the urgency of the matter we're talking about long term we're talking about three year periods we just heard that we're missing opportunity by the day so how are we going to use the knowledge we have now and what are the new structures where is the transformation in this or the revolution or whatever you would like to call it thank you good thanks a lot and now we have five minutes so I will give you all like 40 seconds each actually to take one of the questions and to have some final words if you have from the panel okay so I will pick the one about the discrepancy in the timeline we can't really do like quick research but you can have a different type of interaction so if we from the beginning in the process sort of engage with both communication and policy and practice there will be things coming out from the research process because it's not so much always about like results after many years but just the design, just the approach the research questions that once engaged so I think if we see it as it's sort of a continuous interaction then it's both feeding in and sort of coming out things from this core learning process in the different steps that Thomas outlined so I think that that would be one way to sort of try to combine the robustness in the research but not saying you have to wait for 10 years but we can actually interact from sort of the design of the project and then we can also respond to the question how research question can come out of the policy processes because then that will happen in that process Good, 40 seconds Okay, thank you So I would address the first question on research problems emerging from policy and practice of course and I would view that as a very natural outcome of if you think about this co-design, co-production co-implementation as sort of a cycle that goes on over time of course problems and challenges emerging in practice and policy will then be picked up and scientists engaging in finding solutions and then you test the solutions and so on and I also think the urgency question will relate to that because when you feel that urgency you will naturally speed up the process within that and speed up the learning Ja, a quick response to examples of where I felt that policy can create research sort of questions and input Is this network the guild as I mentioned I think I'm surprised I'm very new to it but I do hear from the guild and we have an excellent director that the European Commission come to ask questions to the guild, we are doing this and there are questions asked and I think it has to do a lot on trust and you have built up that you can, the politician some of them actually understand that they don't understand science and ask the questions to scientists and that is to encourage your course Secondly is my own example 25 years ago when we had money for solar cell research from the energy agency I was a young researcher and to my surprise they opened up the dialogue we were maybe almost the only one in Sweden working with solar cells so it was not so many others to talk to maybe but anyway I felt that very stimulating that they asked we want solar cell research and we want it to happen and we want it to apply it but it's important so we could discuss basic research we could just implementation so it wasn't a dialogue which I find very fruitful so it can happen I just wanted to say something about the result from the inquiry I think that yes, most politicians haven't read an article or a scientific report or an inquiry or a government report and that's the way how ministers and parliamentarians get their information and the latest news from the scientific community I think the real problem isn't that they won't get the answers to different problems the real problem is that they need help policymakers need help the questions that the inquiries will answer and there I think you need a real collaboration between the scientific community and the policymakers thank you I would like to address the question from the student, what is your name again Kelly, yes because I think it's fundamental issue that you're addressing through your question we just had a discussion at KI to allow for slow science slow science has a negative connotation in Sweden but in this discussion there was a student from Harvard slow science is really what is needed that was the mantra from our colleague from Harvard and of course there are instruments in place in many other parts of the world where you can do slow science without being harnessed into the short time frame or projects from VR or other funding bodies but this is in fact a responsibility also of the universities and the university presidents to see to it that when there are interesting projects that we know will take time to mature we should have an instrument in place for slow science unfortunately we don't have that in Sweden but the most important thing is that timeline is not as I said only determined from the point of view of the individual researchers but from the point of view of the research community of which you are a part just one second to Stefan I think what hasn't surfaced in this discussion and that relates to this interaction between science and policy is the issue of secondments internships I don't think Sweden is on the top of the list when it comes to having scientists that's candid to for example WHO EU system the UN system perhaps I'm wrong but I don't think we are at the top of the list perhaps we should improve that and ensure that we get our best scientists for a time being also into the even supranational governing bodies that is an interaction that is needed thank you very good thank you so much everyone and thank you so much to the audience for coming I think one thing at least that we have learned from here this discussion needs to continue that we need to maybe start off the multi platform tomorrow to discuss it further but at least within Sweden we are continuously in this discussion and want to increase the interaction with researchers in different thematic areas demographic areas and policy makers so we are trying to be that link and be a matchmaker so please if you are already not involved in Swedish activities please join our assembly tomorrow for 45 in room 4 I think at least in this building and come and talk to us more or you can also join online or you can join in other ways as well afterwards and to the panel I just want to give you the two studies I was talking about as a small gift with the figures as well and there are some suggested solutions from us on what to do but I think we have heard much more today from the panel so we need to make a third study I think without the ideas but Yes, thank you from me and one still want to say the final words I just want to say that it seems like we have run out of oxygen in this room now, it's very hot it has been a very interesting discussion and I think we all agree that it needs to continue and we need to find especially the interaction points and the for us where we can continue to discuss this also so that we can go from discussion to something also real when it comes to the interaction so thank you very much panelists thank you very much audience for joining this session


I'm watching myself on the stream, there we go. So hi everybody, I'm Hank Leininger, co-worker and fellow organizer of some of the events like the Bastard Village and the CrackMeatCamp contest. So I'm going to give a talk on a defensive technique and technology and open source tool that we ended up developing after sitting around thinking about all these interesting all these ways that we can make password cracking easier, we asked ourselves, okay, well can we turn those into ways to make password cracking harder? The PL didn't watch is we're going to learn from successful attacks and use that to inform us of how to make better defenses. Just a little about me, I came up wearing an assistant min hat and got into security that way, still enjoy building stuff about as much as I enjoy breaking them. And yeah, I sometimes do talks and build things. And Pathwell, the topic of this talk. Like I said, it came sort of as just a brainstormed idea, but my co-workers actually turned it into running code that we released. So kudos to them. So the audience probably includes people that can't spell hash cat and people who wrote hash cat. So I'm going to give a very oversimplified overview of a particular kind of cracking technique for the sake of people who for whom this is not second nature. And those of you who know that I'm oversimplifying, don't at me grow. So we have a bunch of classic defenses used for password cracking. I got to keep in mind that the slides update way slower than I do. All of these standard old ways that we try to make passwords stronger. Yeah, they basically don't work. There's a bunch of talks that go into a lot more detail than I'm going to. But password complexity rules, they helped a little when they were newly enforced. But it turns out humans make very similar decisions in the face of similar policies. And password crackers have figured out the way humans respond to being given certain rules. And we can guess where everybody's going to end up. As soon as we know the password policy of a company, we can guess what a lot of those user's passwords are going to look like. And if we know what their passwords were a year ago, and we know their rotation requirements, we can probably guess what they are today. Just to illustrate some examples, I want to throw some numbers up here, which are rough. Again, don't at me. But suppose you built yourself a budget password cracking rig, and congratulations, you can exhaust the entire eight-character key space in a day or under a day. But once password lengths get up to 9, 10, 11 characters, that becomes infeasible. However, nobody actually tries to brute force the entire key space. We'll figure out what's the most relevant bang for the buck places to spend our compute time. So the math and the proportions still apply, but we're not going after the entire key space. We're going after the most relevant tiny slice of the password key space. So one way to divide up that key space is what the hash cat calls mask attacks, where you say in this character position, it's going to be an uppercase letter. I want you to try every uppercase letter. And in this position, I want you to try every number and so on. And usually you don't do this for the entire password. You do it for I want to take a dictionary word and then tack this pattern onto the end of it. Or I want to take a dictionary word and apply rules that morph it in these ways in these positions. So again, just for the sake of figuring out how to discuss this and do the math, we'll use this way of looking at it in this notation. So suppose you wanted to try every possible password of a specific mask. And so the math that I've done here is if we have four different character classes, uppercase letters, lowercase letters, numbers, and special characters, each position of the password could be one of those four. So essentially, the password key space might be eight to the or 95 to the eighth, but the topology key space is four to the eighth. And if we have an 11 character, it's there's, you know, there's four to the 11th different topologies. If we pick the single topology of uppercase number, lowercase, lowercase, lowercase, whatever, number, number, special, we multiply out the possibilities in each of those positions. And we say to exhaust that entirely, which again, we would actually combine that with word lists or other things, so that we didn't have to blindly guess, we would guess the most frequent, the most likely ones. In any case, if you did want to exhaust the whole thing, there would be 265 trillion possible combinations. And that hypothetical cheapo cracking box that would be totally infeasible to try to reinforce the entire key space could do that one topology in about half an hour. So the question we have to ask for the sort of evaluating the effectiveness of hash mask based attacks is do users buy us towards specific mask pattern or specific topologies? If we could guess which patterns were overused by users, then we would focus our attacks just on those. And we wouldn't have to we wouldn't have to worry about 99.99% of the key space, we would only have to worry about the parts of the key space where the users are all clustered. And again, we would actually combine this with other smarts. So in actual fact, our work would be even less. So at our company at our day job, we do a lot of password audits, both regular routine recurring ones and one-offs when we do a pen test.  Spoiler alert, yes, of course users cluster into common topologies. That's why mask attacks are worth doing. But we wanted to get some science and some numbers behind that. So we analyzed the results of having cracked high percentages of a number of different organizations. The first case study I'm going to throw out numbers of we cracked, you know, around over 99% of current and historical hashes. And then we broke those. We attacked them not with a mask-centric focus. We attacked them with all our regular techniques. But then we did the crunching in the math and we said, okay, how many different topologies were in here and what were the most frequent and how frequent were they? Out of those quarter million different logins and hashes, there were only around 7,000 unique topologies in use. And over 10% of the population use each of the two most popular, actually three of the three most popular topologies. So if we knew nothing about this organization whatsoever, other than that uppercase lower, lower, lower, lower number number was going to be highly successful. We would crack over 10% of their population without a second thought. And if we did all the top five, we would have gotten almost half the company. If we did the top 100, which is still a tiny slice of the overall key space, we would have gotten 85% of all hashes. And by the way, you can also determine, you can discern from the relationship between the number one most popular and the number two most popular and the number three and the number three and four, sorry, three and five, that this organization made their password policy stronger sometime in the history of the dump that we have. Good for them, yay, stronger password policy. No, totally worthless because all their users did was made the word inside just one letter longer and added, you know, another lowercase to that run. So trivial for us to figure that out and go after. Now, this is a graphical depiction of how frequent the most frequent topologies were. Pay no attention to the labels on the X axis. They don't mean anything other than the unique identifier that we assigned to each particular topology.  And then it tailed off very, very quickly and steeply. So there were some users who were indeed special snowflakes, but they were like a handful of them way off to the right side of the graph. They don't help the organization as a whole. Stay safe because the people on the left hand side that are all grouped together, they're easy prey. Nor the organization kind of a similar story, slightly larger hash pool, slightly lower crack percentage at the time we did this crunching, but still well over 90%. So we were confident that the data that we were the conclusions we were going to draw from this data were valid. By the way, to preempt the question that I would ask if I was watching this presentation, all of the subsequent stuff is based on number of cracks compared to total population, not number of cracks compared to total number of cracks. So for instance, when I say that 19,000 people using or hashes using that one topology is 4.3%. I mean, it's 4.3% of 449,000, not 4.3% of 419,000 that we were successful at. We don't know what the 30,000 were that we didn't crack, but we know what percentage of the total the ones we did crack are. So in this organization, the numbers aren't as bad, but it's still a very significant relationship. And it's also a once again, the case that somewhere embodied in the password history that we captured, they changed their policies to make them stronger. But the way people responded to it was, oops, was just to add another special, added another character at the end, which was a special, because they went from requiring eight characters, three or four to requiring nine characters, four or four. So users was like, oh, okay, I'm going to put exclamation point at the end. Once again, didn't stop us, you know, from cracking the new ones. This is the graph for that organization. It's not nearly as bad and ugly, but it is still bad and ugly. So we did this same kind of math across eight or so different large data compilations. We discarded anything that was too small to be, you know, we didn't want a single outlier to skew the overall numbers too much. And we also limited it to ones that we had cracked a substantial portion over 90%. Again, so that the conclusions we were able to draw were sort of statistically, you know, valid for the population, knowing whatever the caveats, you know, you had to take into account. This, this graphic is all of the histograms for each of those organizations not sorted by what's popular for them, but basically stacking on top of each other so that we can see clear patterns occur. This very first topology on the list, it was popular in all five of the organizations or all eight that are included in this data set. Same thing, you know, the number three one was pretty popular. The number five one was hugely popular across everybody. The only organization that was substantially different from all the others is the one that was grafted in cyan or light blue here, where they're a huge tall spike and nobody else is a huge spike in that area. This is a big enough anomaly we dug in to figure out why. And it's because that particular organization had a default password that was so commonly used and still used by all their users, by a huge percentage of their users, that it threw off all the rest of the numbers. And it was a specific outlier just for them. I don't even remember what it was, but imagine it was, you know, one change me, and it was a number one and then all lowercase. And even when people changed their password away from one change me, they made it to change me or three change it. And so their topology was exactly the same as the original password was. Once you once you exclude that one data point, we see there's a huge commonality in which topologies are super common across industries. And these are the companies in different sectors. They are, for the most part, US centric. Some of them are global, but the majority of their user population was still English speakers. So that is one caveat. It's very possible that somebody with alternate language sets that users gravitate towards would look somewhat different. But if you knew nothing at all about a company other than that it had a substantial presence in the United States, take the top five common topologies on this list, attack those, and you're going to get tons of users. And as a defender, this is terrible because even in the strength of what we think of as good password strength policies, we know our users are going to land this way and attackers are going to come after them and hunt them down and kill them. So just to recap the kind of things that all this data crunching told us to confirm our suspicion about the problem and where we ought to try to find a way to improve the situation. Users pick the lowest competent nominator. There's specific things that they commonly do when told that the password policy is getting stronger. And those behaviors, although there are absolutely smart ways to attack an organization specific to that organization, go after word lists for their industry, go after proper names of things in their hometown and sports teams and location names and blah, blah, blah. Still, these trends are going to be common no matter who and where the company is. And complexity rules just don't help. Not nearly as much as we think they do anyway. By the way, another way to think about this in the COVID-19 era is users are not social distancing their passwords. To graphically depict what having 12% of your user population landing in a single topology means, if you were to imagine the land area of the, all right, I should be back. Sorry about that. If we were to imagine the entire land area of the United States as being the possible password key space that users could pick from, 13% of all users choose to live together in a land area smaller than Manhattan.  They just move a couple doors down or maybe one block away. So any attacker knows they don't have to go far to hunt them down. Another thing about this is it applies even to much stronger password policies out of the box. We discussed this with some of our friends that work in places where, and this was going back to 2010, they had rules like you have to use a 15-character password and it has to have minimum two of everything. And they were like, so how strong is that really? And we said, well, it's really strong if you're not a smart attacker. But if you were a smart attacker and use, among other things, mask-based attacks using, targeting the most common topologies, you would have a painfully, you know, you would have a surprisingly good success rate. If you were looking at a large organization with lots of users and password histories, you would still likely be, and you picked the topology that had the most users in it, you would likely still succeed in cracking a password roughly once every 12 hours, you know, for however many millions of years. But you don't need more than a few to get you started. All right. So that's kind of the foundational concept that led to what I'm going to talk about next. So, you know, it became clear we need new defenses, we need new ways to make things harder. The rules that we have now aren't terrible, but they're not enough. And, you know, one of the worst things we need, one of the strongest things we need to do is figure out how to keep users from all congregating in the same place, no matter what rules we impose on them. Human nature says the majority of those users are going to cluster in a few new places, which can still be predicted or discovered by the attacker. So, at a high level, what are some things we could do? We could blacklist topologies that we know are a problem, where we know or predict users are going to land. And not just blacklist individual passwords, but blacklist the topologies, the shapes of those passwords. Nobody is ever allowed again to have a password that's an uppercase letter followed by a bunch of lowercase, followed by a couple of numbers, followed by a special. Just can't happen. Another thing we can do is require a minimum change distance between where your current password is and where the new one is that you want to go to. So, whatever words you're using, if you're using a three-letter word and a four-letter word with the first letters capitalized, the second letters replaced with numbers and a special character in between, you can't use that exact same pattern on your next password change. And also, don't allow your users to congregate on whatever topology they choose to congregate on. This is a term that we didn't know when we were thinking about this early, but which is becoming one of the ways to describe this part is dynamic password strength enforcement, meaning the password strength or the password policies you enforce are adaptive based on what your user population is doing. There's two big costs to this, which are key space reduction and user rebellion. I'll talk more about those in a bit. So, first, what do I mean by blacklisting? It's not that complicated. We figure out what the most popular topologies are usually for a given policy. Like, if your policy is 10 characters or more, it doesn't mean it's not interesting to figure out what the most popular eight and nine character topologies are. And similarly, if you require four of four, then we don't care about blacklisting topologies that are three of four or two of four. By the way, whatever list you come up with as the best ones to blacklist are also the best ones to start with when you're a cracker, you're a Patrick cracker, and nobody's enforcing pathway yet. So, we published what was our working set at the time back in 2014. We and a bunch of others can probably contribute updated data by now. But we also, with just about everything we figure out and publish, we figure out, we assume bad actors have already figured these things out before we started. That's one of the reasons that CoreLogic started the password, the crack if you can contest back in 2010, because we figured bad actors were already figuring out and sharing, you know, password cracking tricks. And we wanted to bring more of that discussion out into the open for defenders and researchers to be aware of too. So, what is the effectiveness of blacklisting? Well, if the attackers have figured follow these exact techniques and they go after, they use a top end approach of targeting the topologies that are most likely to be successful, then when we take those top ones away, they're going to start, they're going to get zero cracks in their earlier, in their initial pass. Instead of getting 25% of the organization in minutes, they're going to get zero in the first hours and wonder what's up. Of course, once attackers figure out what we're doing, and once they're able to figure out what users do next, then maybe we're just pushing the problem around. You know, we blacklist these 100 most popular topologies, and now users are going to congregate in the 100 different ones, and it's just chicken in the egg, or not chicken in the egg, but it's an arms race, we just, you know, go back and forth. Maybe. The next thing we can do, which is starting to get more adaptive, is a minimum topology change at password change time. So without any kind of enforcement of topology change, a user who just increments a number in their password is a perfectly accepted new password. And similarly, even once we're doing it, even if we enforce a thing that says, hey, you can't use the same topology that you did in your previous password, they're probably going to make the smallest change that constitutes a topology change, such as pick a random letter that was uppercase and flip it to lower, or pick a lower and flip it to upper, that would pass the test. But it would still be lower down on an attacker's list than incrementing a number or possibly incrementing a letter. And more importantly, if we say, well, let's figure out how can we measure the difference, the distance between one password and another, and then what's a minimum distance that we want to enforce? So one of our people who is, well, way more educated than I am in the computer science realm, said, oh, that's leverage science distance. And I said, what's that? It was what I wanted without knowing it. It's a science, it's a way to measure the distance between two strings, how many edits, how many inserts or updates or removals or increments or whatever. So just for string changes, you measure the leverage time distance between two strings by looking at how many characters were changed, added, removed. For topologies, we can do much the same thing. So when we look at these couple of hypothetical password changes, if you keep all of the character types the same and you just increment one of them or decrement, your topologies leverage time distance changes zero. But if you change the character class of one of the positions, then you've successfully moved your topology from one to another. And obviously, if you combine more than one thing at a time, you may or may not, your edit distance of the string and your leverage time distance for your topology may be different. And if you go about making multiple changes at once, then it's going to be, it's not going to be the very next thing the attacker tries. When they learned that your password used to be password 20 exclamation point, passwords 20 exclamation point won't be the first thing they try. It might be the 10th. The, you know, more interesting if you change more positions throughout the string. And every time you make a topology change, you multiply out the number of different paths the attacker has to go down in order to try to find you. Okay, so this still isn't really ware leveling. Ware leveling is, you know, comes from, at least I borrowed the term from the way things like solid state disks, SSDs, try to spread their writes out across all of the different memory cells before they come back to one that was previously written to and write to it again. So in this case, we want to take all these users who've bunched up in specific buckets of a specific topology and spread them out. The most ideally ware leveled population of user passwords would have on average, you know, one or less users per bucket or at least no more users in any particular bucket than any other. That way, if an attacker tries to pick any random topology, they're, or rather any topology that they know humans are likely to gravitate towards, they'll get few if any cracks instead of, oh, 5% of your users landed on there on that topology. So we have to think about what, what are the impacts to an attacker of using ware leveling effectively and uniformly. Now, there are downsides to doing it too, and I'll get to those in a second. But if the attacker is used to being able to target that first or the first top five topologies and get, you know, 10% of users per topology, 50% of your entire population in just, you know, 10 topologies or less, if users were spread completely out, then you would end up with something like six orders of magnitude more work to get the same number of cracks or six orders of magnitude fewer cracks using the same amount of guessing time. Now, in reality, it's not going to be that good. And it could be even worse. Suppose the attacker knew somehow exactly which topologies were in use by within your organization, then they could target just those topologies and ignore all the ones that aren't in use. However, because we know that their success rate in any given topology is now minimized, it's controlled, there's not going to be more than one or more than the number of topologies divided by your number of users. In that particular topology, their success rate still drops by two to three orders of magnitude. In the realistic case, where users spread out, but they're not, it's not like you're rigidly assigning them a topology, you may as well assign them a password if that was the case.  But in the realistic case, you're probably looking at a four to five orders of magnitude change in work factor. And again, by that, I mean, it surprisingly to us, it works out more or less reflexively. If you say, I used to spend this many hours and crack this many thousand passwords, I want to spend that same number of hours and see how many passwords I crack. You will crack one 10,000th or so of the passwords you used to do in the same amount of time. And at the same by the same token, if you say, I used to crack this many thousands of passwords, I want to crack that same percentage or that same number, no matter how long it takes, it's going to take you 10,000 to 100,000 times as long as it used to. So what are some costs here? The one that first comes to sort of mathematical minds is I'm blacklisting parts of the key space. That means I'm making it so that there's fewer possible password users could choose. Oh my God, we're reducing our key space. That helps the attacker because now they have less ground to cover. But once you do the math, that actually almost disappears into nothing. So for instance, if you are talking about eight character password length and in reality, there's almost no world and no hash in which eight character passwords are okay anymore. But keep the math simple. Start with eight characters. We're going to have 48 possible different topologies of 64k, 65,000. If we blacklist the 100 most popular topologies, we still, that's less than, that's only around 0.2% of the possible key space. And in fact, if you are talking about nine character, 10 character, 11 character passwords, the percentage of your key space that you're deleting by blacklisting is even smaller if you're just talking about the top 100 out of a million instead of out of 65,000. Now, the thing about forcing unique topology use, or at least spreading uniformly among the topologies that are not blacklisted, you actually do have a problem where any given randomly selected topology is now more likely to have a password in it than before you impose this rule. But if you think about the fact that what we're getting rid of by doing that is we're getting rid of the property where an attacker can find one topology that has 5% to 10% of your users. Even if it's only that they can find a topology that has 1% of your users, then the difference is still massively in our favor that this is an improvement for the defender. Now, there's another possible downside. As Perz said, you're going to have violence against your security staff. Well, maybe. On the one hand, any new control that adds work for users is going to be resisted one way or the other. One of the ways, one of the things that you could do about this is measure it, like do pilot testing. Carnegie Mellon actually did a usability study on the difficulty of different stronger password strength enforcement. And their results were, yes, it matters, but it's not as bad as you might think. That's the PLDR of it. And there are specific ways you can address it with user hinting. Now, what are ways you could hint the user, hey, your password isn't strong enough. If you adjust it this way, it would become strong enough. Or literally, your password is too weak, make it this instead. Those are decisions that, we can work our way through and different organizations can choose differently. But it appears from CMU's research that some flavor of that can drastically solve the user complaints. You're going to have cranky users, but you're not going to have 100% of your users get cranky. And, yeah. Now, we always have to remember that if we're going to give extra information to users at password change time, that might somehow become user hints to the attacker. Some of those things we've thought through and figured out ways to address others are just going to be trade-offs we're going to have to know that we're making. And keep it in mind when an organization chooses, for instance, what kind of hint level to use, they're going to have to keep that in mind. All right. So enough of that, the code. So a few years back now, we released a PAM library, a PAM module that implements all this stuff with optional, you know, controls to enable it and set the different parameters. We developed and tested it on multiple Linux's, Gen2, Ubuntu, probably some of the Red Hats. And I believe Solaris, but don't quote me on that. And it basically implements all the things that I just talked about. And I'll talk a little more about specifically how in a second. We did patent the ideas here, but the code is AGPL. You can use it for free all you want. The TLDR of the way the AGPL works is you can use this all you want for free stuff and open-source stuff. If you want to make money off of it or make custom modifications that you make money off, then you have to talk to us because the AGPL license won't work. You'll have to ask us for a dual license on something other. But that's fine. We did it as a PAM library or a PAM module for, you know, Linux deployment, but with the thought that the API in the library could be used by other things too, like an LDAP server that implements single sign-on or what have you. Yes. So Perth asks, Perth is thinking about how attackers would adapt. I actually have that in here in a little bit too. Okay. So what are the different modes that we implemented in the Pathwell open-source code? So audit mode is simply the tracking of topologies that are used as users change their passwords. When you start in an organization, you don't know other than by cracking their existing password base, which is an option, especially if you're us, but it might not be an option for everybody. So you could enable this to record topology use as it goes. Now, if you're going to keep a database of all your users' topologies, you better consider that database pretty sensitive and be careful with it. And because of implementation details and our proof of concept, it's currently limited to tracking the topologies of characters up to 29 characters long, which ought to be enough for anybody. Then there's enforcement modes, which actually impose different controls. The first and most obvious one I'm going to talk about is blacklisting. And it's basically everything I said before that blacklisting should do, it does. We distribute a standard list, a starter sort of list of topologies to blacklist, but you could also add or modify your own. And again, I'll reiterate, blacklisting itself is not enough as a permanent solution. But it does help you be better and more resistant than other organizations that somebody might attack. So you don't have to run faster than the bear, you just have to run faster than the other guy. The next enforcement option is MinLev, that's Levenstein Distance, the minimum distance for the topology of the new password candidate versus what the previous one was. This enforcement mode, actually, I should mention, neither blacklist mode nor MinLev mode require auditing to be turned on. So if you have heartburn about the idea of maintaining a database of in-use topologies and I don't blame you, then these features don't need that at all, because they only care about what your new password is in the case of blacklist or what your new password is compared to your old password in the case of MinLev. They don't care about what your new password is compared to the entire rest of your organization, which is what MaxUse is about. MaxUse allows you to say, I want to have a threshold, any given topology bucket can only have one user or can only have five users or whatever's the right number for the size of your organization. And again, the point here is, if the attacker, if you have successfully kept users from clumping anywhere, or rather if you want to prevent users from clumping anywhere, you use this and then a user setting their password can't set their password to be the same topology that they or anybody else in your organization has used, or if not more than two have used or whatever your setting is. Now, it's called an enforcement, well, it's an option that matters in enforcement mode, but it's not an enforcement but rather a sort of the, you know, controls the user experience if you want to give any hints. So we did an experimental hint info level implementation partly to facilitate that kind of research that I talked about before, the user acceptance of what's the user experience when I tell them this is much information as opposed to when I tell them that. So out of the box, Pathwell doesn't give users any particular feedback or information, doesn't tell them how they could make their password stronger, doesn't leak information about the organization, doesn't give information to the screen that would be useful to somebody's shoulder surfing. But if you choose to, if it's right for organization, you can turn up hint levels. And this is supported by the back end API as well, not just by the PAM library. So if you wanted to plug this stuff into a non PAM using single sign on server, you know, go for it. Right now, hints are only hooked up for blacklist violations, but the other types should be doable without a problem too. Now, not going to do a live demo, but I'm going to show some examples of how this works in practice on a Linux box. So you install the PAM library, and you modify your PAM.d settings. And we have readmes and examples for the different distributions that we supported and tested it on, but you can also roll your own custom, you know, PAM settings. So you do a thing to turn on audit mode. You do a thing to turn on blacklist or minlev or max use or any combination thereof. And you can also enable the hint level. So again, max use requires that audit be turned on. But the other enforcement modes don't require audit to be enabled. So what's it look like when things happen? Well, because this is sort of, you know, because this is a beta, we're verbose, although we don't include secrets in the output, but we're verbose even on successful, even in the case of success, we log a bunch of info about the fact that we just accepted a password change. A failure will tell the user that it failed a specific check, the minlev check in this case, but it won't tell them anything else. It won't tell them use this one instead. It won't say there's already one user and minlev is set to, or sorry, it won't tell them that, you know, how to modify their candidate. It'll just tell them, you know, they failed. And we log that. And then a max use failure, where in this case, minlev was not turned on. So users were allowed to choose any new password they wanted, any new topology they wanted, as long as it wasn't in use by somebody. Well, it was in use by them. Therefore, they can't reuse the same one. But they also can't reuse the same topology as their neighbor. And we log that. But again, we don't give away anything else. Now, showing a little bit of what some of the hint level stuff you can, if you want, look at the topology of the password that they supplied, and say, that's a topology that we're not going to allow. Let's figure out what change would be viable. And what change would be viable is basically randomly selected at password change time by the engine. It says, okay, this topology they asked for is not allowed. What are the neighbors of this topology that are allowed? I'm going to pick one of those at random, and then suggest an edit that would land the user in the new allowed topology. Now, funny enough, what it's suggesting here is actually a topology that wouldn't be great on its own. But for instance, maybe the organization's minimum password length is such that by making this longer, they'll end up being an outlier that way, because most users won't make their password any longer than they need to. You jack up the hint level one more, and now we'll actually show them where drawing on their existing password here, point at the spot in their existing password and say, put a this here, put a that there. And then even more, we can suggest specific things. You can say here, try replacing this with a that, and try inserting a this here. And your password is going to end up as this. You know, classically, and back in the day, nobody ever suggests echoing plain text back to the human. But it turned, you know, there are actually use cases and scenarios where that's reasonable, or at least where it's reasonable to let the user choose. That's why a lot of, you know, web apps these days have a little button you can click or hold to show to reveal, rather than always make it opaque. And it's always just a trade off. So if it's right for your organization, it's right for organization. I'm not going to judge you until I come and test it and own you and then I'll judge you. So what's next for the Pathwell project? Well, like I said, hints are only implemented for one of the modes. So easily, if easy to say, we should just go ahead and add hint support for the other modes. More platforms. The working implementation, like I said, is Linux PAM. But the bigger organizations, places where this is going to be more useful, are going to be running either AD or some other kind of large single sign on platform. If a vendor of one of those platforms wants to work on making their product better than all other products in the universe, come talk to us. The other thing too is we can easily come up with more ways we could improve things, more enforcement options. So first of all, this is highly focused on one specific very successful, but it's still only one specific aspect of password cracking, which is the mask attack. So are there specific things we could learn from other highly successful password crack methodologies, which we could in turn turn into defensive enforcement, dynamic strength enforcement at password change time. Say, well, I know that that thing you just asked for is going to fall victim to this specific attack. We can compensate for that attack pretty easily and not allow you to make that requested password change. Now, an easier, more straightforward thing would be, hey, we could easily do regular expression support. Right now, our black lists are basically just the masks tokenized into a machine format, but basically right now, we just have a list of masks. We could enforce of regexes too. So you can make a regex that would disallow a huge variety of different ways to say the word DEF CON in your password all at once and do that with, you know, do that with whatever your company name is.  You could say, okay, well, my company name and my city name and my sports team name, all of those and every variation that fits into, you know, would match these regexes among disallow. And now you've taken away not one black listed password or 10 black listed passwords, but millions of terrible passwords all at once. And then if this did get adopted, what would attackers do next? And what would we need to do to adapt to that? So that's pretty much it. I'll take questions and I'll first I'll scroll back to look for questions, but then I'll take more and I'll be around and in discord the rest of the event.


It's quite often very useful to have a yes or no question. It might seem a waste of a question but actually that takes a moment to answer and then you have that key piece of information. Sometimes it's very useful not only to ask about like explicit questions where they need to feed the information but also to ask for documents and then it might take less time for them to answer but then the documents will contain much more information if they're willing to share. Quite often one thing they will bring back is suggesting that the request is too broad and we need to narrow it down. It can be part of the strategy to lock them into having to respond to the feed information requests by asking you to narrow it down and then you narrow it down further.


Okay, in this short video we're going to take a look at what a traditional DevOps stack looks like and what that means to teams to stand up a new project and get CI CD working and then contrast that with GitLab and our vision for complete DevOps. So here we look at the legacy state, set of tools that many enterprises use for DevOps and so let's talk about a brand new project that's getting started by a developer. They're going to have code and start creating this new project and of course the developer is going to be uploading that to their source control management system, let's say in this case GitHub Enterprise. So we'll need a new project there and to make sure that the right people are credentialed and have access to that project and then we might hand off that project to the infrastructure and DevOps team. They're going to create a new channel in Slack to help with ideation. They'll create a new project with the right credentials again matched up in JIRA so that we can manage the planning of this project. They'll create a new project or folder in Jenkins. Make sure that that has the right credentials to connect back to source control. Then we might make in the DevOps side of the house, we might make a new project or write prod files for puppet and chef or chef to stand up environments for this and maybe we include those in source control. Maybe we don't. It depends on our processes and then for production, we're going to have to stand up a new instance. We'll have to spec that instance, let's say in AWS or Kubernetes. We'll have to create that instance, make sure that the credentials to get all the way back are ready for that instance and then maybe create a new project in New Relic for instance to monitor that production instance. But then also if we want to dockerize and kind of take this into the cloud, we're going to have to create a docker file and maybe have Docker Hub to store that or maybe in addition to that have an artifact store in Nexus or Artifactory. Then we're going to connect the build process into that channel and Slack that we created so that we can actually have build statuses be able to be visible by the developers. When there's artifacts or those Docker images, we're going to want to factor those into our puppet and chef scripts. From there, we're also going to want to focus on code quality so probably at build time Jenkins will push code quality metrics to sonar and then we might want to connect that again back to Slack to understand how code quality is changing as we're making changes. And then, you know, we're going to want to again put the monitoring into Slack as well so that production issues are clearly noted back to developers. And so this is, you know, 20 plus steps to set up and connect and wire together this brittle architecture. And in many organizations, this can take a long period of time. It can create different people if someone manages Jira and someone manages source control and someone else manages Jenkins and someone else manages production environments. Now, you know, we're talking about multiple roles involved and their shared time and, you know, when their availability is to stand up something new.  And maybe it's still connected to Slack because we want to do some chat ops, but the developed code goes right into GitLab. From there, GitLab automatically detects what kind of code it is, builds it, automatically uses Heroku build packs for testing and code quality, automatically dockerizes the app for us and deploys it into a Kubernetes cluster with auto review apps and auto deploy. And because it's deployed in Kubernetes and we have Prometheus faked into GitLab, we're automatically monitoring that code from day one. And so in this way, developers are unable to deliver code faster to production and cuts out that brittle house of cards, traditional DevOps stack.


So, one of the things you learn when you get a PhD in mathematics is that every calculus textbook must include some version of the following problem. This dictate is enforced by a secret cabal of mathematicians who can control every aspect of our lives, and is led by Professor J. No secret cabal of mathematicians exist. Go about your business. So here's the situation. We have a 25 foot ladder resting against the wall, and the base of the ladder is moving away from the wall at 3 feet per second, while the ladder itself maintains contact with the wall. So how rapidly is the top of the ladder falling when the base is 8 feet away from the top of the wall? Now, while these drawings in perspective are great for showing what actually happens, they're not so good for representing what actually happens. So let's change our viewpoint so that we can get a better picture of what's really going on. So, it helps to identify the variables and constants. So let's let our ladder slide a little bit. So we see that the distance to the top of the ladder and the distance to the base of the ladder from the wall are variable quantities. So we need to represent them as variables. So let y be the height of the top of the ladder, and x be the distance of the ladder from the base of the wall. And we'd like to find some relationship between these variables and maybe some other things. Well, notice that the length of the ladder doesn't change, and that x, y, and the ladder itself form three sides of a right triangle. And that means the Pythagorean theorem tells us that x squared plus y squared equals 25 squared. So we're told that the base of the ladder is pulled away from the wall at 3 feet per second. And so this is a rate of change of x with respect to time, and so we're differentiating with respect to time, t. We want to know how rapidly the top of the ladder is falling when the base is 8 feet away from the wall, and so that means we want to find dy dt when x is equal to 8. So we have our relationship between x and y, so let's differentiate with respect to time. We want x equal to 8, and since x squared plus y squared equals 25 squared, then we can find y. So we have a derivative relationship as well as x equals 8, y equals square root 561, and the x dt equals 3. So I'll substitute those into my equation and solve for dy dt. And don't forget those units. y is measured in feet, t is measured in seconds, so dy dt is going to be a value in feet per second.