1 00:00:00,000 --> 00:00:02,420 (upbeat music) 2 00:00:02,420 --> 00:00:04,340 - Okay, so everybody ready? 3 00:00:04,340 --> 00:00:06,620 It's gonna be so fun. 4 00:00:06,620 --> 00:00:09,720 - I think we'll do a deep dive of like the, 5 00:00:09,720 --> 00:00:11,900 like different types of like encryption algorithms 6 00:00:11,900 --> 00:00:12,780 and all the math behind it. 7 00:00:12,780 --> 00:00:14,380 I think that'll really go over well with the eye. 8 00:00:14,380 --> 00:00:15,140 - I think so too. 9 00:00:15,140 --> 00:00:16,140 (laughing) 10 00:00:16,140 --> 00:00:18,260 - We'll throw as many acronyms out there as possible. 11 00:00:18,260 --> 00:00:19,460 - Yeah, the more three letter acronyms, 12 00:00:19,460 --> 00:00:20,300 the better I think. 13 00:00:20,300 --> 00:00:22,300 (laughing) 14 00:00:22,300 --> 00:00:24,880 (upbeat music) 15 00:00:25,040 --> 00:00:27,620 (upbeat music) 16 00:00:27,620 --> 00:00:36,820 - Welcome to Inside Hopkins. 17 00:00:36,820 --> 00:00:39,740 I am your host, Dr. Rhoda Miri-Piri Reid. 18 00:00:39,740 --> 00:00:42,820 In today's episode, we're talking about 19 00:00:42,820 --> 00:00:47,420 an increasingly critical topic in education, cyber security. 20 00:00:47,420 --> 00:00:50,000 (upbeat music) 21 00:00:52,100 --> 00:00:55,540 As technology becomes more prevalent in every part 22 00:00:55,540 --> 00:00:58,140 of our schools and our lives, 23 00:00:58,140 --> 00:01:02,640 keeping our students, families, staff, and systems safe 24 00:01:02,640 --> 00:01:05,280 has never been more important. 25 00:01:05,280 --> 00:01:09,420 Cyber security in an E12 setting is about more than just 26 00:01:09,420 --> 00:01:10,900 protecting devices. 27 00:01:10,900 --> 00:01:14,060 It's about safeguarding personal information, 28 00:01:14,060 --> 00:01:17,740 maintaining reliable access to learning tools, 29 00:01:17,740 --> 00:01:22,020 and ensuring our schools can operate without disruption. 30 00:01:22,020 --> 00:01:24,160 Joining me today are three experts 31 00:01:24,160 --> 00:01:28,700 from our Hopkins Technology and Information Services team. 32 00:01:28,700 --> 00:01:31,700 John Wetter is the Director of Information Services 33 00:01:31,700 --> 00:01:34,740 and Technology for Hopkins Public Schools. 34 00:01:34,740 --> 00:01:36,420 He has been working in the school district 35 00:01:36,420 --> 00:01:38,220 for 19 years, is that true? 36 00:01:38,220 --> 00:01:39,060 - It is. 37 00:01:39,060 --> 00:01:40,840 - Wow. 38 00:01:40,840 --> 00:01:44,540 John has really improved our district's infrastructure, 39 00:01:44,540 --> 00:01:47,620 having a positive impact on student learning. 40 00:01:47,620 --> 00:01:51,980 John recently returned from the Jamf Nation User Conference 41 00:01:51,980 --> 00:01:56,140 the largest gathering of Apple admins in the world, 42 00:01:56,140 --> 00:01:59,300 where, yes, our very own John Wetter, 43 00:01:59,300 --> 00:02:03,460 spoke about AI, privacy, and cyber security. 44 00:02:03,460 --> 00:02:06,420 Welcome to the show, John. 45 00:02:06,420 --> 00:02:07,260 - Thank you, Roda. 46 00:02:07,260 --> 00:02:08,500 Thanks for having me. 47 00:02:08,500 --> 00:02:09,660 - Absolutely. 48 00:02:09,660 --> 00:02:14,060 Scott Van Vleet has worked in Hopkins for 14 years. 49 00:02:14,060 --> 00:02:17,100 His current role is the Assistant Director of Technology 50 00:02:17,100 --> 00:02:19,340 and Information Services. 51 00:02:19,340 --> 00:02:21,820 Scott has a degree in System Administration 52 00:02:21,820 --> 00:02:24,300 from Southeast Technical Institute. 53 00:02:24,300 --> 00:02:26,420 Welcome to Inside Hopkins, Scott. 54 00:02:26,420 --> 00:02:27,180 - Thank you for having me. 55 00:02:27,180 --> 00:02:28,060 Glad to be here. 56 00:02:28,060 --> 00:02:29,140 - Awesome. 57 00:02:29,140 --> 00:02:33,020 Kishan Singh is the Enterprise Information Specialist, 58 00:02:33,020 --> 00:02:35,020 very fancy title, Kishan. 59 00:02:35,020 --> 00:02:37,460 He joined Hopkins in 2021. 60 00:02:37,460 --> 00:02:40,860 He has a lot of experience working in education software. 61 00:02:40,860 --> 00:02:42,820 - Thank you for inviting me, thanks. 62 00:02:42,820 --> 00:02:43,660 - Yes. 63 00:02:43,660 --> 00:02:44,500 - I'm excited to be here. 64 00:02:44,500 --> 00:02:45,860 - Thanks for being on the show. 65 00:02:45,860 --> 00:02:49,540 Okay, this is super apropos, I guess, 66 00:02:49,540 --> 00:02:53,340 could be the word for having this conversation the day after 67 00:02:53,340 --> 00:02:57,820 the Amazon Web Services outage, which was like a big deal. 68 00:02:57,820 --> 00:03:01,780 First of all, at a high level, could you, John, 69 00:03:01,780 --> 00:03:06,780 could you just describe what even is Amazon Web Services? 70 00:03:06,780 --> 00:03:09,140 'Cause I asked you that question yesterday, 71 00:03:09,140 --> 00:03:14,140 like what is it and why did it have such a widespread impact? 72 00:03:14,140 --> 00:03:16,660 - Yeah, thanks, Roda. 73 00:03:16,660 --> 00:03:21,300 Amazon Web Services was really built by Amazon originally 74 00:03:21,300 --> 00:03:25,060 to help keep their shopping site running. 75 00:03:25,060 --> 00:03:30,300 How could they scale their traffic for a random Tuesday morning 76 00:03:30,300 --> 00:03:33,620 in the middle of the year and also keep the site running 77 00:03:33,620 --> 00:03:38,620 for Black Friday and Cyber Monday and that ramp up holiday 78 00:03:38,620 --> 00:03:42,140 period where they do the majority of their sales? 79 00:03:42,140 --> 00:03:45,220 And so in Amazon, they made the decision internally 80 00:03:45,220 --> 00:03:49,900 to build all of this infrastructure out to help that scaling 81 00:03:49,900 --> 00:03:53,300 is what we call it being able to run from a slow day, 82 00:03:53,300 --> 00:03:55,300 all the way up to like your biggest day of the year 83 00:03:55,300 --> 00:03:58,300 is how do you scale up to that biggest day of the year 84 00:03:58,300 --> 00:04:01,900 and do that all automatically without people needing to be, 85 00:04:01,900 --> 00:04:05,060 you know, closely in the loop on that. 86 00:04:05,060 --> 00:04:10,300 And they built that out to make their own Amazon.com website run 87 00:04:10,300 --> 00:04:14,380 and they decided to start selling that to others. 88 00:04:14,380 --> 00:04:16,500 So that is sold as a service, you know, 89 00:04:16,500 --> 00:04:21,500 so infrastructure as a service to organizations all over the world. 90 00:04:21,500 --> 00:04:26,100 And today, that actually makes more money for Amazon 91 00:04:26,100 --> 00:04:29,940 than selling stuff on Amazon.com does. 92 00:04:29,940 --> 00:04:33,700 So they've really become, you know, one of the probably 93 00:04:33,700 --> 00:04:39,100 maybe three or four made main cloud providers in the world. 94 00:04:39,100 --> 00:04:41,180 - Wow, that is fascinating. 95 00:04:41,180 --> 00:04:45,900 So how did that outage impact us here in Hopkins schools? 96 00:04:45,900 --> 00:04:50,860 - Specific to Hopkins of the 24 systems that we monitor, 97 00:04:50,860 --> 00:04:54,700 you know, every 30 seconds on what their status is. 98 00:04:54,700 --> 00:04:57,940 At one point yesterday morning, 14 of those 24 services 99 00:04:57,940 --> 00:05:01,100 were either completely down and unavailable 100 00:05:01,100 --> 00:05:04,740 or running in a degraded fashion of some sort. 101 00:05:04,740 --> 00:05:08,700 - Hmm, so that impacts how we communicate with families, 102 00:05:08,700 --> 00:05:12,060 what kinds of platforms our teachers can or can't use 103 00:05:12,060 --> 00:05:14,940 with students learning, all kinds of things. 104 00:05:14,940 --> 00:05:16,020 - Yep, absolutely. 105 00:05:16,020 --> 00:05:17,340 - Okay. 106 00:05:17,340 --> 00:05:21,740 So Scott, I know you play a role in cybersecurity 107 00:05:21,740 --> 00:05:23,060 in our system. 108 00:05:23,060 --> 00:05:27,460 When we talk about cybersecurity in the school system, 109 00:05:27,460 --> 00:05:30,900 what does that really mean in an E12 context? 110 00:05:30,900 --> 00:05:33,300 - What that really means in an E12 context 111 00:05:33,300 --> 00:05:37,220 is more than just data, it's almost protecting people 112 00:05:37,220 --> 00:05:40,180 and accounts, that's our biggest thing. 113 00:05:40,180 --> 00:05:43,780 A lot of people have a misconception 114 00:05:43,780 --> 00:05:46,980 of what attackers actually do. 115 00:05:46,980 --> 00:05:50,340 They see Hollywood with the screens in the background, 116 00:05:50,340 --> 00:05:53,180 people typing code, and that's really not what the biggest 117 00:05:53,180 --> 00:05:54,740 attack piece is. 118 00:05:54,740 --> 00:05:57,180 It's people sending fishing emails, 119 00:05:57,180 --> 00:05:58,540 attempting to get into accounts 120 00:05:58,540 --> 00:06:00,580 that they shouldn't have access to, you know, 121 00:06:00,580 --> 00:06:03,460 you kind of think about it from an attacker's perspective. 122 00:06:03,460 --> 00:06:06,700 Why would I spend hours trying to break into something 123 00:06:06,700 --> 00:06:09,580 when I can just send an email and let somebody 124 00:06:09,580 --> 00:06:11,140 who already has access to that system, 125 00:06:11,140 --> 00:06:12,660 give me their credentials. 126 00:06:12,660 --> 00:06:17,220 So a lot of our cybersecurity focus is making sure 127 00:06:17,220 --> 00:06:19,180 our counselors secure hand. 128 00:06:19,180 --> 00:06:21,820 A lot of that is like our MFA policies. 129 00:06:21,820 --> 00:06:22,660 - MFA. 130 00:06:22,660 --> 00:06:25,980 - Multi-factor authentication, requiring people 131 00:06:25,980 --> 00:06:28,820 not only to know their password, but get a phone call 132 00:06:28,820 --> 00:06:31,540 to approve a sign and press a button to say, 133 00:06:31,540 --> 00:06:33,380 yes, this is actually me, that's actually 134 00:06:33,380 --> 00:06:35,180 by far the most secure thing you can do, 135 00:06:35,180 --> 00:06:38,500 not only just from a Hopkins account perspective, 136 00:06:38,500 --> 00:06:40,460 but a personal account perspective. 137 00:06:40,460 --> 00:06:42,460 If you have a bank account, the number one thing 138 00:06:42,460 --> 00:06:46,380 you should send up is my multi-factor authentication, 139 00:06:46,380 --> 00:06:47,740 to make sure that you are the one 140 00:06:47,740 --> 00:06:49,380 who's actually getting in there. 141 00:06:49,380 --> 00:06:52,580 So it's limiting that, and then of course, 142 00:06:52,580 --> 00:06:55,540 there's all the technical things of like we have firewalls 143 00:06:55,540 --> 00:06:58,780 in place to make sure that applications 144 00:06:58,780 --> 00:07:01,740 that aren't allowed access and can't get access 145 00:07:01,740 --> 00:07:05,540 and we do things with only allowing certain applications 146 00:07:05,540 --> 00:07:08,460 in which is always really fun when a staff member is like, 147 00:07:08,460 --> 00:07:10,060 hey, I was trying to access this thing 148 00:07:10,060 --> 00:07:12,980 and all of a sudden I was blocked what's going on here. 149 00:07:12,980 --> 00:07:16,100 - So there are a lot of protections that our users 150 00:07:16,100 --> 00:07:18,340 may not even be aware of. 151 00:07:18,340 --> 00:07:19,980 You know, sometime they ask, John, well, John, 152 00:07:19,980 --> 00:07:22,420 I just really want to use this tool, right? 153 00:07:22,420 --> 00:07:26,620 And what John knows that I don't is that this tool 154 00:07:26,620 --> 00:07:28,740 wants access to some of my data 155 00:07:28,740 --> 00:07:30,300 and I'm not even thinking about that. 156 00:07:30,300 --> 00:07:32,780 I'm just thinking about how cool it would be 157 00:07:32,780 --> 00:07:35,100 to use that particular tool. 158 00:07:35,100 --> 00:07:39,060 So John, you are a very good student 159 00:07:39,060 --> 00:07:43,540 of real life scenarios where there have been breaches, 160 00:07:43,540 --> 00:07:45,300 not that we want to introduce a fear factor 161 00:07:45,300 --> 00:07:48,700 in our conversation, but like what is the worst case scenario? 162 00:07:48,700 --> 00:07:52,700 Like what are the bad things that can happen 163 00:07:52,700 --> 00:07:56,100 if we are not vigilant with cybersecurity 164 00:07:56,100 --> 00:07:59,620 in our E12 school system? 165 00:07:59,620 --> 00:08:03,620 Some of the main pieces that we really are engineering 166 00:08:03,620 --> 00:08:07,220 our solutions toward is making sure that the data, 167 00:08:07,220 --> 00:08:11,980 that families and students and staff 168 00:08:11,980 --> 00:08:15,620 are trusting us with remain secure. 169 00:08:15,620 --> 00:08:17,900 You know, we do hold a significant amount 170 00:08:17,900 --> 00:08:21,780 of very sensitive, personally identifiable information. 171 00:08:21,780 --> 00:08:24,940 And as we look at that, you know, worst case scenario 172 00:08:24,940 --> 00:08:30,700 and what we see happen is attackers trying 173 00:08:30,700 --> 00:08:33,660 to get a hold of credentials, like what Scott mentioned earlier, 174 00:08:33,660 --> 00:08:36,140 of where trying to get a hold of credentials 175 00:08:36,140 --> 00:08:40,220 to a staff member by either giving them something free 176 00:08:40,220 --> 00:08:42,620 for all this information that they don't understand 177 00:08:42,620 --> 00:08:45,780 that they're making that trade or to straight up try 178 00:08:45,780 --> 00:08:49,900 to trick them into giving up their password 179 00:08:49,900 --> 00:08:52,060 or giving up additional information. 180 00:08:52,060 --> 00:08:54,180 And it's getting access to all of that data. 181 00:08:54,180 --> 00:08:55,660 Having all of that information, 182 00:08:55,660 --> 00:08:58,620 any of that being breached or you know, 183 00:08:58,620 --> 00:09:01,580 being exfiltrated out of our systems 184 00:09:01,580 --> 00:09:04,300 is really what that worst case scenario looks like. 185 00:09:04,300 --> 00:09:05,260 - Mm-hmm. 186 00:09:05,260 --> 00:09:10,260 And I want our community to know that on November 4, 187 00:09:10,260 --> 00:09:14,780 Hopkins residents do have an opportunity 188 00:09:14,780 --> 00:09:19,780 to consider approving not only our $140 million 189 00:09:19,780 --> 00:09:22,820 bond referendum, which is question one 190 00:09:22,820 --> 00:09:25,060 on the November 4 ballot, 191 00:09:25,060 --> 00:09:30,060 and that will only cost taxpayers about $7 per month 192 00:09:30,060 --> 00:09:32,180 for the average homeowner. 193 00:09:32,180 --> 00:09:34,660 And then question number two is renewing 194 00:09:34,660 --> 00:09:38,780 the capital projects levy and these are existing dollars 195 00:09:38,780 --> 00:09:43,780 that fund cybersecurity protections, our devices, 196 00:09:43,780 --> 00:09:47,620 all of the technology and technology support 197 00:09:47,620 --> 00:09:49,740 that we're discussing right now. 198 00:09:49,740 --> 00:09:52,420 And what I'm wondering, and I think what some 199 00:09:52,420 --> 00:09:55,860 of our listeners would also want to know is, 200 00:09:55,860 --> 00:09:59,460 with that support, could it still happen here? 201 00:09:59,460 --> 00:10:03,900 Could we still face some kind of severe cyber attack? 202 00:10:03,900 --> 00:10:07,020 - Yeah, thank you for that question, Rhoda. 203 00:10:07,020 --> 00:10:09,980 I mean, and that is a complex one. 204 00:10:09,980 --> 00:10:12,660 And also one that maybe folks don't probably like 205 00:10:12,660 --> 00:10:15,300 to hear the answer to is that yes, 206 00:10:15,300 --> 00:10:17,380 it still could happen. 207 00:10:17,380 --> 00:10:20,380 However, you know, these sort, 208 00:10:20,380 --> 00:10:24,300 these attackers often frankly are lazy, quite frankly, 209 00:10:24,300 --> 00:10:26,860 and they go for the easier targets. 210 00:10:26,860 --> 00:10:28,460 That is where they spend their time. 211 00:10:28,460 --> 00:10:32,420 And Hopkins is known to be a hard target 212 00:10:32,420 --> 00:10:35,820 because of the investment from the capital projects levy 213 00:10:35,820 --> 00:10:39,540 and because we have amazing people and great systems 214 00:10:39,540 --> 00:10:43,140 in place to help thwart those actors 215 00:10:43,140 --> 00:10:44,900 trying to get into our data. 216 00:10:44,900 --> 00:10:45,900 - Thank you, John. 217 00:10:45,900 --> 00:10:48,480 (upbeat music) 218 00:10:49,320 --> 00:10:52,200 - We're going to take a quick break. 219 00:10:52,200 --> 00:10:53,360 We'll be right back. 220 00:10:53,360 --> 00:11:01,080 - This fall, Hopkins Public Schools is asking voters 221 00:11:01,080 --> 00:11:05,000 to invest in the future of our students and community. 222 00:11:05,000 --> 00:11:08,000 On Tuesday, November 4th, you'll see two questions 223 00:11:08,000 --> 00:11:09,200 on your ballot. 224 00:11:09,200 --> 00:11:11,200 Want to modernize our school buildings 225 00:11:11,200 --> 00:11:13,280 and its hands safety and security. 226 00:11:13,280 --> 00:11:16,200 And another to renew our capital project levy 227 00:11:16,200 --> 00:11:19,640 to keep classrooms connected and future ready. 228 00:11:19,640 --> 00:11:22,360 Together, these investments create safe, 229 00:11:22,360 --> 00:11:24,720 inclusive, and innovative spaces 230 00:11:24,720 --> 00:11:26,960 where every student can thrive. 231 00:11:26,960 --> 00:11:30,920 Learn more at Hopkinschools.org/referendum. 232 00:11:30,920 --> 00:11:33,500 (upbeat music) 233 00:11:33,500 --> 00:11:38,560 - Well, I want to turn to you, Keeshan. 234 00:11:38,560 --> 00:11:42,120 What are some of the things that you have to do in your world? 235 00:11:42,120 --> 00:11:45,320 To keep our data clean, to manage the system well, 236 00:11:45,320 --> 00:11:50,320 to partner effectively with John and Scott 237 00:11:50,320 --> 00:11:52,960 in the cybersecurity space. 238 00:11:52,960 --> 00:11:55,960 - I think when people think about student information, 239 00:11:55,960 --> 00:12:00,040 they often wonder like, "Why do people even care about this? 240 00:12:00,040 --> 00:12:02,800 Why would someone go after student information?" 241 00:12:02,800 --> 00:12:07,080 And it's often because the student information really is 242 00:12:07,080 --> 00:12:10,760 just an abstraction of like data and like what it represents. 243 00:12:10,760 --> 00:12:12,840 Like, it's not just our student information. 244 00:12:12,840 --> 00:12:15,480 It's a representation of our family's information 245 00:12:15,480 --> 00:12:17,000 and our student's information. 246 00:12:17,000 --> 00:12:19,120 And that's really what they're trying to get at. 247 00:12:19,120 --> 00:12:21,280 So we have to protect that in the same way 248 00:12:21,280 --> 00:12:24,240 that we would protect the physical safety of our students. 249 00:12:24,240 --> 00:12:28,080 One thing that is a big thing that I've kind of like 250 00:12:28,080 --> 00:12:30,320 started helping Rolot is actually getting rid of data 251 00:12:30,320 --> 00:12:31,720 that we don't need anymore. 252 00:12:31,720 --> 00:12:32,560 - Oh. 253 00:12:32,560 --> 00:12:33,560 - Oh, an example of this would be 254 00:12:33,560 --> 00:12:36,600 that we don't store any social security numbers. 255 00:12:36,600 --> 00:12:39,320 We just don't keep it in our student information system 256 00:12:39,320 --> 00:12:41,920 because sometimes the best way to protect information 257 00:12:41,920 --> 00:12:43,440 is just to not have it. 258 00:12:43,440 --> 00:12:45,200 - Oh, smart. 259 00:12:45,200 --> 00:12:50,200 So what role do teachers and school staff play in helping 260 00:12:50,200 --> 00:12:56,680 all of you help our system be secure? 261 00:12:56,680 --> 00:12:57,920 - I think the biggest thing honestly, 262 00:12:57,920 --> 00:13:01,480 just thinking about data protection and security 263 00:13:01,480 --> 00:13:04,400 as like part of the culture of serving our students. 264 00:13:04,400 --> 00:13:06,400 I think it's easy to think about it as like, 265 00:13:06,400 --> 00:13:08,160 "Oh yeah, that's like a matrix." 266 00:13:08,160 --> 00:13:10,080 Like we have to like just have the ITT 267 00:13:10,080 --> 00:13:12,400 and protect the firewall and protect the passwords. 268 00:13:12,400 --> 00:13:14,240 But it really is like a culture. 269 00:13:14,240 --> 00:13:18,840 If we really can internalize that student data is like 270 00:13:18,840 --> 00:13:20,960 as a representation of our students and our families, 271 00:13:20,960 --> 00:13:22,560 well, how would you protect that? 272 00:13:22,560 --> 00:13:24,600 In the same way, we can protect our data 273 00:13:24,600 --> 00:13:29,040 with a culture of safety and a culture of just like 274 00:13:29,040 --> 00:13:30,360 the protections that we usually do. 275 00:13:30,360 --> 00:13:35,360 Like making sure that we handle our data even virtually 276 00:13:35,360 --> 00:13:37,640 the same way we'd handle any like important 277 00:13:37,640 --> 00:13:40,720 documents or anything very important to us physically, 278 00:13:40,720 --> 00:13:42,880 making sure that we know who we're giving it off to, 279 00:13:42,880 --> 00:13:44,720 we don't just like leave it hanging in places 280 00:13:44,720 --> 00:13:48,160 that we are not quite sure what's going to happen to it. 281 00:13:48,160 --> 00:13:50,480 I think if we can have that culture about like 282 00:13:50,480 --> 00:13:52,440 integrating our data the same way we'd integrate 283 00:13:52,440 --> 00:13:54,920 all of the rest of our like security and all the rest 284 00:13:54,920 --> 00:13:56,160 of the ways we keep our students safe, 285 00:13:56,160 --> 00:13:58,000 I think that's the best thing teachers can do. 286 00:13:58,000 --> 00:14:00,680 It's not necessarily about one specific action. 287 00:14:00,680 --> 00:14:03,320 It's about all of the little things that we do. 288 00:14:03,320 --> 00:14:08,240 What are the most common mistakes students make 289 00:14:08,240 --> 00:14:12,920 that could result in like some kind of cyber security, 290 00:14:12,920 --> 00:14:14,480 I don't know, breach? 291 00:14:14,480 --> 00:14:17,000 And what is the most common mistake that 292 00:14:17,000 --> 00:14:19,600 adults, either staff or parents? 293 00:14:19,600 --> 00:14:22,640 So one of the most common mistakes students make, 294 00:14:22,640 --> 00:14:26,120 I usually see this a lot is they try to take advantage 295 00:14:26,120 --> 00:14:31,120 of some free VPN service to get around some block at home. 296 00:14:32,280 --> 00:14:36,240 And it's like anything free is never actually free. 297 00:14:36,240 --> 00:14:37,360 What's a VPN? 298 00:14:37,360 --> 00:14:39,920 So VPN is a virtual private network. 299 00:14:39,920 --> 00:14:42,320 It basically makes your device look 300 00:14:42,320 --> 00:14:44,400 like it's coming from somewhere else. 301 00:14:44,400 --> 00:14:47,160 So students will use these free VPNs to try and get around 302 00:14:47,160 --> 00:14:52,160 like, appearance, own restrictions put on their home network 303 00:14:52,160 --> 00:14:54,280 or these other kinds of restrictions. 304 00:14:54,280 --> 00:14:57,520 And of course they're free quote unquote, 305 00:14:57,520 --> 00:14:59,040 but they're really hosted by someplace. 306 00:14:59,040 --> 00:15:01,680 And when you connect to that, it can just read all the data 307 00:15:01,680 --> 00:15:03,200 that you're sending to it. 308 00:15:03,200 --> 00:15:07,840 So number one is don't use free VPNs ever. 309 00:15:07,840 --> 00:15:11,720 And then for staff, the hardest part is vigilancy 310 00:15:11,720 --> 00:15:16,640 because like John said, we have a fishing simulations 311 00:15:16,640 --> 00:15:20,400 that go out, every staff gets to simulated fishing emails 312 00:15:20,400 --> 00:15:21,400 a month. 313 00:15:21,400 --> 00:15:22,000 And-- 314 00:15:22,000 --> 00:15:22,520 Really? 315 00:15:22,520 --> 00:15:23,360 Two per month? 316 00:15:23,360 --> 00:15:24,040 Two per month. 317 00:15:24,040 --> 00:15:26,320 I have failed a couple of times. 318 00:15:26,320 --> 00:15:30,760 And the thing is what these fishing emails do 319 00:15:30,760 --> 00:15:34,640 is they mimic kind of real life situations. 320 00:15:34,640 --> 00:15:37,320 And so that's usually the biggest thing 321 00:15:37,320 --> 00:15:40,640 is being vigilant because a lot of these fishing emails 322 00:15:40,640 --> 00:15:43,560 will use both very urgent language. 323 00:15:43,560 --> 00:15:45,920 You need to do this right now or else you will lose access 324 00:15:45,920 --> 00:15:48,480 and you will cost yourself hundreds of dollars. 325 00:15:48,480 --> 00:15:49,720 Or-- 326 00:15:49,720 --> 00:15:51,320 And they're very vague. 327 00:15:51,320 --> 00:15:53,880 And if they don't really mention specifics, 328 00:15:53,880 --> 00:15:56,360 like they don't say, hey, your American Airlines flight 329 00:15:56,360 --> 00:15:59,800 is being rerouted, they say, your flight has some issue. 330 00:15:59,800 --> 00:16:02,760 You need to do this now, those types of things. 331 00:16:02,760 --> 00:16:04,840 And that is probably the hardest part 332 00:16:04,840 --> 00:16:07,840 is just always being vigilant. 333 00:16:07,840 --> 00:16:10,160 Well, this has been a super fascinating conversation. 334 00:16:10,160 --> 00:16:14,400 I really appreciate each of you sharing your expertise. 335 00:16:14,400 --> 00:16:18,040 As we close out, I would like to ask, 336 00:16:18,040 --> 00:16:21,440 what's next for cybersecurity in Hopkins? 337 00:16:21,440 --> 00:16:24,440 I'm going to take the easy one. 338 00:16:24,440 --> 00:16:28,840 I think the easy one here is, how do we integrate AI? 339 00:16:28,840 --> 00:16:30,400 As we were talking about building profiles, 340 00:16:30,400 --> 00:16:33,240 and building relationships between people, 341 00:16:33,240 --> 00:16:36,200 and how do those networks of information all get together? 342 00:16:36,200 --> 00:16:39,920 That's how these neural networks work. 343 00:16:39,920 --> 00:16:42,840 And I think the next big step is, how do we integrate 344 00:16:42,840 --> 00:16:48,080 and use AI without giving up a large part of ourselves 345 00:16:48,080 --> 00:16:49,400 and our personal information? 346 00:16:49,400 --> 00:16:52,200 Because now that we have these basically gigantic networks 347 00:16:52,200 --> 00:16:53,960 of information that can be put together, 348 00:16:53,960 --> 00:16:56,480 the more information that is out there about us, 349 00:16:56,480 --> 00:16:59,200 the more it can be easily attached to us 350 00:16:59,200 --> 00:17:01,040 in a much quicker manner and fashion. 351 00:17:01,040 --> 00:17:04,720 So I think the next step for us is learning everyone 352 00:17:04,720 --> 00:17:06,880 and building that culture, I'm like, OK, what is our data? 353 00:17:06,880 --> 00:17:07,760 What does it represent? 354 00:17:07,760 --> 00:17:10,560 And where do we want that to be going? 355 00:17:10,560 --> 00:17:11,920 And who do we want knowing that? 356 00:17:11,920 --> 00:17:14,480 And what do we tell an AI? 357 00:17:14,480 --> 00:17:16,320 And what don't we tell an AI? 358 00:17:16,320 --> 00:17:19,560 And what do we purposely keep out of the AI context 359 00:17:19,560 --> 00:17:20,760 in the AI sphere? 360 00:17:20,760 --> 00:17:24,040 What do we share with AI so that we can work smarter 361 00:17:24,040 --> 00:17:28,560 and faster without compromising private data? 362 00:17:28,560 --> 00:17:29,800 Exactly. 363 00:17:29,800 --> 00:17:30,600 That's good. 364 00:17:30,600 --> 00:17:31,320 Scott? 365 00:17:31,320 --> 00:17:33,960 And we're going to start looking at how 366 00:17:33,960 --> 00:17:38,800 can we limit the data that's out there to be seen? 367 00:17:38,800 --> 00:17:41,880 And that is, like, key sense of like, 368 00:17:41,880 --> 00:17:43,560 are we going to have to start saying, 369 00:17:43,560 --> 00:17:49,080 what, emails after four years, they get deleted? 370 00:17:49,080 --> 00:17:52,920 Google Docs that are seven years old just sitting there. 371 00:17:52,920 --> 00:17:54,040 Maybe those get deleted. 372 00:17:54,040 --> 00:17:55,840 So they can't be seen anymore. 373 00:17:55,840 --> 00:17:57,800 And the data in there can't be pulled. 374 00:17:57,800 --> 00:17:59,880 Because even if you're like, well, that document doesn't contain 375 00:17:59,880 --> 00:18:02,160 any social security numbers. 376 00:18:02,160 --> 00:18:05,600 It only contains a description of these students 377 00:18:05,600 --> 00:18:09,520 when they had this special ed thing happen seven years ago. 378 00:18:09,520 --> 00:18:11,400 It happened to not even students anymore. 379 00:18:11,400 --> 00:18:12,160 Doesn't matter. 380 00:18:12,160 --> 00:18:13,480 Helps build that profile. 381 00:18:13,480 --> 00:18:14,800 It helps build that profile. 382 00:18:14,800 --> 00:18:18,080 It's also data that can be exposed. 383 00:18:18,080 --> 00:18:21,400 That's a big thing that we think about is when 384 00:18:21,400 --> 00:18:25,160 we say to staff, no, you can't have access to this. 385 00:18:25,160 --> 00:18:27,880 Sometimes it's not-- 386 00:18:27,880 --> 00:18:30,160 we don't think you should be able to do your job. 387 00:18:30,160 --> 00:18:32,360 Well, if I give you access to this, and your account gets 388 00:18:32,360 --> 00:18:35,880 compromised, now all of a sudden we have to tell everybody 389 00:18:35,880 --> 00:18:39,080 in the last seven years that your data might have gotten 390 00:18:39,080 --> 00:18:41,280 accessed, even if you were only a Hopkins student six 391 00:18:41,280 --> 00:18:43,760 years ago. 392 00:18:43,760 --> 00:18:47,320 And so anything you want to add, John, about what's 393 00:18:47,320 --> 00:18:51,000 on the horizon for cybersecurity, especially in Hopkins? 394 00:18:51,000 --> 00:18:51,920 Yeah, absolutely. 395 00:18:51,920 --> 00:18:55,520 Well, the whole idea of the-- 396 00:18:55,520 --> 00:18:56,960 well, if you get an email, that's just 397 00:18:56,960 --> 00:19:00,400 in really poorly written English and not proper sentence 398 00:19:00,400 --> 00:19:01,480 construction. 399 00:19:01,480 --> 00:19:03,640 That's an easy spot at-- it's fishing. 400 00:19:03,640 --> 00:19:05,720 And these large language models will help make 401 00:19:05,720 --> 00:19:09,240 those a lot more real, a lot more convincing. 402 00:19:09,240 --> 00:19:11,960 As we mentioned earlier, bring that urgency into it 403 00:19:11,960 --> 00:19:15,080 in the proper context of time of year 404 00:19:15,080 --> 00:19:17,320 or the work you're doing or knowing 405 00:19:17,320 --> 00:19:20,640 that you have relatives in certain areas or whatever. 406 00:19:20,640 --> 00:19:23,640 You mean AI is going to help cyber attackers? 407 00:19:23,640 --> 00:19:24,440 Yeah. 408 00:19:24,440 --> 00:19:26,480 Cyber attackers as well as defenders. 409 00:19:26,480 --> 00:19:29,200 And so what is that balance going to look like over the next 410 00:19:29,200 --> 00:19:33,240 couple of years, as I think really remains to be seen? 411 00:19:33,240 --> 00:19:36,440 And with that, we talked about education right up on the front 412 00:19:36,440 --> 00:19:37,000 end of that. 413 00:19:37,000 --> 00:19:39,880 And it certainly is an education organization. 414 00:19:39,880 --> 00:19:42,280 And as we're continuing to do more and more work 415 00:19:42,280 --> 00:19:45,400 with our career technical education programs, 416 00:19:45,400 --> 00:19:50,040 we know we have a huge shortage of people 417 00:19:50,040 --> 00:19:52,040 for cybersecurity work. 418 00:19:52,040 --> 00:19:55,240 Right now, gosh, I'm trying to remember the last job survey. 419 00:19:55,240 --> 00:19:58,600 I think there was something in the neighborhood of-- 420 00:19:58,600 --> 00:20:01,640 in the next couple of years, over a million new jobs 421 00:20:01,640 --> 00:20:06,920 in this area needed or waiting to be filled. 422 00:20:06,920 --> 00:20:09,800 And so making sure that both we're thinking 423 00:20:09,800 --> 00:20:15,160 about our internal security and that from a K12, 424 00:20:15,160 --> 00:20:18,360 an E12 environment, that we also are helping 425 00:20:18,360 --> 00:20:23,280 to build that next set of cyber defenders in general as well. 426 00:20:23,280 --> 00:20:27,960 So that to me is our big challenges in the next few years. 427 00:20:27,960 --> 00:20:28,960 OK. 428 00:20:28,960 --> 00:20:30,920 Well, thank you all. 429 00:20:30,920 --> 00:20:35,040 You've given us a lot of really thoughtful and provocative 430 00:20:35,040 --> 00:20:36,120 content. 431 00:20:36,120 --> 00:20:39,320 I am so thankful to each of you for the work 432 00:20:39,320 --> 00:20:41,120 that you do protecting our system. 433 00:20:41,120 --> 00:20:43,000 So thank you, John Wetter. 434 00:20:43,000 --> 00:20:47,400 Thank you, Scott, Ben Bleet, and Keishan Singh. 435 00:20:47,400 --> 00:20:48,200 Guys are amazing. 436 00:20:48,200 --> 00:20:49,360 Thank you. 437 00:20:49,360 --> 00:20:50,040 Thank you, Rella. 438 00:20:50,040 --> 00:20:51,040 Thank you. 439 00:20:51,040 --> 00:20:54,360 [MUSIC PLAYING] 440 00:20:55,240 --> 00:20:58,320 [MUSIC PLAYING] 441 00:20:58,320 --> 00:21:08,320 [BLANK_AUDIO]