all right thank you Dagfinn and thank you Trine for a wonderful presentation it's great to see in detail the
work that our researchers are doing so I'm Leon and I'm the section leader for Research Services at
the University Center for IT and I'm leading TSD on a daily basis and what I'd like to do today is
to tell you about what we've been doing in the last two years roughly
to make research with sensitive data easier
point is that research is difficult inherently and researching with sensitive data is even more
difficult because it
has its own challenges data management challenges begin with I'd like to just recap what is TSD
there might be viewers who are not familiar with it it is a secure Cloud where you bring your own
ethical approval for your research you bring your own data and potentially your own software and a
license so if you for example have a license agreement for using Matlab you can just reuse that in TSD
and it is a remote login solution which you can use from anywhere in the world in addition it is
also a platform for app development what is TSD look like it looks roughly like this you have a
Windows or a Linux desktop
and perhaps you also have programmatic interfaces or an app
and excuse me and before I continue I would like to also tell you a little bit more about the context in
which TSD operates
so the distinguishing feature of TSD in the last two years has been growth and a changing security
environment
so for growth
total number of projects active now is 1615
and as you can see in the last two years we've received more than one project per day and this year
is looking pretty much the same
user growth
we now have a total of 8917 active users
and the same is the same thing is happening to data volumes in total we're now storing 10.4
petabytes up from Seven petabytes and we're seeing increases in our web traffic handling up
to million requests per day
but on the institutional agreements we have now 36 institutional commercial agreements in
place and 19 new since 2020 and I've listed here are some of the institutions with which we have such
agreements in such agreements typically make it easier for people to register projects since the
contracts are already in place
on the security side we see we see a more complex environment there's war in the Ukraine of course
and this has implications for the types of texts that we have to defend against we are secure cloud
and we have sensitive data so we are a potential Target for hackers this is a real threat and one of
the most problematic threats that we face is so called ransomware as a service and ransomware is
where an attacker infects your network and encrypts your data and then demands payment in return for
decrypting the data and we've seen this type of attack in Norway in various public sector
institutions and coupled with that there are always bugs in IT systems so this is the environment
that we operate in
what does this mean in terms of trends it means that small attacks are often the start of larger
attacks so we can no longer ignore small attacks because it might be the beginning of something
bigger
and so called advanced persistent attacks are becoming more of a reality and the IT security team at
UiO for example suspect that I ransomware group has tried to attack UiO of course they have not
succeeded but this is a
this is a sign that we need to take security very seriously and we do and some of our responses at
the sector level is that we have more early warning systems that we have two-factor login on all
services something that has been in place with TSD from the start and of course TSD builds on and
relies on the University sector and University of Oslo's security work
and this might be for example relying on network scanning and early warning systems and then TSD
implements a host of other measures to ensure data security
so that is the general environment in which TSD has been operating in two years we are facing the
challenges of growth and an increasingly complex security environment in the world but given that we
want to make Research Services easier so what is it that researchers typically want to do in TSD
well I like to think of this as a hierarchy of needs you might want to end up for example
sharing data or building an application in through which you share data sensitive data or eventually
export publication material like graphs for your paper but in order to do that of course you have to
first be able to process data and in order to ensure that only the right people get access to the
data you have to apply access control
before you get to that step of course you need to install software
and compute on it
and we have to import and collect data
you have to login in order to do that of course you need a user account in order to get a user
account you need TSD project and in order to get the TSD project
you need agreements and approvals
and of course it's no good that TSD offers all of this
if it is not available if it is not secure so you want all of this with confidentiality you want
stability and you want availability and you need user support throughout and this is what we try to
offer in the last few years we've had many exciting use cases in research
and I will speak about some of them in the slides that follow to illustrate what we have been doing
to make research easier so first of all if you want to work with your data you have to be able to
log in this goes without saying but it's often more challenging than it than it sounds
and at some level TSD looks like this it is a bunch of computers cabled together in a data center and
on top of that
you have lots of programs running and eventually what you get is a desktop and this is where you
work and as a research service provider we have to relate to all of this and do our best to hide the
complexity from the users so I spoke about data security and one of the foundational aspects of TSD
is its firewall and pre 2020 we had recurrent issues
where the firewalls would crash and this is very problematic not basically nothing works when this happens
and it was a long road to a solution but happily we have stabilized us and what did we do when we
bought new machines we bought new network cards we took advice from Netflix Engineers since they use
similar technology we established hot failover so that if one firewall crashes another takes over
and we engaged the operating system developers we eventually found the source of the bug and helped
us to rewrite our firewall rules to avoid problematic code and then afterwards we established a test
environment we did lots of performance tuning and we stabilized opposite operations and often we get
requests for new functionality from researchers and then we have to say no we cannot work on that
right now and
I realize that sometimes people wonder what are we working on and this is a great example of the type
of non-sexy work that we have to engage in to ensure stable login and continuing on that you of
course use Virtual machines when you log in and when you work with your data and we've invested
heavily in to efficient operations on the hardware and configuration so standardizing installation
of components across the organization
in and establishing team-based knowledge bases and enforcing hardware standards for example using
only Intel CPUs and Nvidia GPUs
an important part of our efforts in the last years was to modernize the Linux environment we have
now deployed Redhat 8 and deprecated a prior login method in favor of using VMware Horizon so now
users have single login method where they choose all of their virtual machines
and this of course builds upon the aforementioned stability efforts we have a single environment for
log in and Redhat 8 is a much more modern operating system makes and managing software easier and
this was a multi-year effort on our part helping users migrate setups with custom software to new
virtual machines if you
back to that hierarchy of needs
one of the things that you have to be sure of is that your data is correct if you import data then
you want to exactly that which you sent to be present in your project and here we have an
interesting case where the psychology Institute at the University of Oslo uses the media capture
application on the web to record therapy training sessions so they recorded with the web client it
is web-based and they stream video to
TSD and analyze the video on virtual machines this is quite a large scale in 2022 a 150 students per
semester so far there's been 1500 hours of video recorded to TSD totaling 1.5 terabytes
of data so the point is that you cannot lose data while sending it to TSD because you have to use
the video to do your therapy training and
the challenge of course is that this uses the internet and because it uses the internet it means
that our Institute does not have full control over the network so what do we do is we build
applications that can deal with failures and detect them when that happens and retry appropriately
and we spent many hours perfecting this and we're very happy that the service is reliable and that
Institute of psychology trust the service
and uses it
well let's say you can log-in and your data is correct of course being sensitive data it's no good
if you don't have the confidentiality that you need so you have to be able to apply access control
and we've had two very interesting cases where our users needed advanced access control the first
case I'd like to mention is called DIGIKOST and this records people's dietary
intake and other lifestyle factors and reports this data back to them and to other experts
and the second use case is called food capture and food capture is a CE approved medical device and
it is used to track people's dietary intake while they are in hospitals and to generate
recommendations for what they should be eating
to get the proper nutrition and all of this implies that you have to be able to control who sees the
data you have to be sure of that so the challenge is sharing data with this specific person but in
the context of TSD without making them a member of the project because you don't want them to be
able to log into a virtual machine
so traditionally TSD projects have different roles there's the principal investigator the one who
sets up the project and it's responsible for it from legal point of view and there's an
administrator of course there can be many and members and administrators all the ones that
administrator rights in TSD as of 2020 all of these roles required login so our solution to this
problem to solve the advanced use cases
was to build a new identity management system so that we could introduce a new role new role
being called project associate and the thing about a project associate is that as an admin you can grant
access to very specific data in web services to a project associate so you can say for example that
the patient can access their own data and that a group of nurses can see this patients data and
developing this identity management system was two years of work and we're happy to report that we were
able to adopt the seamlessly there was no downtime it just works wonderfully this of course also
laid the foundation for self-service because we were able to design it to TSDs needs and we were
happy to see that we could reuse this in Educloud the service
which you will hear about more in one of the next sessions so we spoke a little bit about the
environment that were operating in and one of the salient features of that is that we are growing
that that we are getting more projects and more users and if we look here at the total volume of
user support that the second line has to solve
starting in 2020 up until last month if you ignore the seasonal pattern in the data you will see
that there is no increasing trend and this is important evidence that we are scaling that we are not
seeing an explosive amount of user support and what it means is that the team can focus on solving
problems and on improving research services instead of just firefighting
and
what did we do what is our strategy how do we do this first of all listen to users and to our
stakeholders they are the ones that guide our actions that guide our development
of course you have to secure financing and we have doubled UiO financing and through project
participation we secure financing for developing specialized services but we always require that we
can reuse the technology to the benefit of all TSD users we've used this financing to grow the team
and growing the team means hiring more people but also investing in competence and we've grown the
team not only in the section for research service
but also in other sections of the organization in the help desk and in the infrastructure teams TSD
is financing positions for people making sure that the entire organization is staffed properly
and we collaborate within the organization and harmonized efforts in the sector with in Norway
of course we always want to enable self-service because we don't want people to have to wait for us to
do things on their behalf and then very importantly to solve problems by addressing the root cause
so the example of the firewall for example we went all the way down to the source code with the
developers of the technology and identified it at the root and
solved it there
and with this I would like to end my talk and just tell you a little bit about what you can hear
about next the next sessions will be about new features or services and we will hear about the
self-service portal the publication portal new Nettskjema integration consent system and unified
storage in TSD and these demos and talks will be
much more Hands-On and thank you for your time
thank you very much Leon I have a question about if the presentations will be available on the
website after conference and yes we will post these presentations on the website of the company but yes
absolutely on you're talking about scaling
how big is the 15 hour how many uses can really now how many projects have you scaled
for now for example all that about we have 1600 active projects and we're still growing fast and I
don't expect it to slow down any time soon we've course hope that the launch of Educloud will
channel some of the use cases which were borderline
sensitive data to Educloud itself but then of course it's the same team that runs TSD and Educloud
so it doesn't mean less work for and all infrastructure are
still in the basement here and in neighbor building yes yes and we have also I forgot to
mention that we have established an off-site backup for disaster recovery
in which we are working with
so we are investing heavily in reliability
how many projects do you expect to come within the next year or two
more than one a day so your two years and that would be 700 more and then maybe 100 or 200 will end so
then we'll be over 2,000 2,500 ish in total
we will be hearing more about how we scale when we talk on the topic of the new delivery from Nettskjema and
we also had find it to scale to a lot more data large data more data more availability and more
stability
thank you very much
okay one question we are we are a little bit delayed because we have like 40 seconds after when we
published so we will if you have a question for Leon and you can still answer and I can
ask him after the next presentation yeah you don't but okay how have you solved the challenge of
how to share data with Americans
it seems that there seems to be differing legal opinions about what constitutes data sharing and
I've seen discussions actually involving the data privacy officer at the cancer registry where yeah
basically there is no simple solution it seems like worst case you need an agreement and
institutional agreement
with the institution where the foreign researcher works
it's not exactly scalable but I think that is the answer but then again I'm not a legal experts I'm
probably not the right person to ask that we have American researchers with the users in TSD yes
we did and we are able technically we have institutions for both Latin American
people from other countries and sharing data out yes but the depending on which
privacy officer you ask you might get it
different answer on which agreements are sufficient
but technically you can share data with anyone from TSD