@article {24194,
	title = {Toward Risk Assessment of Large-Impact and Rare Events},
	journal = {IEEE Security \& Privacy},
	volume = {8},
	year = {2010},
	pages = {21-27},
	publisher = {IEEE},
	abstract = {Traditional risk assessment methods underestimate the risks of large-impact, hard-to-predict, and rare events in information systems. An alternative approach extends these methods to better evaluate risks associated with black and gray swans.},
	keywords = {information systems, risk management},
	doi = {10.1109/MSP.2010.55},
	author = {Kjell J{\o}rgen {Hole} and Netland, L.-H.}
}
@article {24196,
	title = {  Risk Assessment of a National Security Infrastructure},
	journal = {IEEE Security \& Privacy},
	volume = {7},
	year = {2009},
	pages = {34-41},
	publisher = {IEEE},
	abstract = {In Norway, BankID is the banking industry{\textquoteright}s public-key infrastructure (PKI) of choice for authenticating Internet customers. But do BanklD{\textquoteright}s differences from standard PKIs make it a riskier choice? This assessment, based on both publicly available information and usage experiences, addresses that question.},
	keywords = {bank data processing, Internet, public key cryptography},
	doi = {10.1109/MSP.2009.17},
	author = {Kjell J{\o}rgen {Hole} and Klingsheim, A.N. and Netland, L.-H. and Espelid, Y. and Tjostheim, T. and Moen, V.}
}
@article {24200,
	title = {Open Wireless Networks on University Campuses},
	journal = {IEEE Security \& Privacy},
	volume = {6},
	year = {2008},
	pages = {14-20},
	publisher = {IEEE},
	abstract = {Open wireless networks raise privacy issues and entail increased risk of malicious attacks and illegal downloading activities. Such networks are nonetheless attractive-particularly to universities-because they enhance usability and thus expand access to nonsensitive system resources. At universities, such access brings numerous benefits to students, faculty, and the surrounding community alike. Here, the authors describe the challenges of removing individual user authentication requirements at the perimeter of a university network in which mobile device users access system resources over wireless links to the wired infrastructure. The authors discuss how to mitigate the security and privacy risks entailed in an open network of this sort, and also describe how IT departments can vary the network{\textquoteright}s degree of openness.},
	keywords = {authorisation, radio networks, telecommunication security},
	doi = {10.1109/MSP.2008.92},
	author = {Kjell J{\o}rgen {Hole} and Netland, L.-H. and Espelid, Y. and Klingsheim, A.N. and Helleseth, H. and Henriksen, J.B.}
}
@inproceedings {24236,
	title = {A Proof of Concept Attack against Norwegian Internet Banking Systems},
	journal = {12th International Conference on Financial Cryptography and Data Security (FC08)},
	volume = {Volume 5143 of the series Lecture Notes in Computer Science},
	year = {2008},
	pages = {197-201},
	abstract = {The banking industry in Norway has developed a new secu- rity infrastructure for conducting commerce on the Internet. The initia- tive, called BankID, aims to become a national ID infrastructure sup- porting services such as authentication and digital signatures for the entire Norwegian population. This paper describes a practical man-in- the-middle attack against online banking applications using BankID. The attack gives an adversary access to customer bank accounts in two dif- ferent online banking systems. Proof of concept code has been developed and executed to demonstrate the seriousness of the problem.},
	author = {Espelid, Y. and Netland, L.-H. and Klingsheim, A.N. and Kjell J{\o}rgen {Hole}}
}
@inproceedings {24235,
	title = {Robbing Banks with Their Own software{\textemdash}an Exploit against Norwegian Online Banks},
	journal = {23rd International Information Security Conference (SEC 2008)},
	volume = {Volume 278 of the series IFIP {\textendash} The International Federation for Information Processing },
	year = {2008},
	pages = {63-77},
	publisher = {Springer},
	abstract = {The banking industry in Norway has developed a new security infrastruc- ture for conducting commerce on the Internet. The initiative, called BankID, aims to become a national ID infrastructure supporting services such as authentication and digital signatures for the entire Norwegian population. This paper describes a man-in-the-middle vulnerability in online banking applications using BankID. An exploit has been implemented and successfully run against two randomly chosen online banking systems to demonstrate the seriousness of the attack.},
	author = {Espelid, Y. and Netland, L.-H. and Klingsheim, A.N. and Kjell J{\o}rgen {Hole}}
}
