ARI: Hello, I'm Ari. [CLAUDINE: And I'm Claudine] Welcome to Proving the Negative.
ARI: We're a podcast all about exploring the different sides of cybersecurity,
from political to computer science, international relations to mathematics.
Join us as we talk to our friends about the work they do.
Really short intro[duction] today, we have Andrew, the director of our CDT,
Louise, who used to be a [CDT] student and has become a researcher.
Kevin is the Chief Executive Officer of a company called Cyjax. They do threat
intelligence, but more importantly, he is a member of our academic board!
Just before we dive in this week, we're going to talk a lot today about
different disciplines - what that means is subject areas.
My discipline is Computer Science. Claudine has many! The disciplines
she comes from are Political Science and Law. For the purpose of this
discussion, interdisciplinary is the integration of knowledge and methods.
Multidisciplinary - people from different subject areas working together,
they draw from each other's knowledge, not necessarily integration,
just being around each other. We mix up these words, but that's a
general guide as to what the specific differences are.
We hope you have almost as much fun listening to this as we did recording it!
Without any further ado, let's get this show on the road. LOUISE: I'm Louise, I
started in the cyber security CDT in 2014 looking at present[ing] threat and
monitoring data to security practitioners in security operations centres.
I was looking at alternatives to visual techniques, in particular using sound.
I've moved on to being a postdoctoral researcher where I look at systemic
cyber security risks and modelling interdependencies between organisations,
how different attacker strategies might play against different defender strategies.
I've also been looking at security for some of the alternative systems
structures that are starting to be used more and more,
in particular distributed ledgers like blockchain.
I define cyber security as protecting computing systems at the core,
protecting confidentiality, integrity and availability of data and systems.
There's a lot of complexity behind that, there's a lot of different types of
systems, there's a lot of connections and dependencies between systems,
and there's a lot of different stages to protect. It sounds simple, about
protecting computer systems, but there's a lot of complexity behind it.
KEVIN: I'm Kevin McMahon. I'm a member of the CDT Advisory Board.
In 2012 I founded a cyber threat intelligence company.
And since then, we've been helping UK government organisations and private
sector companies to develop their cybersecurity capabilities internally
and better understand the risk that they are facing
as a result of problems that are presented by cyber security.
One of the biggest challenges we have is develop[ing] recruitment pipelines.
With a skills shortage, it's difficult to maintain and keep staff with necessary skills.
There's a bit of a race on at the moment from some of the larger,
better funded organisations to snap up as much of the talent as they can.
Cyber security has been about protecting devices within organisations.
More recently we've started to understand and embrace the wider
scope of the problem and how it impacts every area of the business.
Cybersecurity can present itself in physical risk to employees, to assets,
setting benchmarks and protecting the brand reputation of organisations.
Cyber security relates to [challenges] within business and within technology.
which certainly touches upon the multi-disciplinary work we are here to discuss.
ANDREW: Hi I'm Andrew Martin, Professor of Systems Security.
I'm Founder and Director of the Centre for Doctoral Training in Cyber Security.
I first encountered computer security near the beginning of my career, 1990.
[I] look[ed at] technical aspects of how we make computers secure.
I started teaching that stuff to Master's students after the Millennium.
It was immediately very clear that you could have all the good
technology in the world and if people didn't use it right or
didn't understand it or had their own priorities that were at odds with
what you were trying to do with the technology,
you didn't end up with a good security outcome. I quickly recruited someone
to teach the course that became known as 'People and Security'.
Things have rather snowballed from there.
We've tried very much to keep a multidisciplinary approach
to security across what we do in the Computer Science Department
and more widely across the university. That became 'Cyber Security Oxford',
Then the opportunity came along to set up the Centre for Doctoral Training,
the priority was that we would recruit students from across the disciplines,
maybe a majority from Computer Science, but plenty with other
backgrounds in Law or in Social Policy or in Business or in Economics.
They would probably specialise in topics close to their their original discipline,
but they would have the experience of learning together and across disciplines
Bring[ing] diverse insights together to solve cyber security problems.
We knew that was going to be tough, but it seems to have worked.
One of my goals was that, whilst nobody could learn everything,
I hope that those graduat[ing] from the CDT know what they don't know and
know that there are more perspectives than the one that they specialise in.
It's been really good to see lots of students growing in confidence, and in
understanding security from a very rounded perspective. That excites me!
So that's still my priority. Looking for new ways to do that,
even though I myself stick to looking at how to make technology more secure.
As regards defining cyber security, it's something I've asked each new cohort
of students to do as they came into the Centre for Doctoral Training.
It's been quite interesting to see how it's evolved. In the very first cohort,
students seemed to split into groups with a very technical view,
(they started talking about networks and servers)
whereas others with social backgrounds started talking about people.
By the fifth and sixth cohorts, people had a much more rounded view.
I think cyber security has become understood as something that has to
do with how we harness technology to build security in the space, in the real
world context that is cyber space, because somehow cyber is real and
it's where we live even though it's also virtual.
That's a paradox, I suppose, but it's the place where cyber security sits today.
CLAUDINE: Claudine, part of the 2018 CDT cohort.
[I prioritise] how individuals experience harm related to content they
interact with and consume, specifically more mundane types of content,
the everyday content that could create unseen harm,
small, incremental harms we experience from everyday social media use.
I take a slightly broader view of cyber security than the traditional definition.
Given how integrated humans are in the use of technology, particularly
around how much we use our devices with one another and with cyber space.
As Andrew said, 'cyber' is real at this point!
I take a slightly broader view and look at mitigation strategies to protect
individuals from psychological and emotional harm online,
that providers of user services can implement to protect users from harm,
[strategies can] be technical, guidelines or community standards.
ARI: I'm Arianna, CDT 2016, we've done intros on the podcast before.
Where did I start? In a dark room with lots of flashing lights, lots of cables.
So a bit of a network monkey - at the moment, it's quite different.
I have worked with medical researchers and people with rare conditions.
I've looked at how we build systems - how do you architect choice?
So my priorities now, rather than the bare bones and the cables, switches
and routers, it's more about the responsibility of the (cyber sec) expert
in creating a culture where people feel safe to disclose mistakes they make
or report something without fear of getting punished.
How do you respond when something happens?
How do you pull everyone together, leverag[ing] the expertise they have
so that you're not carrying the full weight of cyber security
across an organisation? Because that's really heavy. You'll burn out, and as
Kevin was talking about, we do lose people. It's not always to a company...
How would I define cyber security? I go right back to 'cybernetics'.
Cybernetics is a system that's made of lots of other systems. It's complex.
You have different moving pieces. There's this idea of feedback loops,
you have a rule, take action and there's some outcome.
Then that outcome feeds into the next steps.
Cybersecurity is strategic. You've got to have leadership and
you've got to be able to measure and demonstrate value.
There's an expectation that cyber security people need to have loads of
deep areas of expertise, and I think it's more about - how do you facilitate,
bring in other people's expertise and then take responsibility as the expert
to do the technical work, do the deep dive and come up with these plans?
Over the series, we've seen that interdisciplinary work is difficult.
How do you think this translates to cyber security as a sector?
KEVIN: One of the biggest challenges is [that] we are typically looking for
solutions to what we believe is a predominantly technical problem.
A point you just made - cyber security is a strategic problem within organisations
and there are certain things that practitioners need to be aware of
and need to be able to manage and deal with within organisations.
Business strategy and security, first and foremost, will define your solution
Practitioners need an understanding of what business strategy is, why it is
important and why it's critical that it is led from the top,
to define solutions that you're going to implement across the organisation.
Technology is going to grow more complex as we continue to develop
at the breakneck pace that we are. The third challenge for how this
translates to cyber as a sector, is risk. Risk drives everything we do.
We've come a long way since 2005 where these problems took centre stage.
We're now considering more than just putting a firewall in place.
It presents a challenging environment for cybersecurity practitioners,
and it's something that we have to figure out how best to address.
ANDREW: Building on that, it's taken a long time to get real understanding of
how to build technology that people can use right, and to do their job.
Cyber security throws into sharp relief any shortcomings we have in
understanding how technology works, and might work when deployed,
but also how people are going to use it, rely on it and work around [it].
You may think you've built a system that's going to be used in one way.
People might well use it in another. In the absence of security problems,
that's not really an issue, as long as people are able to get the job done.
But if the workaround introduces a point of weakness that somebody else
might exploit, then suddenly all bets are off.
One of the fascinating things about cyber security is it really shines a light
on the gap between what we think we're doing, and actually doing.
That makes it quite a challenge for a lot of disciplines, because
that means thinking about how the technology works,
thinking about whether law is lined up with what we need to enforce.
Whether social practice and people's understanding, comfort, trust,
happiness in their work... are lined up with what we think is going on.
KEVIN: The technologies that are being created to make things as
easy as possible (work that cyber security practitioners have to do),
you tell everyone, 'Just point and click and we'll do the rest for you",
if they use [those technologies] outside of [intended] scope of use,
it starts to introduce other risks and other potential problems as well.
And it's an awful lot to keep track of.
ARI: How do we prioritise? Louise, I know you were us[ing] sound...
Overload and overwhelm is common. What comes first, what do we focus on?
[Teaching] people to know what you don't know, and perspectives to bring.
[We talked] to practitioners about their needs and the issues they face.
We did lots of these interviews, lots of requirements gathering,
and that's something we'd learned through the interdisciplinary course,
working closely with people in fields like Human Computer Interaction.
That's a really valuable thing that we can learn, and something
that it's really important is out there in industry.
In lots of cases it is - we can look to continue growing and facilitating
these kinds of engagements between different groups that teaches people,
this is a gap that could be filled by considering [some other] perspective.
KEVIN: We have to think about developing accessible cyber security
technologies for practitioners. They're not all going to be tech whizzes.
Some of them are going to be more focused in and around strategy, which
is absolutely imperative to help inform everyone else within that space.
The earlier we consider interdisciplinary requirements,
the better prepared we can make students, as they are
coming through the various different schooling systems
and getting into universities where they figure out where to specialise.
ANDREW: We definitely struggle with interdisciplinary work.
There are 21st century challenges that need an interdisciplinary approach.
Cyber security is one. Climate change is another.
Climate change needs somebody to understand the physics of the climate
and the economics of changing energy sources.
Impacts of climate change upon agriculture, societies... other disciplines
in order to make sense of where the best policy interventions are.
The same applies in cyber security, we need [a] grounded understanding.
Universities are still set up on a 19th century model of [walled] faculties.
Students from one faculty [cannot study] in another, particularly in the UK.
In Oxford, we don't just gather people in faculties.
We also gather them in a variety of other places, with the goal of
making sure that people don't sit in silos and ignore every other discipline.
That doesn't make interdisciplinary work easy - people still get rewarded
for publishing in traditional journals that are in a particular subject.
They get career points for being in the centre of that subject very often.
You don't get rewarded very readily for working across the disciplines
because it's very easy for work that crosses disciplines to look shallow,
from the perspective of people who are in the core of the discipline.
You need to integrate insights across disciplines to solve difficult problems.
LOUISE: I've been trying to publish in cyber security for eight years,
it is feeling more open to interdisciplinary work.
It feels like something that's slowly improving, there are more venues
that include interdisciplinary fields that I have been working on.
It sometimes feels like, if you're not firmly in one discipline, it's a challenge.
ANDREW: We knew that was going to be a problem for the CDT.
I think the students have stepped up to the challenge incredibly well.
But that doesn't mean we've solved it. Institutional structures are so deeply
ingrained that even if you push the boundaries for a while,
it's very easy for them to snap back as soon as you stop.
So we've got to keep pushing,
KEVIN: I really like the approach that Oxford is taking to this, in using other
disciplines to analyse and understand where we need to put some focus.
Perhaps that is a discipline that can be opened up to encourage students
to come in and figure out how we solve these problems,
not just technical problems typically synonymous with cybersecurity.
There's a lot of work that can be done with the skill sets that you have,
you can lead [thinking on] education for cybersecurity practitioners.
CLAUDINE: A challenge I personally noticed coming from outside,
[a discipline not typically considered as a core cyber security discipline]
there's a challenge around having a shared language across disciplines,
law, policy, psychology... which feed into cybersecurity.
Slightly different definitions of very similar terms can lead to confusion.
A common [cyber security] vocabulary across disciplines is something we,
both industry and academia, need to work on,
to be more consistent and ease communication.
ARI: We have talked about how cyber security presents challenges.
What is the goal?
KEVIN: To reduce the risk of a successful compromise [to]
your business, technology, or [the] people who rely on that technology.
We cannot stop these things from happening. Technology evolves daily.
We are never going to be able to create a 100% secure system.
We have to face up to it - cyber security is about the reduction of risk.
It's about minimising the impact that these events could possibly have.
We do that by learning from what we've already seen, events that have
taken place, looking at impact across the organisation and end users.
LOUISE: [Cyber security] should be there to let us reap benefits that the
processes and systems that we use every day have the potential to bring.
There's potential to make more efficient cities or improve Medicine
and help solve global issues like food shortages.
We need security in place to let that happen, if we don't get security right,
that underlies all that, it has more potential to go very badly wrong,
the bigger impact it could have.
We're starting to see harms that you didn't have the potential to create.
As we start to link up transport and manufacturing systems, there's more
potential to create physical harms and harms that badly impact people.
An important goal of cyber security is getting it right so that
we can have that benefit that we're trying to build.
KEVIN: Getting it right is very difficult in the current climate, with the
skills shortage that we have. As a cyber threat intelligence company,
we are continually monitoring and looking at the emerging threats
in the space, not just to the technology, but for business as well.
We ourselves are often looking to recruit skilled individuals.
One of the more recent scams that we have witnessed is people taking
advantage of this skills shortage. We are starting to see 'Skills-as-a-Service'
emerging, so almost the cloud version of cyber security skills.
But the problems that we face there are pretty much in and around trust.
We've witnessed a number of cases where developers provided for hire...
Developers take these roles and use the access to compromise organisations,
planting malware and planting ransomware in some cases.
ANDREW: To look at the goal of cybersecurity, you've got to look at
the overall development of a technological society.
We are connecting more and more people together.
We're connecting more and more things together
with the goal of making us happier, feeding more people,
using fewer fossil fuels... other things that seem to be good for society.
The downside is, the more connections you make, the more
opportunity there is for anything from mischief to straightforward theft
and scarily somewhere in the background, to existential risk.
(Whether it's to an organisation or even to a country)
The goal, somehow, is to enable us to have those technological benefits,
being able to get a job on the other side of the planet is probably good!
But without introducing small scale harms and existential risks.
Sometimes you look at technologies and the way people use them,
and you wonder whether we get scarily close to
scenarios better as movie plots than the real world.
The goal is to keep us out of the movie plot world and in the world
that makes people happier, healthier, wealthier and so on.
ARI: I like this vision, but there are practicalities and realities where we
don't enable everyone and we are not feeding everyone.
At the end of the day, people come to work to do a job.
One of the roles of cyber security experts is to translate.
They have to figure out what motivates people.
Kevin, I think you're right. It has to come from the top.
That's where the money is and that's where the pull has to be.
But I read reports that tell me boards don't understand.
They think [security is] important but don't know where to start.
There are toolkits for how you communicate with the board
to get that imperative for cyber security work.
Perhaps it is about taking the ego out of it. We have a rock star mentality,
we're in cyber and it's very shiny, it's very new.
We're going to make the UK the most secure, the best place to do business.
We need as many eyes out there as possible [as a security method].
How do we get more eyes? How do we get people reporting [instead of]
creating their own workarounds. Hacking works both ways -
it can be bad, but it can be useful if something [is] in your way,
you figure out a way to work the system that makes your job easier.
KEVIN: The board level is still reactionary in the UK (and abroad).
They sit there and think 'It's happening out there, but not to us...'
'... so why should we make the investments?'
And they are considerable investments that we're talking about.
Companies are asking 'Why should we make these investments to do this?
Can we offload this to [a] third party and get rid of the responsibility?'
Unfortunately, we see organisational boards taking that approach.
ANDREW: That brings us back to interdisciplinary study.
Whilst there are some things that we can clearly do, that will improve
our cyber security, the evidence base is lacking overall.
Senior management at the university is very exercised about this subject.
If I want to give them advice about [making] the university a safer place,
I could tell them to triple the budget of the central cyber security unit.
But deciding which [advice] is good and bad is not backed by evidence.
Perhaps because we've got an immature science,
perhaps because the question is just too hard.
E.g., a lot of people are told that password safes are a good idea.
Media articles are conflicted on whether the password manager
built into your browser is a good idea or not.
There are arguments, both ways. As a scientist who understands the issues,
I'm not sure I could tell you hand on heart, which will actually reduce your
risk more, because there's a lot of contextual factors that go with it.
As a scientist, that's a problem.
KEVIN: I think we've teased out a better answer... the goal has to be to
educate everyone to the risks so that they can act and respond accordingly.
You have to educate everyone across the business.
Janitors have email addresses, they need to be educated to the risks of
using those - clicking on the links that could potentially target them.
This slips through the net - you are only as strong as your weakest link.
ARI: We use 'educate the users' to absolve ourselves from responsibility.
The cleaner needs to clean. Ultimately, it is the organisation's responsibility
to follow upon that, have some measurement for what's going on,
and rather than punishing this person if they get got by a phishing attempt,
instead, it's saying 'Oh, OK, right, well because we've had training, you...'
'... know what phishing looks like, [that] you've done it' - no shame.
One of the issues with cyber security training is it's completely irrelevant.
You cannot have a one size fits all approach because
your HR bod [Human Resources person] is not going to have the same
motivations as junior software developers.
There's just different people who have different priorities.
That's one of the fundamental complex issues we have to tussle with.
KEVIN: User gets phished [clicks a bad link, allowing unauthorised access], it's
not their fault. That, in itself, is an example of a failure of the
organisation to properly prepare a security strategy.
If the end users are being successfully phished, [the org. is] not providing
them with the right information to understand that it's happening.
ANDREW: I was going to say exactly the same. If your business relies on
the cleaner not clicking on the wrong link, then there's something wrong.
Your business relies on the cleaner not putting bleach in a kitchen dispenser.
We know how to manage that risk - most of the time!
But the cleaner shouldn't be expected to do tasks that belong to techies.
We have got to be clear on that, as you've all said, we can't just assume
that training people is the solution. We've got to use the technology right
and not simply assume that giving everyone a multi-purpose,
multi-program device that connects to every other device on the Internet
is a safe or straightforward thing to do. ARI: Or feasible, or cheap!
CLAUDINE: Just one thing to add is that a goal of cyber security is to shift
focus somewhat and put more emphasis on the end user.
Organisations and businesses are the key focus for
a substantial amount of the cybersecurity sector.
But traditionally, the impact on end users (when there is a breach)
tends to be an afterthought or a secondary harm, i.e., not prioritised.
Perhaps shifting focus more to the impact on end users as well as
the organisations tasked with protecting or controlling their data,
would help shift perspective to a more interdisciplinary and holistic view,
[providing] better insights into avoid[ing] situations like the cleaner
or someone who simply doesn't think (in the context of their job or life),
about security ramifications of the tech they use and have access to.
ANDREW: One more thought there, cyber security awareness training
[is everywhere] in business and even in the university, I think.
But if that's any use at all, it can only be the baseline.
What we actually need are people who make decisions to have a deeper
understanding of the implications of the decisions they make.
Cyber security in decision-making, in [the] design of new facilities and
services and products and so on needs to follow. The interdisciplinary
approach needs to go much deeper into the training of every profession,
not merely the don't click on links kind of advice.
LOUISE: It's very important that we look at where this is all going, where
this is going to be in 3-5 years when we're thinking about skills,
engagement and which disciplines we need to be working with.
What we build and create now is what's going to be used
when there will be a different landscape. We're talking about [a]
need to train cyber security people to engage in the right way, ensure that
the organisation is doing the right thing and employees aren't relied on...
This all moves so fast and in terms of research, industry and policy,
[we need to be forward-looking in terms of]
the training we do now and what engagement we facilitate.
Join us next week for another fascinating conversation.
In the meantime, you can tweet at us @HelloPTNPod
And you can subscribe on Apple Podcasts or wherever you listen to podcasts.
The title there is PTNPod. See you next week. ARI: Bye!
CLAUDINE: This has been a podcast from the Centre for Doctoral Training in Cybersecurity, University of Oxford.
Funded by the Engineering and Physical Sciences Research Council.