ARI: Hello, I'm Ari. [CLAUDINE: And I'm Claudine] Welcome to Proving the Negative.
ARI: We're a podcast all about exploring the different sides of cybersecurity,
from political to computer science, international relations to mathematics.
Join us as we talk to our friends about the work they do.
*Sound bites from interviews*
HARMONIE: There's a shift of attention towards cyber security, it comes at a cost.
BERNARD: There's a more complex value chain that now sits behind 'product value'.
JOHN: You want the smartest room of people, to deal with complex problems.
AWAIS: This is something that is truly an international effort.
CHRIS: The latest cyber strategy starts to expand and tackle tough problems,
building on what we've already done before.
ARI: Hello everyone. Welcome back to PTNPod, it's great to have you with us.
This episode is just a smorgasbord of delights.
This is a special episode. We got ourselves invited to a conference,
celebrating Academic Centres of Excellence in Cyber Security Research (ACE-CSR).
At this conference, there's lots of people interested in cyber security,
doing work across the board: cyber physical systems (water, power grids),
we've got a bit of international relations and politics,
[and] how we're teaching, how we're educating.
What we're trying to do in the UK is build an ecosystem.
This ecosystem will have students and newbies, people building careers,
people who have been around for a little while (i.e., before 'cyber' existed).
We want all this expertise to make the UK a safe place to be and do business.
We're going to start with an introduction to the UK Cyber Strategy.
Now, this is very exciting because it points us in the right direction.
We'll be talking to industry, policy and academic people to understand value.
The question here is 'what kind of bang are we getting for the taxpayer buck?'
We will start with [the] big picture, [then] move on to value and
what value looks like in the work we do. We'll talk to someone who reminds us...
...there's more to life than cyber security.
You'll hear ideas we've talked about in other episodes (e.g., the skills gap),
as well as new projects, like the Cyber Security Body of Knowledge (CyBOK).
We wondered why no students were coming to talk to us...
We were in a room set aside from the main conference... we found 'em!
We found where the food was, and the free coffee.
At the end of the episode we interview students who are doing great stuff.
Without any further ado, let's rock and roll.
CHRIS: I'm Chris Ensor, one of the Deputy Directors of the
National Cyber Security Centre (NCSC), responsible for cyber growth.
We all rely on technology today. It's just how we live and ultimately
we need it to be safe and secure so people have confidence in it.
That's the job of the National Cyber Security Centre,
how do we make the UK a safe place to live and work online?
The priority for me is how do we make security easy for everybody?
It shouldn't be hard. People should be able to use stuff securely by default.
For me it's all about how we make that happen - how we build in security.
How do we make the companies who build software,
build it in a way that doesn't make people more vulnerable to cyber attack?
We rely on technology, and that isn't going to change any time soon.
We want that technology to be secure and robust against any sort of cyber attack.
[In] the long term? Will cyber security be a discipline into the future?
I don't know. But certainly we want cyber security built in.
Over time you'll see the standalone discipline, which is security in the corner,
part of everyday life so people don't have to worry - it's already there.
The Cyber Strategy begins to tackle longer term problems: the use of regulation,
[and] the need to upskill and look at the education system.
We've learned a lot from the last two strategies and this one builds on it and
starts to expand and tackle some of the really tough problems,
building on what we've already done before. ARI: Chris Ensor, from the NCSC.
Talking about strategy is really helpful because it gives us [a] roadmap.
The place we're trying to go is the UK being a safe place, to work and live.
This has to be the same for everyone. The government's responsible for taxpayer money,
so the directions that they set have to be resilient. It's got to 'bounce back',
in case anything happens. This long term roadmap is what the strategy is for.
My name's Bernard Parsons, I'm the CEO of a cyber security company called Becrypt.
We're a UK developer of security products and services based in London.
The main focus for us at the moment is around endpoint security.
The endpoint is where a lot of cyber attacks gain a foothold.
'Endpoint' refers to company devices that users interact with to do their job,
typical examples being laptops and desktops, tablets, mobile devices.
But actually it can be viewed more widely than that.
There's some work we've been supporting recently where actually
the term they're using is 'enterprise connected devices'.
So it gets even broader and starts to pull in things like printers and scanners.
All of these devices have an increasing amount of intelligence within them,
very often what comes with that is increasing vulnerability.
Most of what we do is around securing desktops within enterprise environments,
but it does extend much more broadly now. We did some work with government...
[making] endpoints more resilient to attacks and resistant to cyber threats.
[Delivering value for money is] about reducing endpoint risk within organisations.
You can come up with the best security in the world,
but if you can't deliver in a way that's [usable],
and [cost-efficient], you're not going to get off the starting line.
It's all about being able to deliver a convincing value proposition.
It's interesting to think about the big picture, because it's quite cross-cutting.
It's difficult to think of cyber as separate, and that's reflected in the UK Cyber Strategy.
Now that is the 'Cyber' strategy as opposed to 'Cyber Security'.
It cuts across technology, over into socio-economic and environmental aspects.
The 'right' amount of cyber resilience for your organisation,
is increasingly important: managing risk as part of what you want to do.
Managing cyber-related risk in a way that is appropriate for you,
Is about getting the right controls and processes in place [to] balance
operational efficiency and [cyber-related] risk management.
ARI: I asked what value looked like and this is what we talked about.
BERNARD: It depends [on] scope. I could approach answering [this] where I'm
only going to be concerned in proving to you what the value of my product is.
It's a much bigger conversation than that, because any one
product is part of a much bigger environment and set of systems.
If I tackle [this] at product level, it is a big problem for cyber security.
As a sector, how do we demonstrate the value of what we're building?
Historically, what one looked towards to answer that question was product assurance.
[Getting] some independent entity to certify my product against [a] standard.
Product certification that gives someone a tick in the box,
and we're happy. That has has been problematic. [Some] background...
It used to work with very well defined categories of product.
In the early days, what Becrypt was all about was building encryption products.
Very easy to define a set of standards and criteria: 'to encrypt this...'
'... this is what we want.' Algorithms, how you manage credentials and so on.
You could get a certification for that - something of value.
But then, how that artefact sometimes got used by the consumer,
was problematic. People would use [it] as a proxy for informed risk management.
So, somebody told me this product is good,
I don't need to think about what I'm storing, how long I'm storing for, and so on.
Product certifications have their challenges, even where easily applied.
But as technology has evolved and become more diverse,
traditional product certification has become strained - it's difficult to create
criteria for what technology should and shouldn't do for [what] we have today.
That's why you're seeing a lot of work taking place,
where they're trying to shift the model more to thinking about,
principles appropriate to classes of product, rather than prescriptive criteria.
More outcomes based, e.g., how a particular manufacturer might build a product,
but also what surrounds that. The processes of the organisation itself.
There's a more complex value chain that sits behind the question of product value.
It's an evolving space and we're supporting some of [that] work.
It's a whole different conversation at the the economic level, where
we sell products. Following on from the difficulty in providing assurance,
what that leads to within cyber, is an increased amount of information asymmetry.
The cyber market is dominated by companies spend[ing] more on marketing than R&D.
That leads to a situation where it's difficult for buyers to tell good [from] bad.
That drives companies that want to invest in stronger controls out of the market.
That drives down the average value of products being delivered in the market.
The net result is - investment from companies within sectors that
need to demonstrate security and resilience, without a net increase in resilience.
ARI: Dr Bernard Parsons MBE. CEO of Becrypt.
Talking about organisational security is important in reducing the risk that
printers, whatever that these devices pose to a business.
If a hacker was going to try [anything, these devices would be on their] list,
trying to find holes, weaknesses. The way we do business is changing.
The technology is developed very fast, it's clever, and sucking up a lot of data.
Oversight and quality checking has never been more important.
Rather than having tick boxes (which ARE helpful),
the first step is having [an] expert suggest where your priorities should be.
What's the number one thing to address?
You can also ask yourself questions: What do we want this technology to do?
How do we expect this thing to happen?
What don't we want? What is not acceptable? HARMONIE: My name is Harmonie Toros.
I am a Reader in International Conflict Analysis at the University of Kent.
I research security negotiations and violence.
My priority is to ensure that research into (critical) security studies,
is learned from by the (academic and policy) cyber security community,
it's important we understand that a lot of the terms we use,
can be very complicated and have upsides and downsides.
The main problem I am addressing is that, because (cyber security is) a new field,
there is a tendency [to see] security as a positive. It usually is, I would agree.
[But it is not challenged, or looked at in a critical way] Also, resilience.
I've had many conversations here,
[asking], do you see the (political) difference between security and resilience?
Security is [a] State's (and company's) responsibility to secure people.
Resilience is [a] person's responsibility. There's a shift there.
These are important questions [with] legal and political implications.
My goal [is] to transfer reflections and critical engagement from security studies to cyber security.
I come from a terrorism studies background. That's what I studied for a long time.
One of my main concerns is - however many governments would decide that terrorism
was either the greatest, or one of the greatest, threats to national security,
I could find very little evidence.
If a country like the UK tells me that terrorism is the greatest threat,
I can't understand how that is the case. There's no metric.
However, it was there.
It was there in all the documents. It was there in the money being poured into it.
We're moving away from terrorism, but there's a shift towards cyber security.
We need to understand that that comes at a cost. A cost of funding going to
mental health, education, social services, safe spaces...
We need to know that if we're moving attention towards cyber security,
that it is really a threat to national security.
How is it a threat to national security? How much money do we have to put in?
We need to make sure that security questions are looked at outside of security.
Of course, within the security world, cyber security is very important.
But we have to look at it in a broader, societal way.
What are the other problems we are facing? What other questions do we [face]?
If you only look at cyber security within the security silo, it seems essential.
[More broadly], you understand that if we're focussing here, we're not focussing there.
I'm going to end with a little anecdote.
In conferences I'm often asked 'what is the greatest security threat?'
The greatest security threat, statistically, to me is my husband.
I am more likely to be killed by my husband than by anybody else.
And the greatest security threat to most men in the room [is] themselves.
We need to think about security in that way.
We need to think about other ways in which people are hurt and suffer.
Dr Harmonie Toros, Deputy Director of the Institute of Cyber Security for Society,
University of Kent. In this conversation, we talk[ed] about how the words we use matter.
The policies that direct public funding are steeped in assumptions.
We need to be specific about what needs addressing.
Who is at risk? What can we do about it? What should the bare minimum be?
Cyber security [is] fairly new and there is some risk of it being overhyped.
Rather than re-inventing a shiny new wheel, we could just use the ones we have.
Take stock. Be critical. And only promise things that can realistically happen.
[That's] why I enjoyed this conversation so much!
The takeaway for me is that the world is much bigger than I am,
having a micro focus is a problem because you oversimplify or ignore problems.
I'm Furrah, I'm the RITICS Programme Manager, a programme funded by EPSRC & NCSC.
It's coordinated at Imperial College London, a hub for security, research and engagement.
We give money to people to answer [research] questions on cyber-physical systems.
Cyber physical systems [are] attached to our everyday life.
A colleague gave birth - computer systems in the hospital were hacked,
she was administered the wrong amount of medication and became deaf.
You can see the implications... [of cyber-physical risk causing harm]
It's important for us to make [systems] more secure and do more research.
Cyber is involved in everything and anything, from ships to planes to boats.
So why is it important in cyber-physical systems? Because we're interconnected.
We're connected to each other. Everything runs off each other.
It doesn't rely on one source. You need multiple things.
If you're flying a plane, you've got a security system trying to keep it all safe,
make sure no can hack into [it]. You need systems on the plane to run.
And then when you're in the airports, to receive the correct information.
It's not just one branch, it's connecting to one another. You need lots of skills.
I have a degree in Forensics, a Master's in Security and Resilience...
I have skills: communication, networking, administration.
You need to be able to talk to people, mingling, know what to ask, when to ask.
You need to know how to navigate people within academia [and] government.
People in industry are more formal whereas people in academia [are]
a little more relaxed. You need to be able to assess, adjust and be observant.
Not everyone has those skills.
Furrah Hussain, Programme Manager for RITICS, the Research Institute in Trustworthy, Interconnected Cyber-Physical Systems.
Furrah talks about how interconnected cyber-physical systems are.
We'll talk about [these] systems again later. A couple of examples,
water and energy systems - anything that's also physical,
not just in the computer.
She also talked about skills useful in a government funded cyber security research programme.
You don't need to be super technical to appreciate the complexity of systems.
There are different kinds of technicality and different areas of expertise.
It's important that the kind of skills that help get her job done: communication,
networking... we shouldn't overlook them.
Academic Centres of Excellence, they're only one piece of the puzzle.
There [are] all sorts of networks and hubs of expertise; people sharing ideas.
It's not just about having rockstar researchers.
I'm Fabio (Kings College London). I work at the intersection of AI and system security.
AI is really the most viable solution for protecting systems in the long term,
especially given this scalability of threats appearing in the wild and
the fact that attackers have more resources than defenders typically.
The main challenge in this,
is bridging the semantic gap between experts designing systems and people [using them],
like security analysts.
In the research community, we have methods and systems understood by experts.
The very important thing is to create solutions that can be understood and
used by real world analysts [who] may not know much about [AI/machine learning].
Whenever I design a new project,
I ask myself how it can be useful, how it can help while being practical.
Being able to practically the blind in the wild I engage with.
I [discuss these topics with other academics] and industry about [their] needs.
I have an ongoing collaboration with Avast and I have been talking with NCC Group.
We talk different languages, even while we talk about research.
Research in academia means publishing papers,
in industry it's more about the mission of the company, making systems efficient.
I tend to talk a lot to industry people, and want to learn from them.
It's important that we keep bridging this communication gap.
Cyber security fits everywhere. It's about creating safe spaces for people.
My research focuses on system security [which] happens behind the curtain.
It protects people, keeps their data safe, their money safe.
Cyber security should really create a better and more peaceful society.
Dr Fabio Pierazzi, Lecturer in Computer Science at Kings College London.
When Fabio is talking about bridging a semantic gap, we're coming back to words.
Everyone speaks a different language, it's worth making sure we're on the same page.
He's also talking about making sure that research is informed by the needs of
the people who are going to use whatever it is you build.
Translational work is important, particularly in cyber security.
Being able to speak to people in their own words, or maybe a shared language.
Translating, to make sure we're all pulling in the same direction...
Without this work, you build things that aren't helpful, useful or usable,
and worst case, it's a waste of taxpayer money!
I'm John, I work in the NCSC in a team called the Sociotechnical Security Group.
We undertake multi-disciplinary research into cyber security problems.
Trying to take on board different academic disciplines (psychology, economics...)
[Looking] at problems [with] a multi-disciplinary perspective to understand them,
rotate them around, and see if we can address or manage them.
It's a range of problems we look at, it goes back to the NCSC mission:
How do we keep the UK safe online? From that, there's a whole raft of [ideas].
So, for example, we care about assurance. We care about cyber incidents.
We want to understand what happens, how we can manage them, learn from them,
and how we can try and put (mitigations) in place.
If I'm looking at economics, I might apply that to ransomware,
[to see] what are the implications? To do that we go out to a broad network,
beyond the team - academia, government, UK allies and commercial partners.
Trying to expand the room, because we want the smartest
room of people to be able to deal with some of the most complex problems.
To do that, we have to go beyond our boundaries to draw in the biggest,
smartest room to tackle long term systemic problems.
We're always looking for 'lenses', different disciplines.
The last two years I've been looking at economics, building a network of expertise
and then trying to develop a set of research questions,
which is going to tackle and feed back into the priorities we care about.
I'm now looking at a new sort of space,
how [we can] bring in international dimensions, international relations.
It's about trying to identify what's new in terms of technology,
[and] academic disciplines that can help us develop [a] more nuanced understanding
I think 'problems' is the wrong word. There are opportunities as well as problems.
Part of it is trying to frame it in that way because it goes beyond safety into...
how could you think positive? How can people live their best lives online?
We're increasingly living online and living blended, distributed existences.
And part of it is about - how do we do that best?
How can we have safe, happy communities but also live individual lives where
the challenges posed by technology can be addressed and thought about in advance.
There are bigger questions about people that seek to cause problems,
part of the NCSC's missions is about protection.
Whether that's nation states, criminal gangs or unintended consequences.
You don't need bad actors, you can have unintended consequences.
The root of what we do in this group is systems thinking.
The more complex systems and interactions you have from systems of systems,
the more unexpected outcomes... technology is a big Factor X in all that.
ARI: I couldn't resist asking John about systems of systems. We've come across
the idea that a big system made up of smaller systems is complex.
I wanted to ask how you manage all of that work [and] complexity.
JOHN: Quite often...
you're not looking at something which is static, [it] is dynamic and changing.
Even if you get the snapshot right...
The spiel I use when I have my slides, which you'll be thankful I don't have here,
I talk about the idea that it takes a village to raise a child.
From a multi-disciplinary perspective, what goes into raising that child?
You could talk about the parents, the school,
the village, the child's own psychological development.
You could go into attachment theory...
Beyond that, you'd look at anthropology and other disciplines, educational theory.
You could keep on going. At some point you have to bound the system.
There's a quote from George Box - all models are wrong, some are useful!
We're never going to get it right because it's changing.
From our perspective, we're not looking at that model for [a] child.
It takes an ecosystem to produce a cyber incident.
These things don't just happen by themselves.
it's not the case that 1) hardware, 2) software or 3) people did something wrong.
You've got to try to understand the broader ecosystem.
You could look at social networks, hardware, policies, supply chains...
Assurance, social engineering... behind each of those, issues and subdisciplines.
How can we reach out, draw on expertise and bring it together?
One of the things we're doing at the moment is looking at ransomware.
We work with economists to understand an illegal marketplace like ransomware.
We have [ideas] about how we prevent market failures using economic theory.
What happens if you flip that on its head? We want to use economic theory to try
and understand how we can degrade and prevent a marketplace from working.
That's great, but how do we test that?
You can't get data on marketplaces [but] you can get historical datasets.
[Medieval Historians are showing us] how legal marketplaces were disrupted by the Catholic Church.
If you take the structure of those marketplaces,
it maps across very strongly to the sort of the marketplace for ransomware.
The point is, you've got triangulation.
This is telling you how you can use that understanding from the past,
using economists, using technical expertise,
[and] historians to bring these things together to try and identify where we
should be focussing our energies in trying to disrupt a threat to the UK.
ARI: That was John from the Sociotechnical Security Group at the NCSC.
He is talking about sociotechnical work [solving] real, large scale problems.
This is important because we can't just simplify things.
A lot of the time it's not about everybody understanding the problem.
It's about technical experts digging into their areas of expertise and then
returning to a level where we can understand what that means in real terms.
We develop an approach together, or we don't understand this problem at all.
I love the idea that - you don't want to be the smartest person in the room,
You want the entire room to be smart. People have different approaches,
I completely resonated with that.
Innovation doesn't happen in a vacuum.
It's much more about creating space for this work to happen.
AWAIS: I'm Awais Rashid, Professor of Cyber Security, University of Bristol. I lead the Cyber Security Body of Knowledge (CyBOK) project.
ANDREW: I'm Andrew Martin, Professor of Systems Security, University of Oxford.
I'm a member of the Executive Board of CyBOK . STEVE: I'm Professor Steve Schneider.
I'm at the University of Surrey.
I'm Director of the Surrey Centre for Cyber Security, I'm a (CyBOK) Executive Board member.
AWAIS: CyBOK was born out of a need. Most mature disciplines have bodies of knowledge.
Cyber security as a field has grown in maturity,
[but it did not have a body of knowledge that educators and trainers could use]
How do we know what good looks like when trying to train people in this area?
Given [the] varying quality [of available resources], is there an authoritative source?
The challenges are articulated in the aims that we set ourselves.
The project was funded by the UK's National Cyber Security Programme,
UK cyber security doesn't live in isolation from the rest of the world.
There are a number of excellent experts around the planet.
The biggest challenge has been to make sure that this is truly
an international effort where experts from around the world come together to
provide input [and we maintain the rigour of that process].
It's not just members of the editorial team or executive board making decisions.
Community has to be involved - these people are experts in the field.
I'm going to borrow from someone else who said this to me,
The author and reviewer list reads like a Who's Who of cyber security.
That credibility comes from the expertise of the people,
and the rigour [of the] reviewing and editing,
and the wider community input that comes in.
There are a number of key things that have happened.
In the UK we have a certification programme with the National Cyber Security Centre.
If there are certified degrees in the UK in cyber security, they are based on CyBOK.
So we are actually using it in education and training materials.
It's also being used as a guide to design new courses.
It allows you to compare where the focus of different programmes lie.
There isn't a single [type of] expert. The people you need to build cryptographic mechanisms
are very different than people who work in a security operation centre.
Both are equally valuable, but the knowledge and skills [are] different.
It allows you to see whether programmes are delivering relevant knowledge or not.
STEVE: There's a number of activities that we've got going on at the moment.
We're running a call for small projects.
We've had two very successful runs already and have built up a good body of
supplementary material that's used to support CyBOK.
We're looking for more small projects for the community to develop.
We're also looking to recruit industry champions
[who] will work with the CyBOK team and industry to embed CyBOK in industry.
We're developing knowledge guides (emerging knowledge) and topic guides,
where particular topics are embedded [throughout] CyBOK.
It's about bringing them together.
We're looking at security of AI systems and the use of AI in cybersecurity,
which appears in various places in CyBOK. We wanted to bring that together.
ANDREW: Discipline[s] change and develop over time. That's true of cyber security.
We want CyBOK to remain relevant, it mustn't become something that nobody looks at.
Nor do we want it to be a straitjacket for people, not keeping up with the field.
Since we published the first edition, we've had a process for change requests.
People can spot errors or typos, they may want to comment...
maybe propose something that we've missed and really needs to be added.
We're also aware that people are busy and may not always get around to telling us.
We're about to proactively go out and look at a number of the knowledge areas
and ask whether they're still a good summary, or need a bit of an update,
a bit of a reorganisation of material, perhaps.
We'll get experts to do that and to keep us keep us on our toes.
Periodically, we expect to do a bigger review of the overall scope of CyBOK
[so] it remains aligned with the community's thinking on cyber security.
ARI: I asked who this community was, and really liked what they had to say.
AWAIS: I would say this is my personal view, not the CyBOK project's view...
Our community is any professional who wants to learn about the topic.
Ultimately CyBOK is used to build education and training programmes for them.
CyBOK is a way for employers to see whether they have the knowledge.
But at the heart of it we talk about the cyber security workforce gap.
They are our primary community.
STEVE: The beneficiaries of all this, of increasing our capability, is the nation.
We are talking about the resilience and the
ability to maintain infrastructure and the whole of society
making sure that we have the right skills
to make sure that the systems will work in the way that they should.
ANDREW: Part of our objective has been not to have a boundary to the community,
so CyBOK resources are freely available for download.
That means we get people telling us that they're using CyBOK across the world.
And so the community is boundless. ARI: CyBOK brought together documents, people,
a lot of areas of expertise, to map out different topics within cyber security.
This work is giving people who create teaching materials and education programmes
content to work with [and] they don't track you when you access their website!
Cyber security as a field is being taken more seriously in the UK.
We're seeing standards being mapped out, professional bodies forming around CyBOK.
It was a real privilege to get to talk to them. ANDREW: I'm Andrew Hood.
I'm a Lecturer in Cyber Security at Cardiff University.
One of the problems we're trying to solve is recruitment within cyber,
especially within academia, finding talent to be able to work on our research.
I come from industry and I've also been a Youth Offending Officer.
I've worked a lot with young people - one of the things we tend to miss is talent.
When I started at universities, I noticed that (enthusiastic) young people came in
but nobody was taking them seriously. At Warwick and at Cardiff,
I started a programme - rather than trying to recruit a research assistant,
I would take that role, break it up into a pool of hours [and] recruit students.
We can use the infrastructures universities already have to allow us to do this.
I end[ed] up [with] a team from different departments, not just Computer Science.
They work on the research together.
They've been very successful. Warwick, I had 26 undergraduates. We're starting at
Cardiff with 6 students working on a project funded with the Alan Turing Institute
The priority is to build up our skillset within the industry.
Within UK-based companies. We have a huge shortage of technical skills,
we're really struggling to find people who have backgrounds in hardware,
cyber-resilient systems... that starts at university, identifying talent early,
nurturing it and growing it before releasing it out into the UK space.
We have a responsibility as academics to support industry. This is one
of the ways we can do it, by helping prepare the next generation of experts.
Cyber security is in everything.
I think it's vitally important that we start investing in our young people.
I firmly believe that you can only really learn cyber by doing cyber,
the things we learn most in industry is when we're actually working on it,
not necessarily sitting on an online course.
All my teaching is lab based, it's all technical, it's all hands on.
If I want you to read lecture slides, you can read them in your own time.
There's no benefit in that from a teaching perspective.
Benefit comes from you working with other students, solving real life problems.
That's something that universities can really embrace.
Cardiff built an entire new building to allow us to be flexible in this space.
And I think that's the future.
If you are running a degree on a lecture slide basis,
then you are failing your students and you are not preparing them properly.
We've developed a Masters in Cyber Security, linked with PricewaterhouseCooper's.
PwC are keen for us to develop a technical Masters.
One of the complaints from industry at the moment is that Masters programmes...
they're no longer preparing somebody to be a Master of the subject.
PricewaterhouseCooper's was keen for us to develop a technical Masters.
The Welsh Government is supporting us, providing fully funded bursaries.
We've looked at every module [asking] How can we teach this in a physical way?
We've created a whole lab devoted to teach forensics.
We've adapted all our labs to allow students to explore the subject matter.
Andrew Hood, Lecturer in Cybersecurity, Cardiff University.
The way that Andrew talks about training undergraduates as researchers,
encouraging them to start exploring ideas and building confidence in themselves.
It's really important because universities nourish independence and ideas.
Part of the pipeline that feeds a trained workforce into various sectors.
A trained cyber security workforce starts to address the sector's skills gap.
My name is Matthew Boakes. I'm a PhD student at the University of Kent.
My primary focus is biometrics on mobile devices and how we can test them,
the environments and scenarios available for mobile devices is bigger than,
say, airport gate systems, where it's much more static.
Something that's come up more in recent years is ethical use of biometric systems.
Some recent examples over the pandemic,
facial recognition technology to track citizens leaving the house, in Ukraine
using facial recognition technology as part of their strategy,
using an organisation that isn't so ethical, pictures scraped from social media.
So there's this whole debate about whether this is ethical.
[The company] was fined by the Information Commissioner's Office in the UK.
[There's a] whole drive towards a passwordless society.
If you've heard of the FIDO alliance (https://fidoalliance.org),
that's their main aim, to come up with how can we go towards 'passwordless'.
Both Microsoft and Apple are driving this.
The use of biometric sensors in your smartphone, more and more in laptops...
That's where I see biometrics - playing a part in driving this passwordless world.
Biometrics, something we carry on us all the time, can't really be changed.
That's where I see it fitting into the big picture.
ARI: Matthew's talking to us about biometric systems (biometrics: eye scans, etc.)
He's talking about the systems themselves, [and] their ethical use.
This is important because, as biometrics are embedded into laptops etc.,
people are getting less of a choice about sharing quite personal data.
I've seen people needing to access a (payment) till using their thumbprint,
[Is that the] difference between being hired or not getting the job at all?
People building new biometrics need to be considering ethical implications.
We're not saying that they need all the answers, just thinking about imbalances,
perhaps even drawing colleagues in who do specialise in this kind of space...
MARIOS: Hello. My name is Marios Samanis, a PhD student, University of Bristol.
I'm interested in the security of industrial control systems, attacks,
and cascading effects of cyber attacks on interconnected critical infrastructures
How can we disrupt one system and see effects in another?
It's important to have a lab environment to be able to do practical research, test
attacks or defences and be able to program such systems, policies and so on.
I'm interested in digital twins, which is something that we [are working on].
This is what I think is important.
Critical national infrastructure is very important, separated in the past,
but now interconnected with each other, the internet, the [power] grid and so on.
The attack vectors are much greater, the vulnerabilities are much bigger.
We need a security plan in order to secure these infrastructures.
ARI: Marios is talking about critical national infrastructures (CNI).
We're more at risk now because not only are they getting connected to each other,
which can be a problem because these systems are different to one another.
So when you stick them together, you might get holes in communication and weak spots.
They're also connected to the Internet (so we can look at data in real time?).
These systems need to be protected from disruption, not just being turned off.
MARIA: Hi, my name is Maria Sameen.
I'm a doctoral student at University of Bristol under the CDT programme
[I look at] TIPS at scale - trust, identity, privacy and security.
Cyber security is segregated and not considered fundamental in organisations.
I believe that everything is connected.
We need cyber security to be thought of as regulatory practises, social science,
how users perceive security. Cyber security in the future shouldn't be a buzzword.
Users are becoming more susceptible to different privacy
harms, exploits etc. You are already in the era of smart homes,
24-hour surveillance systems, or smart cities for (surveillance outside homes...
... inside our homes), you need to take steps now so we can have a better future.
ARI: Maria was talking about how cyber security should have multidisciplinary aspects.
This is something we've seen in a few of the conversations today.
This is a good way to think about cyber security, especially as a starting point.
If you expect to think bigger picture, be open to new ideas and inputs,
perhaps we'll have fewer nasty surprises along the way.
PRIYANKA: My name is Priyanka. I'm doing a PhD in Cyber Security, University of Bristol.
Every organisation has the security operation centre (the SOC) with different teams.
Security monitoring, the red team, incident response and threat hunting.
Most literature covers the SOC.
The challenges, how a SOC performs and operates. Less literature around threat hunting.
My research is to understand how can we help threat hunters perform better.
Because I worked in [a] SOC in my past, I understand there are lots of challenges.
I understand what they go through - I got an opportunity to do research,
My first priority is to help them. Everything is digital now.
Everyone is using machine learning, AI - cyber security is really important.
And so I think cyber security will be... it's going to be a blast!
ARI: Priyanka was talking about helping threat hunters do their job.
Threat hunting is a really important approach to dealing with cyber attacks
because instead of retrospective or passive work after things have happened,
these teams face real challenges in real time.
As an ex-threat hunter, Priyanka has a general idea of her research,
by understanding the challenges these people face, we can reduce obstacles!
On that note, we're going to wrap up this episode.
Hopefully this demonstrates the value of cyber security work.
A big thank you to the NCSC for hosting the event and inviting us.
A massive thank you to everybody who's taken part. We leave you on this note.
We protect things together or we don't protect them at all.
What does this look like in real life?
Understand your context, know who you're working with, understand what you want to achieve.
Thanks for listening, everyone. See you next time.
CLAUDINE: You can tweet at us @HelloPTNPod and subscribe
on Apple Podcasts or wherever you listen to podcasts.
The title there is PTNPod. See you next week. ARI: Bye!
This has been a podcast from the Centre for Doctoral Training in Cyber Security, University of Oxford.
Funded by the Engineering and Physical Sciences Research Council.