ARI: Hello, I'm Ari. [CLAUDINE: And I'm Claudine] Welcome to Proving the Negative.
ARI: We're a podcast all about exploring the different sides of cyber security,
from political to computer science, international relations to mathematics.
Join us as we talk to our friends about the work they do.
CLAUDINE: How's it going, Ari? ARI: I'm excited for our top 5 moments.
Anirudh, Klaudia, Harmonie, Sean, Mary...
I'm going to kick off with Anirudh.
ANIRUDH: Digital resilience means children have digital and mental tools,
to cope with the challenges that they're facing.
Browser plug-ins, add-ons for your phone to prevent data sharing...
The mental tools are important as well. If you find a photo appeared online,
which you didn't want to be online, how do you cope with that?
We taught children to navigate the physical world,
now we have to teach them how to navigate the digital world.
Long term consequences need research.
For a child growing up using Facebook, what are the consequences
once that child has become an adult?
How does this person engage with other people?
How does it impact their relationship with their kids or people around them?
ARI: In this clip, I enjoyed [how] Anirudh talks about long term impacts,
we don't know what they are [and are ill-equipped] to map [them] out.
Big social media platforms have all the data, researchers don't.
Because there's no conversation happening, we're missing out.
CLAUDINE: I like the zooming out he did - he went into detail,
he did also pull out big picture concerns.
ARI: Kids are a vulnerable population.
Part of security work is understanding how you protect people from harm.
I'll add kids to [my] pool of groups of vulnerable people.
CLAUDINE: Also, we're not just thinking about how [we] might harm users,
[rather] what those harms might be. ARI: I love that. The long term view.
CLAUDINE: Next up, Klaudia's interview.
What I liked (I thought it was cool), was her research process.
So just listen to the clip here. KLAUDIA: we assume the attacker has footage.
Someone recorded it or the attacker got access to a local video recording.
And the user was interacting with the smart environment and devices.
We allowed our participants (the attacking group) to watch the video
and then try to mimic the behaviour of the victim on the video footage.
In-person observation: let's imagine a smart office environment.
you have colleagues, but you have a manager who can do things you can't.
You are a malicious colleague. You want to use the privileges of someone else...
CLAUDINE: First - the research design. They went into a real environment,
very neat and novel and innovative in the way that they deployed it.
ARI: Particularly where sensors kept popping off the walls...
CLAUDINE: They dealt with the real world problems...
ARI: They found out that the sensors were popping off because they asked.
If they hadn't listened to [people taking part in the smart home study],
they would have said: 'smart homes are weird, look at this weird data'.
All right. Let me take you through my second snippet.
This is Dr Harmonie Toros from last week's conference.
HARMONIE: There is a tendency [to see] security as a positive. It usually is...
[But it is not challenged, or looked at in a critical way] Also, resilience.
I've had many conversations here,
[asking], do you see the (political) difference between security and resilience?
Security is [a] State's (and company's) responsibility to secure people.
Resilience is [a] person's responsibility. There's a shift there.
These are important questions [with] legal and political implications.
ARI: This interview rocked my world because at a cyber security conference,
we had someone saying, you know, there's more to life.
I enjoyed the idea that security is the responsibility of people with power.
And again, Anirudh talks about being resilient,
[equipping] kids to have digital resilience - if pictures are shared,
how do they deal with that? How do they keep living their life despite [this]?
CLAUDINE: Resilience is an interesting one. I view it from a different angle.
It's easy to slide into the idea that users are responsible for themselves.
It's not the platform or government's responsibility to protect users.
If users don't have means to be resilient, it's an impossible goal.
I would like to talk about Sean. SEAN: I think cyber security has
to revolve around information technology.
What most of us are talking about is computers.
Whether you want to introduce books etc. into that notion, I think you can.
Cyber security is more than just computer security or computer science.
It's about taking a step back and looking at the bigger picture.
When we're talking about security, we are trying to secure computers.
We're securing these computers because they mean something to us.
That's why cyber security is inseparable from social and psychological aspects.
Ultimately, it's human beings who value and use these devices.
We have to learn about the interaction between human and device behaviours.
CLAUDINE: One of the things I loved overall was the use of Maths.
I find it fascinating because I don't do Maths and I don't really understand it.
It's interesting to hear it applied in such a real, specific and relatable context:
trust and reputation online. It was inclusive, I think, that was what I liked.
We tend to get bogged down in very specific definitions around systems,
information and infrastructure, not accounting for the human element.
ARI: Sean does Maths, Sean great words. CLAUDINE: Sean do words good. [laughter]
ARI: Okay. I'm going to talk about... Oh, no, WE're going to talk about Mary.
MARY: When [robot: Curiosity] landed, it started sending Twitter updates.
That was probably a human typing at NASA and not the robot on Mars.
It got me thinking, we're going to be sending robots [to space] ahead of us.
Alexa is a robot. And I wondered, what [is] the place for speech technology?
Could we train a robot to describe to us, the things that it finds?
How would we make those communications secure?
CLAUDINE: The way we selected these moments.
We did not talk to each other... until right before we started recording.
I wish we had a deeper explanation but... robots in space.
ARI: From last episode, the sound byte was 'we get there, together or not at all',
everyone does X and that all counts! There's a great Swiss cheese analogy.
Instead of one protective layer [with] holes, you have multiple layers.
Each has holes, but in different places.
Eventually you're more protected because you've got more coverage.
More barriers in the way of bad things happening.
Security is useless if it is not relevant and not useful, because what tends
to happen: hackers aren't just baddies who try and get into your systems.
People create their own hacks to get around things that are bothering them.
CLAUDINE: And accessibility. ARI: It has to be accessible as well.
As a parting gift for anyone listening,
how can they think about security in their own way?
CLAUDINE: Security by design.
Designing a project which you think has no particular security implications,
there are almost always security implications.
ARI: Think about confidentiality, integrity and availability.
Confidentiality: How safe and secret do you want your data/important thing?
Integrity: How do we make sure it's correct as much as possible?
Availability. How do we make sure people who need access, can do that?
CLAUDINE: The idea is not to scare people. Just be mindful,
that cyber security is something that you should keep in mind
when you're doing anything online or using any kind of technology.
It shouldn't take over your life or make you scared, bear it in mind.
ARI: What are you doing next, Claudine?
CLAUDINE: More research! I will have to figure out what to do next...
and that is future Claudine's problem. And you? What are you doing?
ARI: More cyber security. Because I just can't get enough. I'm going to America.
A few thank yous before we sign off...
Big thanks to the Cyber Security CDT at the University of Oxford.
CLAUDINE: Thank you to everybody who participated, talked to us, emailed...
ARI: A big thank you to you for listening,
it's really great to have you. That is all we have time for today.
We hope you've enjoyed Proving the Negative: Swanning About in Cyber Security.
CLAUDINE: You can tweet at us @HelloPTNPod and you can subscribe
on Apple Podcasts or wherever you listen to podcasts. The title is PTNPod.
This has been a podcast from the Centre for Doctoral Training in Cyber Security, University of Oxford.
Funded by the Engineering and Physical Sciences Research Council.