During my presentation, I will talk about cyber-attacks and their impact from a social science perspective, with the aim of exploring the social and psychological impact of these attacks on members of the public. The social impact of cyber-attacks refers to aspects such as the social disruption caused to people’s daily lives. Psychological impact can be informed by social impact, and includes aspects such as widespread anxiety, loss of confidence in cyber, and outrage. From initial investigations, it is obvious that the current level and scale of cyber-attacks is more likely to do psychological, rather than physical harm. Lastly, this presentation will reflect on some of the key issues relevant to understanding public reactions to malicious cyber-events. This will touch on areas including: (i) risk perception and protection motivation (ii) attacker identity and (iii) target identity and attack scale. 

Roy Azulay (Senior Technology Transfer Manager, Oxford University Innovation) and Anne Miller (Enterprise Programme Manager, MPLS) At last! All in one place: an overview of ways to get your research outputs into the real world.  The talk will include an overview of options for increasing the impact of your research, and the various ways Oxford University can support you, from software licenses, to working with outside companies and NGOs, to starting your own business and more.

There are ever-growing amounts of security data being generated, collected, stored and made available to cyber security analysts and managers; it is essential that they are able to extract the relevant information from this avalanche of data.  They need, for example, to analyse the data to explore and comprehend the state of their networks, hosts, applications and processes.  However, standard approaches are inadequate to make sense of these ever increasing volumes of complex and heterogeneous data.  There is therefore a need for new methods, approaches and tools to manage, exploit and utilise these valuable information so as to be able to maintain network security.  Visual Analytics is one of the possible solutions to this problem.  This presentation discusses the application of Visual Analytics to cyber security.

Consider a scenario in which a whistleblower (Alice) would like to disclose confidential documents to a journalist (Bob). Bob wants to verify that the messages he receives are really from Alice, and have not been modified in transit. However, Alice does not want to be implicated if Bob later decides to (or is compelled to) disclose her messages, his secret key, and any other relevant secret information. To fulfill these requirements, Alice and Bob can use a "deniable authenticated" encryption scheme.  In this talk we present formalized the notions of strong- and weak deniable authentication. Although these terms have been used before in the cryptographic literature, they have not previously been defined in a rigorous way for encryption schemes. We present two efficient schemes that provide deniable authentication. Both schemes incur overhead similar to that of non-deniable schemes. As such, they are suitable not only when deniability is needed, but also as general encryption tools. We provide details of the encryption, decryption, forgery and key-generation algorithms, and formally prove that our schemes are secure with respect to confidentiality, data authentication, and strong- and weak deniable authentication.  We have made implementations of our schemes available as stand-alone command line tools, written in Python. We characterize the performance (both time- and space complexity) of these implementations, and show that our schemes incur very limited ciphertext expansion and computation overhead compared to standard symmetric encryption.

In 2013 a World Economic Forum (WEF) report positioned social media as a threat to global security. The report describes the status of hyperconnectivity created through the contemporary popularity of platforms such as Facebook, Instagram, Snapchat and Twitter as a risk factor for ‘digital wildfires’ in which misleading, antagonistic or provocative content spreads rapidly and causes serious harm. This content may take the form of a rumour, false information, hate speech, or a malicious campaign against others. When it spreads rapidly it can damage the reputation and well-being of individuals, groups and entire communities. The WEF report argues that the prevalence and potential seriousness of digital wildfires mean it is necessary to consider how the potential harms caused by social media content can be managed, prevented and limited. A central practical and ethical question is: how can the prevention of harm be balanced with rights to freedom of speech? In this seminar Professor Marina Jirotka reports on the findings of a research project she has been leading that investigates the issues raised by the WEF report. The ‘Digital Wildfire’ project combines computer science, social science and computer ethics, and seeks to establish an empirically grounded methodology for the study and advancement of the responsible governance of social media. Marina will discuss findings arising from the analysis of social media datasets plus interviews and surveys with key stakeholders such as legislators, the police, civil liberties groups, anti-harassment organisations, and educators. These findings illustrate potential mechanisms through which the rapid spread of harmful content on social media might be responsibly addressed – in particular highlighting the value of education, engagement and user self-governance online. Marina will also briefly describe how the Digital Wildfire project fits into the wider work of the Human Centred Computing (HCC) group at Oxford. The HCC group undertakes interdisciplinary research that seeks to develop novel approaches to understanding how technology affects communication, collaboration and knowledge exchange within scientific, work and home settings. These understandings are used to inform the design,  development and evaluation of new technologies and innovations, and to inform policy for responsible innovation.

There is an authentication plague upon the land. We have to claim and assert our identity repeatedly to a host of authentication trolls, each jealously guarding an Internet service whose importance to us varies widely. Each troll has varying rules for password complexity, and these rules are often incompatible with each other. This dog's breakfast of authentication rules grow from password advice given at the dawn of the Internet, but is now hopelessly inappropriate. There are many proposed solutions: pass faces, pass gestures, pass artwork, devices, biometrics, etc. All these have their problems, so the eye-of-newt password rules persist. I will discuss various solutions that can get us out of this swamp. Including my recent explorations of trying to remember strong keys.

We face immense challenges in securing the information assets and intellectual property of our public and private organizations. Yet only a few years ago, the cyber war was often derided and declared a mere nuisance to business as usual. Painful experiences, such as the Sony, RSA and recent Swift Banking attacks have helped to dispel this naive stance. The truth of cyber security, however, is both overt and subtle. It is overt in the sense that the arena is driven by a wicked mix of political expression, such as the anonymous social hactivism movement, and economic incentives for criminal gangs, up to state-sponsored industrial espionage. The less obvious facet of cyber security, however, is why it remains a hard problem. Specifically, the mix of technical, policy, and social dimensions have combined to create a coevolving, complex adaptive system. More importantly, once we accept this is the case, it perforce reshapes our entire policy and technical approach to the problem. Ultimately, we cannot solve a complex adaptive system; at best we can merely shape and influence its evolution. First we will overview what we mean by a complex adaptive system (CAS) in the cyber domain, and then review the characteristics of the associated cyber security themes: technical, social, and legal.