Signal is a new messaging protocol with end-to-end encryption, likely used by up to a billion people through its implementations in WhatsApp, Facebook Messenger and Google Allo. Despite this massive uptake, Signal has seen little security analysis; challenges include the complex, stateful design involving over ten different types of key, the lack of documentation or specification, and the novelty of some of its claimed properties. We performed a formal security analysis of Signal, proving it secure in a game-based model. This required us first to figure out what Signal *is*, which meant working backwards to a specification from the open-source implementation. We also had to work out which security properties we think it was intended to achieve, which include a form of post-compromise security (PCS). PCS is a recently-formalised property encoding the inability of an attacker to impersonate someone even *after* stealing their key. There is much more to be done, however, and I'll talk about some of the interesting research questions that are still left open.

Cyber-security regulation should be applicable in practice and support practitioners in building secure systems: rules and guidelines can help setting appropriate baselines, establishing audit regimes, and they can also simplify cooperation among professionals. However, when policies are not lived by practitioners but only superficially followed, security goals are weakened. Empirically, this paper finds that while regulation should provide a constructive baseline, experts emphasise that implementing regulation in daily security work remains tricky and work-intensive, yet without much practical impact. Practitioners see a tension between regulation and practice overall, with some subfields and regimes being more affected than others. This paper is based on 100 interviews with IT-Security experts in different positions, from system architects in big corporations to self-employed security consultants. The regulation regimes taken into account are: IEEE, IETF, ICANN, PCI, ISO 2700X, CIS CSCs, BSI-100, Vendor Certifications (composite), CEH, CISSP, IASME, as well as University Degrees (composite), and relevant legal frameworks (composite). While there is some variation, it is puzzling to see that across the board, practitioners seem detached from most cyber-regulation regimes. Yet, there is considerable variance in terms of the problems that the interviewees report, both when it comes to different standards but also the positions that these individuals are in. Experts criticise, amongst other things, the abstractness of many directives, their often superficial requirements, and their focus on compliance rather than a working overall security concept and structure: practitioners express the need for clear guidelines, regulative flexibility, and realistic rules. Furthermore, the procedures of implementation and audit also attract considerable criticism. National and international regulation and standards must support practitioners in building secure systems according to the organisation and situation in question rather than prescribing procedures without empirical consideration. More practically-focussed cyber strategies coupled with stronger audit and enforcement procedures would increase considerably the readiness of organisations worldwide. Thus, in order to improve real-world security, relevant regulators should dedicate time and effort to understand practical security work, and to listen to practitioners’ inputs.

New opportunities for criminal activity arrive with the availability of new technologies. But often these “new” opportunities for crime simply represent modified version of existing offences. When given appropriate time, traditional criminal law principles are expanded by the court to address new criminal activity. This process is slow, but is also methodical, and balances competing interests and interactions across various offences. Alternatively, Parliament can respond to the advent of “new” crimes by passing new laws in a much shorter time frame: such was the case with the Computer Misuse Act 1990. This form of legislative overreaction gives rise to a number of issues that may not be apparent when the legislation is first introduced. One such issue stems from the reliance on over-broad language that attempts to capture all possible forms of harmful conduct. The preference for creating broad laws is a by-product of the costly, and slow moving political and legal process, in contrast to the fast moving development of technology. Laws that target particular technologies would necessarily need to be constantly updated, or risk becoming obsolete. In adopting broad terminology, the Computer Misuse Act attempted to avoid this need for constant updating. But, the adoption of “technology-neutral” language in the framing of an offence does not in itself result in technological neutrality. Where a specific conceptualisation of user interaction with technology forms the basis of a criminal offence, that offence is inherently not technology-neutral. The conception of what a “computer” was, despite it not being defined by the Act, shaped the construction of the offence and has impacted its subsequent application. With this in mind, we will explore the initial framing of the Computer Misuse Act, the various terminological options and understandings available to law makers (computer crime vs cyber crime vs computer misuse), and the implications of their choice in criminalising “computer misuse”. Particular reference will be made to other areas of the criminal law that have evolved to respond to the use of computer technologies in spite of the Computer Misuse Act.

This seminar will look at the challenges and possible solutions for emergent threat detection in an internet environment that continues to grow at an unprecedented rate. As traditional systems struggle to adapt to this environment, does large scale simulation hold the key to securing the networks of the future?

Security in cellular-radio access networks is evolved with every generation from 2G to 4G. Protocols used between the mobile terminals and the base station are armed with layered security approach. In this talk, we revisit this layered approach in 4G/LTE networks, low-cost attacks, and discuss potential challenges for next generation systems.

Some recent quotes from the transport sector sum up the general themes that will be discussed in this talk: “With the introduction of SESAR and the possibility for the air traffic control to directly give instructions to the aircraft control system, the risks will be multiplied. We need to put in place a structure for alerting airlines on cyber-attacks” - Director, European Aviation Safety Agency (EASA) “Currently it is far too difficult to carry out a cyber attack which would have a significant impact on the running of the railway, but we recognise that won’t always be the case. The physical threat will remain, but cyber security will be a major issue in the next three to five years.” - Head of cyber security, Network Rail "It is essential that safety and cybersecurity work together to address possible attacks on electronic vehicles systems." - Society of Automotive Engineers (SAE) I will discuss examples of the risks that the transport sector will face in the coming years from different attacker groups with often very different motivations. The talk will then propose secure development approaches rather than bolt-on security solutions that will be needed to address many of these issues.

This talk will outline BlackBerry’s latest strategy to get ahead of cyber attackers, once and for all.  Topics include: brief BB business update, focus areas in mobile device security, Internet of Things security strategy, and a review of BlackBerry's Center for High Assurance Computing Excellence (CHACE) and its goal to reverse the crisis of confidence in security that plagues the digital world today.

Modern cybercrime has evolved into becoming a worldwide business where specialised actors collaborate to achieve their nefarious goals. To tackle such a threat, technical countermeasures are often now enough, but social and economics ones are also required. In this talk, I will summarise our research on fighting malware operations by acting from different vantage points: on the infected computers themselves, on the network, and in the physical world.

Connected Vehicles, Connected Autonomous Vehicles and Intelligent Transport Systems (ITS) are often used interchangeably; however there are some settle differences.  This talk focuses on ITS and its related road safety application security and privacy. It highlights the scalability issues in ITS (hundreds of millions of cars/smart phones) and the ease of insider attacks due to the broadcast nature safety messages. It presents some suggestions for ITS privacy, Public Key Infrastructure (PKI) design and discusses their impact on network performance.