Ethical dilemmas in Internet engineering research have been a topic of increasing debate over the last few years. As the Internet is becoming increasingly pervasive in people’s lives, networked systems research projects are collecting increasingly sensitive data on individuals, or affecting people in previously unknown ways. A discrepancy exists between human subject research - where there are relatively strict and broadly-understood ethical traditions – and networked systems research where (a) the consideration of these issues is relatively new, and (b) the existing best practices from other fields don't easily translate. This project consists of several multidisciplinary workshops on both sides of the Atlantic that will lead to ethical guidelines, a policy paper, and a comprehensive research website.

Chris Dilloway, Simon Borwick, and Jo Richardson from Deloitte’s Cyber Security practice will come to speak about their experiences of working in cyber security in the corporate world. They will talk about some of their projects working in the Technology, Financial Services, and Retail sectors, on security strategy and transformation, digital fraud, and cyber operations.

Cyber security touches our lives daily, whether it's protecting our national infrastructure, monitoring payment systems, or securing personal computers and devices.  Signature based methods common today in Cyber security systems are insufficient to stop cybercrime, calling for the use of behavioral analytics to detect threat and prevent loss of data.  Real-time streaming analytics, well-utilized in payment fraud detection, are ideally suited to the detection of Cyber threat.  During this talk, we will explore streaming behavioral analytic methods including transaction profiling, collaborative profiles, behavior sorted lists, and multi-layered self-calibrating analytic models. These analytic technologies when used in combination enable the construction of novel self-learning streaming Cyber analytic models.

We discuss evolving yet persistent technical, philosophical, and policy challenges in cyber security and privacy.  We contend that the persistence is driven by un/under-acknowledged realities and dilemmas that are amplified in cyberspace.  For example: Many issues are “dual” in that a solution to one issue represents the essence of the challenge for another issue.   Some persistent failures in security and privacy can be traced back to proven theoretical results and unresolved epistemological questions. The human element often confounds policy and technical solutions; these confounds continue to be conveniently ignored in “the real world”. We’ll close with a sampling of current work that seeks to clarify, resolve, or mitigate these realities and dilemmas.

Securing the Critical National Infrastructure (CNI) from Cyber Attack is the focus of significant global research amongst a background of increased attack vectors and growing interest from governments worldwide.  This talk provides an introduction to the Supervisory Control And Data Acquisition (SCADA) systems that underpin CNI and provides an insight into the requirements and constrains facing cyber security of such safety critical systems.The aim is to foster discussion and opportunities through; the use of real-world examples, an overview of the SCADA cyber security problem space, and current research directions including ongoing activities within Airbus Group Innovations and the wider active community.

How do you keep a system with 1.3 billion users both secure and (mostly) spam-free?  This talk will describe some of the biggest challenges in spam fighting and security at Facebook, as well as going into more detail about one specific mechanism - our system for detecting compromised passwords - and how we use it to prevent phishing attacks.

We investigate the incentives behind investments by competing companies in discovery of their security vulnerabilities and sharing of their findings. Specifically, we consider a game between competing firms that utilise a common platform in their systems. The game consists of two stages: firms must decide how much to invest in researching vulnerabilities, and thereafter, how much of their findings to share with their competitors. We fully characterise the Perfect Bayesian Equilibria (PBE) of this game, and translate them into realistic insights about firms’ strategies. Further, we develop a monetary-free sharing mechanism that encourages both investment and sharing, a missing feature when sharing is arbitrary or opportunistic. This is achieved via a light-handed mediator: it receives a set of discovered bugs from each firm and moderate the sharing in a way that eliminates firms’ concerns on losing competitive advantages. This research provides an understanding of the origins of inefficiency and paves the path towards more efficient sharing of cyber-intelligence among competing entities. (joint work with Arman Khouzani and Viet Pham; to be presented at GameSec 2014 in Nov’14).

New forms of crime ask fundamental questions of existing criminal justice agencies. Cybercrime offers particular challenges to a police service which is proud of its historical traditions and mission. The session will take a long view of the culture and organisation of policing, and ask what the implications are for policing in a networked society.