The seminar will explore recent developments in the regulation of operational resilience and outsourcing in the UK finance sector to assess whether the proposed new framework will provide a hallmark for governing cyber-security internationally and across other industries. The reforms arise following high-profile IT failures in the finance sector, which resulted in Treasury Select Committee Inquiries and recommended reforms.  In light of these developments, the UK financial service regulators recently closed a consultation into proposed controls of operations and outsourcing in finance, which include changes that will reform standards for managing cyber-security.  The proposals are likely to form part of expected final policy statements to be announced later this year or during early 2021. The UK financial services regulators are leading in this area and the seminar will consider whether the proposals provide a benchmark for managing cyber-security risk across different sectors and globally. MS Teams Meeting Link (no log-in required) A draft slide deck for this seminar can be found here.

Software developers make pervasive use of third-party libraries to reduce costs and accelerate release cycles, at a risk to safety and security. In this talk, I will introduce a coarse-grained dynamic analysis framework, Lya, that targets such risk within the JavaScript library ecosystem. Lya interposes at library boundaries to allow concise analyses for extracting access information or enforcing invariants — e.g., identifying security vulnerabilities, highlighting performance bottlenecks, and applying corrective actions. Part of the talk will be given in the style of a hands-on tutorial, showcasing how to build and use Lya to enable further research on library-oriented security analysis and enforcement. Seminar Link (MS Teams)

Research about the determinants of the cybersecurity behaviours of students. Professor Bertrand Venard (Oxford Internet Institute) conducts a major research project at OII about cybersecurity behaviours. Through empirical research, this project seeks to understand the determinants of individual cyber security behaviours of students in France and the UK. Bertrand Venard will present the main findings of his most recent empirical research. Seminar Link

Professor Bertrand Venard (Oxford Internet Institute) is conducting a major research project at OII about cybersecurity behaviours. Through empirical research, this project seeks to understand the determinants of individual cyber security behaviours of students in France and the UK. Bertrand Venard will present the main findings of his most recent empirical research.

This seminar aims to highlight why the defensive side of security will always be playing catch up to the offensive side. Through demonstrating real world techniques used both ‘in the wild’ and on client engagements, Ruptura InfoSecurity will highlight how even simple custom tooling can defeat the most up to date defensive technologies.

Shevirah founder and CTO Weidman is a serial entrepreneur, penetration tester, security researcher, speaker, trainer, and author. She holds a MS in computer science as well as holding CISSP, CEH, and OSCP certifications. Her work in the field of smartphone exploitation has been featured internationally in print and on television. She has presented or conducted training around the world including venues such as NSA, West Point, and Black Hat. Weidman founded Bulb Security LLC, a security consulting firm specializing in security assessments/penetration testing, security training, and research/development. She was awarded a DARPA Cyber Fast Track grant to continue her work in mobile device security culminating in the release of the open source project the Smartphone Pentest Framework (SPF). She founded Shevirah Inc. to create product solutions for assessing and managing the risk of mobile devices and the Internet of Things (IoT) in the enterprise and testing the effectiveness of enterprise mobility management solutions and is a graduate of the Mach37 cybersecurity accelerator. She is the author of Penetration Testing: A Hands-On Introduction to Hacking from No Starch Press. She was the recipient of the 2015 Women’s Society of CyberJutsu Pentest Ninja award. She is on the board of advisors of the angel backed security training startup Cybrary, an adjunct professor at Tulane University and the University of Maryland University College, a member of the CyberWatch Center's National Visiting Committee, and served as a judge for the FTC’s 2017 Home Inspector IoT security challenge. Weidman is also occasionally an angel investor in cybersecurity startups

- Often the perception is that the security skills gap is for Security Operations Centre Analysts and Pen Testers - However the gap that we have in the industry is much wider - how do we unlock new groups of skills? - What are the soft skills that we are looking for? - How do we train business leaders to understand the business implications of cybersecurity?

Exploitability assessment could facilitate the prioritization of vulnerability remediation. In the past, security researchers and analysts assess exploitability for vulnerabilities by generating exploits manually. These methods involve a tremendous amount of human effort and require significant expertise. In order to solve this problem, automated exploitation approaches are introduced. However, as I will demonstrate in this talk, the effectiveness of existing automated exploitation approaches is limited by many assumptions. For example, the existing approaches mostly assume the state space of the program is limited, no security protection or exploit mitigation is enabled, and the capability of a vulnerability is already known. In this talk, I will introduce three lines of research works to tackle the problem of exploitability assessment without any assumptions. More specifically, I will talk about how we utilize static and dynamic analysis approaches to (1) explore the capability of a vulnerability, (2) pinpoint useful objects to obtain control over necessary registers, and (3) identify general exploitation chains to bypass widely-deployed kernel mitigation. Along with the introduction of these techniques, I will also demonstrate their practical impacts by using real-world vulnerabilities.

A case study of ransomware acquisition, triage, analysis and decryption. Showing the most common flaws within ransomware and how to create decryptors.

The legal context for the protection of electronically stored data and data systems from unlawful interference is a fascinating and developing area that bridges different sources and principles, including common law doctrines and statutory and regulatory standards. With this context in mind, the presentation will assess recent legal developments to attempt to predict legal trends in the field of cyber-security.  The foundation of the current approach is a fast-developing statutory and regulatory framework, most relevantly the important changes implemented under the  EU General Data Protection Regulation (GDPR) framework, which has applied in the UK from 25 May 2018, and similar regimes introduced in other regions and internationally.  By assessing the implementation of regulatory norms, Laura will predict how the regulation against cyber-crime, including controls of crypto-assets, may proceed, particularly in light of the recent FCA Guidance.  Relatedly, there will be an assessment of recent judicial authorities and legal commentary on rights over crypto-assets. The developments include the observations as part of the UKJT consultation, the extra-judicial speech by the Lord Chancellor, the landmark Singapore Supreme Court decision (holding that bitcoin can be the subject of a trust in B2C2 Ltd v Quoine Ltd SGHV), and the English High Court judgment that held that buyers of bitcoin may benefit from protections afforded to consumers (Ang v Reliantco Investments Ltd [2019] EWCH 879 (Comm)). The final part of the presentation will explore recent cases in privacy rights in data, and use this analysis to explore potential future judicial developments. Most relevantly, the issues arising from the Court of Appeal decision of WM Morrison Supermarkets Plc v Various Claimants [2018] EWCA Civ 2339 and the subsequent appeal to the Supreme Court, and the expected appeal from Lloyd v Google LLC [2018] EWHC 2599 (QB). To conclude, the presentation will predict developments arising from the case-law and risk mitigation measures that can be implemented to address expected movements in the sector. Laura’s recent blog on the Court of Appeal’s decision can be found here: https://www.law.ox.ac.uk/business-law-blog/blog/2019/10/english-court-appeal-hands-down-eagerly-awaited-judgment-clarifying