TLS is the de facto secure protocol of choice on the Internet. In this talk, I'll give an overview of the state-of-the-art of TLS security, focusing mostly on the TLS Record Protocol which is responsible for providing the basic secure channel functionality in TLS. I'll discuss recent attacks such as BEAST and CRIME, and then focus on a newly-discovered vulnerability in the TLS specification which has the potential to allow full plaintext recovery of TLS-protected traffic. I will reflect on why the deployment of secure cryptography is seemingly so hard, and what the barriers are to adopting better approaches than the current techniques used in TLS. The talk will assume knowledge of basic cryptography and networking, but will be otherwise self-contained.

Security conversations involve considerable ambiguities about scope and perspective. Executives in government agencies and business enterprises, and their organisations' IT staff, focus on different parts of different elephants. Meanwhile, many security discourses are conducted at higher levels, such as industry sectors and nation-states. Ambiguities of scope and perspective hamper discussion and analysis. They also create challenges for empirical researchers. Which biases should be prioritised when selecting and framing research questions? Which unit of study is appropriate? This presentation identities key aspects of various scope definitions of security, and teases out tensions among the perspectives and the players.

What does it take to keep the IT systems and the data generated by a Formula 1 team safe and secure? What compromises have to be made and why? Are the biggest threats from external sources or within the team itself? How does the changing threat landscape affect the Lotus F1 Team?

MockDroid is a modified version of the Android operating system which allows a user to 'mock' an application's access to a resource. This resource is subsequently reported as empty or unavailable whenever the application requests access. This approach allows users to revoke access to particular resources at run-time, encouraging users to consider the trade-off between functionality and the disclosure of personal information whilst they use an application. Existing applications continue to work on MockDroid, possibly with reduced functionality, since existing applications are already written to tolerate resource failure, such as network unavailability or the lack of a GPS signal.

The power grid, on which most economic activities rely, is a critical infrastructure that must be protected against potential threats. Advanced monitoring technologies at the center of the smart grid evolution increase its efficiency but also make it more susceptible to malicious attacks such as false data injection. This talk is about the development of a game-theoretic approach to smart grid security by combining quantitative risk management with decision making on protective measures. Specifically, the consequences of data injection attacks are quantified using a risk assessment process based on simulations. Then, the quantified risks are used as an input to a stochastic game model, where the decisions on defensive measures are made taking into account resource constraints. Security games provide the framework for choosing the best response strategies against attackers in order to minimize potential risks. The theoretical results obtained are demonstrated using numerical examples.

We were engaged through the month of August and most of September with two large clients in the Middle East responding to critical incidents where most of their Windows computing infrastructure had been destroyed by malware that basically wiped the disks at a specific time.   We have never seen single minded destruction on this scale before; the attackers' sole intent was to wipe out the target's computing capability.  The tools were blunt, but effective.  So the logical question is "How do we protect ourselves?".  The recent cases are examples of real cyber terrorism versus the "hacktivism" we saw last year.  It’s the "cudgel with extreme prejudice" versus agitated teenagers, and could easily point to nation states committing acts of war.   In general, this is WHY we do security in the first place. A breach is bad – scorched earth where all your computers used to be is a whole different game.

How complex socio-technical systems in a deeply digitized connected world evolve cyber resilience as shown by their structural responses to, or in anticipation of, cyber surprise - a brief overview of work.

For this inaugural Cyber Security Seminar, we welcome Martin Borrett, Director of the IBM Institute of Advanced Security, Europe. In this short session we will describe and discuss the big security challenges organisation face in 2012. IBM invests a significant effort into security research, we will share some of the key themes and innovation agenda that IBM is following. Finally we will share IBM's Security Strategy and at a high level its solutions to address the security market place.