Malware analysis is one of the most exciting yet daunting tasks in the security research world. A typical researcher spends countless hours and sometimes days to dissect malware and exploits. To keep up the pace (and sanity) many automation tools have been built to help with different kind of tasks. Usage of such tools brings a massive problem of maintaining working and secure infrastructure. An infrastructure often operated in very hostile environments. This problem causes researchers to spend too much of their time and resources on the infrastructure instead of spending it on their target goal. In this talk, we will learn how every malware analyst can start rapidly using serverless technology to make their life easier. We will dive into a serverless open source project called MalScanBot. Learn how it was built and how it can be used as a template for many other interesting project. Because as a researcher you should always  Focus on your malware, Not Infrastructure.

In August 2018, Jake was given permission from the chief constable of Dorset Police to pen test a police station to see if it was possible to gain entry past secure doors and security officers, specifically into the Intelligence Unit as well as gain access onto the force network unnoticed. He was able to get through every door he tried and then he was able to hack into the Head of Anti-Corruption, change his password and access all of his files. The aim of this experiment was not to ridicule or make an example of the police but to demonstrate the sheer impact on what can be achieved if a targeted attack were to occur. Physical and cyber defences have never been so important so this exercise will hopefully voice vital changes to culture surrounding security among law enforcement and businesses alike.

Multi-factor Authentication (MFA) is the current trend to genuinely identify authorized users (in multiple ways) through an authentication process via passwords, security tokens, biometrics, cognitive behavior metrics, software/hardware sensors, etc. Existing MFA systems typically use static policies for selecting authentication factors and do not consider dynamic aspects of the operating environment. We are developing an authentication framework for adaptive selection of multiple modalities at different operating environment so to make authentication strategy unpredictable to the hackers. This methodology, called adaptive multi-factor authentication (A-MFA) incorporates a novel approach of calculating trustworthy values of different authentication factors while being used under different user environmental settings. Accordingly, a subset of authentication factors are determined (at triggering events) on the fly thereby leaving no exploitable a priori pattern or clue for adversaries. Empirical studies are conducted with varying environmental settings and the performance of the adaptive MFA is compared with other selection strategies. The empirical results reflects that such a methodology of adaptive authentication can provide legitimacy to user transactions with an added layer of access protection that is not rely on a fixed set of authentication modalities. Robustness of the system is assured by designing the framework in such a way that if any modality data get compromised, the system can still perform flawlessly using other non-compromised modalities. Scalability can also be achieved by adding new and/or improved modalities with existing set of modalities and integrating the operating/configuration parameters for the added modality.

In the past 7 years, I have been working on cellular security publishing more than 10 papers. Throughout these studies, and interactions with device vendors and carriers, I learned a lot about cellular related industry and found that many of the vulnerabilities came from business logic around cellular technologies. As a professor in academia, I will talk about my experience on  cellular security and its relation to business logics of cellular technologies in the first part of the talk. I will link existing vulnerabilities with these problems to show how they are related. In the second part of the talk, I will present LTEFuzz, a semi-automatic dynamic testing tool for LTE control plane procedures. LTEFuzz dynamically generates and sends the test cases to a target network or a device, and further deterministically classifies problematic behavior by only inspecting the responses in the tester and victim device from the target. By conducting tests against the operational network, we found 51 vulnerabilities (36 new and 15 previously known).

Quantifying the probability and impact of cyber loss events has proved an elusive quest.  Doing so could help security teams advocate for more resources.  This talk looks to the insurance industry to introduce a new approach.  The first part investigates the pricing tables and algorithms used by 26 insurance providers in the USA.  We provide empirical observations on how cyber insurance premiums vary by coverage type, amount, policyholder type, and over time.  The second part introduces a method using Particle Swarm Optimisation to iterate through candidate parameterised distributions with the goal of reducing error in predicting observed prices. We then aggregate the inferred loss models across 6,828 observed prices from all 26 insurers to derive the County Fair Cyber Loss Distribution. We demonstrate its value in decision support by applying it to a theoretical retail firm with annual revenue of $50M. The results suggest that the expected cyber liability loss is $428K, and that the firm faces a 2.3% chance of experiencing a cyber liability loss between $100K and $10M each year.  The method could help organisations better manage cyber risk, regardless of whether they purchase insurance.

Dr Phillips will discuss her ongoing research on the direct-to-consumer genetic testing (DTC) industry, drawing upon her book, Buying Your Self on the Internet: Wrap Contracts and Personal Genomics, which will be published in June 2019 by Edinburgh University Press, as part of their Future Law series. We have all grown accustomed to clicking ‘I Agree’ online, often without reading Terms and Conditions or Privacy Policies, but as more new services handling sensitive data are coming to market this lack of reading is problematic. The DTC industry has developed over the last two decades. It has created a market for DNA tests as consumer services, bringing them outside the clinic and into the domestic space. Individuals in this space can now be viewed as consumers, rather than patients and these services pose challenges for existing regulation. Genetic data is also sensitive data. It can serve as a unique identifier for individuals, it can also be used to trace family members, and it can be used for a wide range of secondary research purposes, meaning that there are significant privacy risks to consider in this context. The industry offers tests for diverse purposes. These range from tests for health conditions to the increasingly popular category of ancestry testing, as well as tests for genetic relatedness (most commonly paternity), as well as more dubious tests for child talent and ‘infidelity’ or matchmaking. This talk will provide an introduction to the DTC industry and the issues these services raise for law and society more generally. This will include an overview of the variety of tests available, discussion of the contracts used by DTC companies, as well as the privacy issues these services raise. The book uses the example of DTC genetic testing companies using wrap contracts as their dominant means of governance to show the challenges that disruptive technologies pose for societies and for regulation. The book: Reviews 71 wrap contracts used by DTC companies providing health testing Explores broader issues with online contracting Sets an agenda for improving regulation and the online contracting environment

The design of security protocols is typically approached as an art, rather than a science, and often with disastrous consequences.  But this need not be so!  I have been working for ca. 20 years on foundations, methods, and tools, both for developing protocols that are correct by construction and for the post-hoc verification of existing designs. In this talk I will introduce my work in this area and describe my experience analyzing, improving, and contributing to different industry standards, both existing and upcoming. As case studies, I will discuss the ISO/IEC 9798 entity authentication standard and 5G Authentication and Key Agreement.

Information security has always been a major concern for organizations, authorities and armed forces. A lot of emphasis is given to the implementation of technical security. As technology advances, attackers look for new ways of exploitation: Why waste time cracking through layers of security when you can trick someone to expand your privileges? Humans are the most vulnerable points in any kind of security system because of their predictable behaviour and psychological aspects. This presentation covers an example of social engineering, common attack vectors and highlights how a prominent general of the Swiss Armed Forces was compromised.

Results from an Empirical Research about Cyber Security Behaviours among Students.

The security industry focuses a great deal on defense, detection and investigation of advanced threats. Once an attacker is on your network, it's imperative to have a formal and repeatable plan to quickly get them back out! This talk explores how Google performs incident management and remediation at scale, adapting the techniques of disaster management professionals and modern open source tools to achieve lightning-fast, efficient response cycles and push the envelope in the field of Incident Response. This seminar is co-hosted with the Centre for Technology and Global Affairs