The field of privacy engineering proposes that there exists a methodological framework for designing privacy-protecting information systems. Recognising that the utilisation of privacy-enhancing techniques for data storage and analysis does not address the entire scope of individual privacy, privacy engineering incorporates influences from user sentiment, legal norms and risk analysis in order to provide a holistic approach. Framed by related design principles, such as ‘Privacy-by-Design’, privacy engineering purports to provide a practical, deployable set of methods by which to achieve such a holistic outcome. Yet, despite this aim, there have been difficulties in adequately articulating the value proposition of privacy engineering. Without being able to adequately define privacy or map its contours, any proposed methodology or framework will be difficult to implement in practice. This talk examines the assumptions that underpin privacy engineering, linking them to open questions within privacy research.

Dr. Shada Alsalamah is an Assistant Professor of Healthcare Information Systems Security at the College of Computer and Information Science, King Saud University, Saudi Arabia. She is currently a Visiting Scholar at the Media Lab, MIT, USA, joining Prof. Alex “Sandy” Pentland's Human Dynamics Lab Research Group. In 2017, she founded the mHealth Lab, and since then she has become Vice President, mHealth Solutions Division, AnmarIT, Saudi Arabia. Through her work, Dr. Alsalamah contributes to the global healthcare sector modernization movement by developing secure, smart, mobile, and intelligent solutions for emerging healthcare delivery models using cutting-edge technologies such as Blockchain, Artificial Intelligence, and Open Algorithms. Dr. Alsalamah has been a keynote speaker and presenter at a number of international events, including Misk Talk in Los Angeles, Blockchain in Healthcare in Boston, Blockchain in Healthcare West in San Francisco, the Winter Youth Assembly at the United Nations in New York, and the Science Collaboration Symposium on Cyber Security in Manchester. Finally, she is a member of editorial review boards in a number of national and international journals in the fields of information security and health informatics.

In this talk, I demonstrate how a scientific approach can be used to combat web-based cybercrime. First, I present an observational study of the prevalence of abuse at shared web hosting providers. I examine the the distribution of web security features and software patching practices in shared hosting providers, the influence of providers on these security practices, and their impact on web compromise rates. Using a fixed-effect regression model, I demonstrate that providers exert significant influence over the security of web infrastructure and applications, whereas individual webmasters tend to control the security of website content and configurations. I also show that the identified security and software patching factors explain between 10-19% of the variance in phishing and malware abuse at providers, after controlling for size. Second, I present two experiments that evaluate the effectiveness of sending individual abuse reports to operators whose websites have been hacked. Sending abuse reports can expedite cleanup significantly, but only if the notifications include details of the compromise.  Finally, I describe an observational study of bulk reports of compromised websites sent to the responsible web hosting providers. By examining over 28,000 URLs shared with 41 organizations between 2010 and 2015, I find that sharing has an immediate effect of cleaning the reported URLs and reducing the likelihood that they will be recompromised. However, there is only limited evidence that one-time sharing of malware data improves the malware cleanup response over the long term.

Abstract This talk provides provocative new ways of looking at IT security and how we can realistically solve the lack of IT security long term. It is frequently said that people have a problem seeing the trees from the forest, but this talk inverts the saying and implies that it seems to be hard for people to see the forest from the trees. Pointing out, that people have been looking for solutions addressing IT security within their own companies or environments, instead of thinking of ways to address and solve the lack of IT security on a large scale.  The talk is partially based on the speakers book, which was published in June of last year. The author will introduce the “Eyjafjallajökull” methodology. The talk will also address a couple of relatively recent data breaches that affected Iceland, where in one case, private information on a quarter of the population got leaked online (including cleartext passwords and email addresses). A security awareness experiment related to one of the data breaches will be covered and lessons learned.  Outline  1. Discuss two recent data breaches that affected Iceland. Telecommunication company in Iceland (which took place in Iceland), private data of a quarter of the population in Iceland (including clear text passwords, e-mail addresses, SMS text messages) + Linkedin data breach. Legal implications and penalties. Briefly mention the GDPR.  2. Cover a security awareness experiment, the speaker performed, relating to the Linkedin data breach on affected Iceland specific email addresses (lots of funny stuff, but also lots of interesting stuff).  3. Shortly cover key results of research the speaker performed relating to the state of network security in Iceland five years ago. (If It looks like I won't have time to cover all 8 points during the one hour allocated, then I may skip this point = (3.)) 4. Cover key results from research on the state of security of government websites in Iceland, which the speaker was commissioned to do by the Ministry of The Interior in Iceland 3 years ago and again last year.  5. Cover action the Ministry of Interior performed two years ago (with the assistance of the speaker). Introducing a contract annex for use with third parties, which was published as well as risk assessment template and risk assessment guidelines (+ really quick run through of roughly 20 controls from the annex).  Also cover the improvements achieved due to the assessment and support given.  6. The current state of IT Security. The problem as it has been described by most IT security leaders (Micro). The way the speaker sees the problem (Macro). The “Eyjafjallajökull” methodology will be introduced.  Various education levels Various industries Vendor certifications Impacting the bottom line   7. Future perspectives, licensing models, call to action (based on the “Eyjafjallajökull” methodology).    8. Questions and Answers   Takeaways Attendees will: - See the IT security problem we face today with a new perspective. - Be inspired to change the world for the better (Eyjafjallajökull methodology).  - Go home with a lot of thought provoking questions relating to how we can address the lack of IT security.  - Hopefully a lot of common assumptions will be cleared up, and if attendees will adapt parts of the contract annex (or as a whole), they may end up preventing data breaches and increase their security. 

The computer security community has advocated widespread adoption of secure communication tools to counter mass surveillance. Several popular personal communication tools (e.g., WhatsApp, iMessage) have adopted end-to-end encryption, and many new tools (e.g., Signal, Telegram) have been launched with security as a key selling point. However, it remains unclear if users understand what protection these tools offer, and if they value that protection. In our studies, we used qualitative research methods (e.g., unstructured/semi-structured interviews, focus groups, observations) and quantitative methods (census-representative surveys) to understand how users “perceive” secure communications, and what influences their decision to adopt (or not adopt) secure tools. We found that usability issues are not the primary obstacles to adopting secure tools. Instead, the main obstacles to adoption include small and fragmented user bases, lack of interoperability, low QoS (Quality of Service), incorrect user mental models of how secure communication works, and bad software quality.

Over the next 10-20 years, AI will raise legal questions in three areas: responsibility, rights, and ethics. Who or what should be liable if AI causes harm, or own the IP if AI creates new inventions? Should AI rights ever be protected? How can we create and enforce moral codes for AI? Jacob Turner will argue that the first step in answering any of these questions is not to write new rules, but rather to design the institutions which can create them. In this lecture Jacob will aim to clarify the problems we face and go on to present a blue-print for how they can be solved. 

Distance-bounding protocols are cryptographic protocols that securely establish an upper bound on the physical distance between the participants. Existing formal verification models for distance-bounding protocols consider timestamps and the location of agents. In this presentation I will introduce a causality-based characterization of secure distance-bounding, which discards the notions of time and location. This allows us to verify the correctness of distance-bounding protocols with standard protocol verification tools.

In the current Internet of Computers (IoC), paradigms and techniques have emerged to manage security risks, at least somewhat.  However, the Internet of Things is different from the IoC, and these differences cause many of these paradigms to stop working. With the deep embedding of the IoT in the physical world, the consequences may have significant physical impact.    Drawing on power and healthcare IT as prototypes of the coming IoT, this talk surveys what I believe are critical problem areas and discusses some approaches to finding solutions.

The session will be delivered by members of the Research Services European & International team and Kelly Ryan, Comp Sci Research Facilitator. It will cover funding streams from the European Commission, UKRI (Research Councils, innovate UK), Government, business (e.g. Google) and any other relevant sources. The EC’s Horizon 2020 framework programme has a broad range of opportunities for Cybersecurity research, with many call deadlines later in 2018 and some in 2019/20. The session will give a brief overview of the topics (or broader funding streams) and the basics of how to get involved. There will be plenty of opportunity for members of the audience to ask questions.