Tag Archives: CSIT

Cyber security needs to consider both technology and human factors.

Cyber Security – Back to Basics

This week I finished the Open University’s “Introduction to Cyber Security” online course which is available through the FutureLearn platform.

Why, I hear you ask, am I going back to basics to learn about a subject in which I am already pretty well versed?

It is true that I have been exposed to cyber security principles and practice for almost 20 years by virtue of my primary degree in Computer Science, internship and subsequent career in both technical and non-technical roles. Heck I’ve even spent the last three years as Technical Marketing Manager of QUB’s Centre for Secure Information Technologies (CSIT), the UK’s Innovation & Knowledge Centre for Cyber Security, a role which sees me regularly speak to businesses, students and contributing to TV, radio and print media on the subject of technology vulnerabilities, threats and breaches. The role also involves bringing new cyber security technology, the output of much of our ground-breaking research, to market.

Why participate?

I participated in the 8 week long online course for three reasons:

  1. I’m big enough to admit that I don’t know it all – even in my own field of expertise there is always scope to learn new approaches and relearn concepts that I may have forgotten. This course offered me a chance to look at cyber security with fresh eyes.
  2. Working day to day in a research and innovation environment at the very bleeding edge of cyber security technology it is all too easy to forget how the person on the street views my area of expertise. This course allowed me the chance to step back from that edge, think about cyber security from an end user perspective and consider how our research and technology could be applied to solve the simple and mundane as well as grander challenges.
  3. Lastly, I wanted to kick the tyres on it. Prior to this course launching I had been asked by a number of organisations if we at CSIT could deliver similar entry level training. We had already delivered some internally to the wider QUB staff body and the question was whether or not we should package that up and produce an offering to business and community groups. I wanted to assess if the OU course would rule that effort worthless.

Did it pass muster?

In a word – yes.

The course surpassed my expectations to be honest. It wasn’t patronising, while it assumed no prior knowledge it explored more complex aspects of cyber security explaining them in an engaging way.

Those charged with information and cyber security in organisations and the wider world can often be seen as bad guys and girls in their own right. Blocking access to fun stuff on the internet and not allowing the latest whizzy consumer devices onto corporate networks without a satisfactory reason from an end-user stand-point. The first week explored the threat landscape in depth, explaining why cyber security matters to everyone and laid a solid foundation for the remaining seven weeks.

Over the last number of years many of the times I have been invited by the media to provide analysis on cyber security events has been due to password breaches.

It’s one of the reasons I’m so passionate about bringing our LIOPA lip biometric technology to market. Week two covers the whole gambit of authentication even going so far as covering salting, hashing as well as multi-factor which is thankfully becoming the norm for most online services.

One area where I disagree with the course is its highlighting of password manager applications as a solution to remembering multiple usernames and passwords. Personally I see them as a significant risk and prime target for cyber criminals. Hack those and you have the master key for an individual’s whole online life.

Weeks 3 and 4 cover Malware and Networking & Communications adequately but it was Week 5’s focus on Cryptography which drew my attention. It’s an area which we at CSIT carry out significant research in areas such as Post-Quantum Cryptography,Physical Uncloneable Functions (PUF)-PKI and Fully Homomorphic Encryption.

The practical application of PGP is taught through the use of Mailvelope, a plug-in for Google’s Chrome browser that uses an implementation of the Open PGP standard. This is welcome but it goes to show that straightforward ways for the man/woman in the street to use PGP to encrypt communications is still a little way off in terms of user experience.

As the family IT go to guy weeks 7 and 8 coverage of what to do when things go wrong and managing risks is welcome. Its also a timely reminder for everyone to fully consider their own vast stores of digital information, prioritising which bits are most important and putting in place a regular backup routine to protect against loss.

Have I changed how I think about my own cyber security after completing this course?

Absolutely. Will I tell you the changes I have implemented as a result? Absolutely not. Why make it easier for the cyber criminals? Individuals and organisations are under constant attack. It is a case of when and not if your cyber security defences will be probed and breached – why make it easy for them.

Wider lessons for going back to basics.

Sometimes subject matter experts can be a little reluctant to admit that they may not be across all the basics in terms of their field. Instead they baffle the uninitiated with the more advanced aspects of their product or service. Looking once again from an amateur’s perspective can be enlightening.

Participating in this course has also opened my eyes to interesting use cases for some of CSIT’s innovations.

While this course may close off opportunities for us as an organisation to deliver similar training ultimately it educates a greater number of people in respect of cyber security who will demand greater security from service providers and technology providers. If it encourages more students to consider applying for our MSc Cyber Security or consider carrying out PhD research with us then even better.

Ultimately this will stimulate further the burgeoning global cyber security market benefiting CSIT and the wider industry in which we operate.

This blog post post was originally published by me on LinkedIn Pulse on 2nd Dec 2014 and can be found here.

Turing – Runner up in 2014 #MatrixPoetryAwards Science Category

I’m delighted once again to have picked up honours at the 2014 MATRIX Poetry Competition. This year I was runner up in Category One, open to people with a science/technology background, with my poem “Turing“.

image

image

The competition was judged and award presented by respected poet and retired academic Professor Ignatius (Iggy) McGovern. The Award ceremony was followed by a reading from his new book, “A Mystic Dream of 4” which is a sonnet sequence based on the life and times of the Irish mathematician William Rowan Hamilton.

The winner in the category was my good friend Fabian Campbell-West, who I work alongside at QUB’s ECIT Institute and Centre for Secure Information Technologies (CSIT), with his poem “Computer Coder’s Sonnet“.

My poem has Alan Turing as its subject. Turing was a mathematician, wartime code-breaker and pioneer of computer science. His contribution to the war effort and technology were only recognized recently due to the secret nature of the work, his prosecution for homosexuality and untimely death by suicide at the age of 41.

Much of the research carried out within CSIT on areas such as cryptography, algorithms and artificial intelligence can be traced directly back to his ground-breaking work back in the 1930’s and 1940’s.

Once again here is my poem:

Turing

Celebrated for his passion, persecuted over love
In Bletchley Hut 8 he tackled Enigma
Breaking the ciphers and stemming the tide
Only science mattered, not social stigma

His bombe silenced bombs, he moved on
The genius visualised a machine in his mind
A device for computation, competing with men
His automatic computing engine, all seeing, blind

Without his intelligence, artificial or otherwise
Machine learning, algorithms, big data; unfathomable
As scientists, today, the evidence is clear
The debt of gratitude owed Turing is utterly incalculable.

Since writing the poem I have learned that a film called “The Imitation Game” based on Alan Turing’s life will go on general release in the UK on 14 November 2014. It stars Benedict Cumberbatch as Turing and is directed by Morten Tyldum with a screenplay by Graham Moore, based on the biography Alan Turing: The Enigma by Andrew Hodges. You can view a trailer here:

Is this the end of usernames and passwords? #csitsummit

Updated 3rd June 2013.

This post was previously published by me over at The Centre for Secure Information Technologies blog.

At the recent World Cyber Security Technology Research Summit hosted by CSIT I had the pleasure of scribing one of the breakout sessions titled “Is it the end of the road for username and password? If so what are the alternatives?”.

The answer, given recent high profile breaches, might surprise. It’s not as clear cut as you might think. One thing is for sure however. There is a huge amount of opportunity in this area.

Continue reading

New role at CSIT: The second 30 days in the 30-60-90 plan

Chips with that?

Last month I blogged about the 30/60/90 plan covering the first 30 days of the initial three months in my new Technical Marketing Manager role at The Centre for Secure Information Technologies (CSIT).  This was based on some interesting guidance posted by Ninon LaForce on the On Product Management blog.

In this post I shall look back at the second 30 days.  Personally speaking its useful for me as I slot into the organisations appraisal system to reflect on what I have achieved thus far in the role.

Day 31-60: Take ownership

According the Ninon, days 31-60 in a new PM role is all about taking ownership. As with my previous post, before getting into the points specified in the original post, here are a few thoughts on this period.

This period began with exhibiting at Mobile World Congress in Barcelona.  I blogged my thoughts on the Congress here. While this took me out of the office for a whole week it was a useful learning exercise personally and an opportunity to test what we as an organisation are doing in the marketplace.  It certainly helped me achieve some of the points outlined below including networking and building relationships with existing and potential partners and customers.

Uncovering new opportunities for the application of our research as well as helping me get up to speed pretty quickly on the commercial environment in the mobile space was invaluable not to mention the process of developing our messaging around this massive market pretty early into my tenure.

Two weeks after returning from Barcelona we hosted Belfast 2012: The 2nd World Cyber Security Technology Research Summit at CSIT.  Preparations for this were pretty consuming.  Again the process of prepping for and hosting this event were priceless in terms of building relationships, setting our commercial and research roadmap as well as firming up my thoughts around strategic direction.

Scorecard

Now lets look at how I think I performed against the list:

Meet with my manager for a first 30-day review. Ensure I am focusing on the right activities and adjust as necessary.

Partially done.  We meet weekly and continue to chat most days regarding ongoing activities.  We plan to sit down to formally appraise my performance over the first 2 months next week.  It should have happened last week but more important priorities meant this had to be pushed out.

Take ownership of some projects.

Done.  I am currently working on a number of projects which have short and medium term delivery dates.  There are no shortage of projects.

Contribute my thoughts/ideas on how to streamline industry partners and programs.

Done; ongoing.  These get discussed each week as part of our commercial team meeting.

Make a list of activities/project that will contribute to meeting the department objectives and set up a plan to reach the goals.

Partially done. See earlier comments.

Go to lots of meetings and begin to run some of them.

Done.  I already chair a monthly marketing meeting with marketing representatives from the various research clusters feeding into that.  I also attend several organisational weekly meetings.

Continue to build relationships.

Done.  Mobile World Congress and The Cyber Summit were excellent for doing this.  I also continue to meet with colleagues from across CSIT as often as I can to build up a funnel of content for our websites and for raising our profile globally.

Begin to write materials (drafts)

Done.  I am in the process of refreshing our web estate which necessitates writing new and rewriting old contents.  I have also been updating marketing collateral, drafting funding proposals and producing press releases.

Continue to learn and read as much as possible.

Done.  The role is such that I will never stop learning and reading.  It’s par for the course.

By this time I hope to have uncovered some promising unexploited opportunities for growth and have begun to figure out how to exploit them.

Done.  I’ll keep them under my hat for now. ;-)

So I make that seven out of nine achieved and a further two partially achieved.  Not a bad result given the events that took place this month.

Update: I almost forgot to mention that during all this I took time out to guest on The Tech Show, a podcast in eamonmallie.com’s Tech section focused on the technology scene in Northern Ireland presented by Chris Taylor and Matt Johnston.  On the show I talk about cyber-security and an exhibitors perspective of Mobile World Congress.

What is a Technical Marketing Manager?

I started this morning writing a long post about my second 30 days in my new Technical Marketing Manager (TMM) post with The Centre for Secure Information Technologies (CSIT).  I found myself explaining how a TMM is similar to a Product Manager (PM).  It probably deserves a post of its own.  So here it is.

Some of you might be wondering why I take advice from a product management blog (On Product Management) when my job title is Technical Marketing Manager.  So what does a Technical Marketing Manager do?

In a sentence I see it as taking overall responsibility for marketing the product of a hugely technical organisation; something that is much more than the 4 P’s.

I see my current role as sitting on a spectrum of similar roles spanning from Technical Product Manager, Solution Specialist, Product Manager, through to Analyst, Product Marketing Manager and finally Technical Marketing Manger.  I’m probably a much better communicator than technologist, therefore the marketing aspect just feels like a better fit.

Ultimately all varieties of PM need most or all of the following skills:

  • Just doing it
  • Domain experience
  • Communication skills
  • Decision making ability
  • Environment scanning
  • Business understanding
  • Technical experience
  • Negotiation (both internally and externally)
  • Selling
  • Networking (of the human variety, not 802.x)
The list isn’t exhaustive but I reckon I use all of those every day.

Hat tip to onpm again for the skills list.  I’ve added a few of my own.