Shows
CyBOK — The Cybersecurity Body of KnowledgeCyBOK - AI for Security with Matilda RhodeCybersecurity, like other industries, has seen an explosion in the use of artificial intelligence (AI) and machine learning (ML) technologies in recent years. AI and ML can help to automate tasks. Data-driven approaches in general can draw patterns from vast volumes of data far quicker than humans are can. This episode summarises the state of AI for security at the time of writing and highlights some of the considerations to guide whether it is an appropriate approach for a given problem, common pitfalls to avoid, and human-AI ecosystems.AI is challenged by several open research areas including lack of...
2023-11-0116 minCyBOK — The Cybersecurity Body of KnowledgeCyBOK - Security Economics with Tyler MooreThe Security Economics Knowledge Guide introduces some of the most impactful ways economics has helped to shed light on cybersecurity problems and frame solutions that blend private and public action. The guide focuses on the organizational, rather than individual, perspective, which is where the majority of scholarly activity has focused.The author of this knowledge guides shares canonical security failures from an economic perspective, describes key measurement challenges, reviews firm-level approaches to improving cybersecurity, and discusses available public-policy options.We speak with CyBOK Security Economics author Tyler Moore for an overview of the topic.
2023-11-0121 minCyBOK — The Cybersecurity Body of KnowledgeCyBOK - Security and Privacy of AI with Lorenzo Cavallaro and Emiliano De CristofaroMachine Learning (ML) has rapidly become a fundamental technology that underpins count- less applications, from natural language processing and computer vision to fraud detection and personalized recommendations. In recent years, there has been a growing understanding of how to use ML in security contexts, leading to the development of advanced tools and techniques for detecting and preventing malicious activities. However, the security and privacy aspects of ML itself remain less understood, posing new challenges and opportunities for researchers and practitioners.This Cybersecurity Body of Knowledge (CyBoK) Knowledge Guide (KG) aims to define the scope of adversarial machine...
2023-09-2521 min
CyberWire DailyUpdate on Chinese cyberespionage incident. ICS vulnerabilities. USB attacks. New KEVs. Updates from Russia's hybrid war, as hacktivists swap DDoS attacks and observers draw lessons learned.Developments in the case of China's cyberespionage against government Exchange users. Industrial controller vulnerabilities pose a risk to critical infrastructure. USB attacks have risen three-fold in the first half of 2023. CISA adds two vulnerabilities to its Known Exploited Vulnerabilities Catalog. Ghostwriter's continued activity focuses on Poland and Ukraine. Hacktivist auxiliaries swap DDoS attacks. Awais Rashid from University of Bristol shares insights on threat modeling. Our guest is Chris Cochran from Huntress on the challenges small and medium sized businesses face with cyber security. And lessons learned from cyber warfare in Russia's war.For links...
2023-07-1430 minCyberWire DailyPowerDrop’s capabilities are up in the air. A Russian cyberespionage campaign channels their inner 007. A disconnect between law firms and cybersecurity protections.A new PowerShell remote access tool targets a US defense contractor. Current Russian cyber operations against Ukraine are honing in on espionage. CISA and its partners have released a Joint Guide to Securing Remote Access Software. A bug has been reported in Visual Studio’s UI. Awais Rashid from University of Bristol discussing Privacy in health apps. Our guest is Jim Lippie of SaaS Alerts with insights on software as a service Application Security. And are there disconnects between cybersecurity and the legal profession?For links to all of today's stories check out our Cy...
2023-06-0726 minCyBOK — The Cybersecurity Body of KnowledgeCyBOK - Network Security 2.0 with Christian RossowThe ubiquity of networking allows us to connect all sorts of devices and gain unprecedented access to a whole range of applications and services anytime, anywhere. However, our heavy reliance on networking technology also makes it an attractive target for malicious users who are willing to compromise the security of our communications and/or cause disruption to services that are critical for our day-to-day survival in a connected world. The Network Security 2.0 knowledge area explains the challenges associated with securing a network under a variety of attacks for a number of networking technologies and widely used security protocols, along...
2021-09-2120 minCyBOK — The Cybersecurity Body of KnowledgeCyBOK - Formal Methods with David BasinThe Formal Methods knowledge area surveys the most relevant topics in formal methods for security. As a discipline, formal methods address foundations, methods and tools, based on mathematics and logic, for rigourously developing and reasoning about computer systems, whether they be software, hardware, or a combination of the two. The application of formal methods to security has emerged over recent decades as a well-established research area focused on the specification and proof of security properties of systems, their components, and protocols.We speak with CyBOK Formal Methods author David Basin for an overview of...
2021-09-2131 minCyBOK — The Cybersecurity Body of KnowledgeCyBOK - Applied Cryptography with Kenny PatersonThe Applied Cryptography knowledge area This document provides a broad introduction to the field of cryptography, focusing on applied aspects of the subject. It complements the CyBoK document [1] which focuses on formal aspects of cryptography (including definitions and proofs) and on describing the core cryptographic primitives. That said, formal aspects are highly relevant when considering applied cryptography. As we shall see, they are increasingly important when it comes to providing security assurance for real-world deployments of cryptography.We speak with CyBOK Applied Cryptography author Kenny Paterson for an overview of the topic.
2021-09-2131 min
Afternoon Cyber Tea with Ann JohnsonUnderstanding Today’s Cyberattacks Through an Ancient LensAnn Johnson, Corporate Vice President, Security, Compliance, and Identity at Microsoft is joined by Genevieve Liveley, Professor of Classics, RISCS Fellow, and Turing Fellow at the University of Bristol. Genevieve talks about her research in the field of narratology, what ancient Greece teaches us about AI today, and the potential threat of AI-assisted cyberattacks. They wind things down by chatting about the human spirit and the power of resiliency.Resources: View Ann Johnson on LinkedInRelated:Listen to: Security UnlockedListen to: Security Unl...
2021-07-1328 minCyBOK — The Cybersecurity Body of KnowledgeCyBOK - Web and Mobile Security with Sascha FahlThe purpose of the Web and Mobile Security chapter is to provide an overview of security mechanisms, attacks and defences in modern web and mobile ecosystems. Web and mobile security have become the primary means through which many users interact with the Internet and computing systems. Hence, their impact on overall information security is significant due to the sheer prevalence of web and mobile applications (apps). Covering both web and mobile security, this Knowledge Area emphasises the intersection of their security mechanisms, vulnerabilities and mitigations. We speak with CyBOK Web and Mobile Security author Sascha Fahl for a...
2021-05-0122 minCyBOK — The Cybersecurity Body of KnowledgeCyBOK - Law and Regulation with Robert CarolinaThe purpose of the Law and Regulation chapter is to provide a snapshot of legal and regulatory topics that merit consideration when conducting various activities in the field of cyber security such as: security management, risk assessment, security testing, forensic investigation, research, product and service development, and cyber operations (defensive and offensive). The hope is to provide a framework that shows the cyber security practitioner the most common categories of legal and regulatory risk that apply to these activities, and to highlight (where possible) some sources of legal authority and scholarship..We speak with CyBOK Law and...
2020-09-0137 minCyBOK — The Cybersecurity Body of KnowledgeCyBOK - Distributed Systems Security with Neeraj SuriThe purpose of the Distributed Systems Security chapter is to introduce the different classes of distributed systems categorising them into two broad categories of decentralised distributed systems (without central coordination) and the coordinated resource/services type of distributed systems. Subsequently, each of these distributed system categories is expounded for the conceptual mechanisms providing their characteristic functionalities prior to discussing the security issues pertinent to these systems.We speak with CyBOK Distributed Systems Security author Neeraj Suri for an introductory overview of the topic.
2020-09-0120 minCyBOK — The Cybersecurity Body of KnowledgeCyBOK - Hardware Security with Ingrid VerbauwhedeThe purpose of the Distributed Systems Security chapter covers a broad range of topics from trusted computing to Trojan circuits. To classify these topics we follow the different hardware abstraction layers as introduced by the Y-chart of Gajski & Kuhn.We speak with CyBOK Hardware Security author Ingrid Verbauwhede for an introductory overview of the topic.
2020-09-0120 minCyBOK — The Cybersecurity Body of KnowledgeCyBOK - Adversarial Behaviours with Gianluca StringhiniThe purpose of the Adversarial Behaviours chapter is to provide an overview of the malicious operations that are happening on the Internet today. The chapter discusses how these frameworks can be used by researchers and practitioners to develop effective mitigations against malicious online operations.We speak with CyBOK Distributed Systems Security author Gianluca Stringhini for an introductory overview of the topic.
2020-09-0117 minCyBOK — The Cybersecurity Body of KnowledgeCyBOK - Privacy and Online Rights with Carmela TroncosoThe purpose of the Privacy and Online Rights chapter is to introduce system designers to the concepts and technologies that are used to engineer systems that inherently protect users’ privacy. We aim to provide designers with the ability to identify privacy problems, to describe them from a technical perspective, and to select adequate technologies to eliminate, or at least, mitigate these problems.We speak with CyBOK Privacy and Online Rights Knowledge Area author Carmela Troncoso for an introductory overview of the topic.
2020-07-1718 minCyBOK — The Cybersecurity Body of KnowledgeCyBOK - Network Security with Sanjay JhaThe purpose of the Network Security chapter is to explain the challenges associated with securing a network under a variety of attacks for a number of networking technologies and widely used security protocols, along with emerging security challenges and solutions. This chapter aims to provide the necessary background in order to understand other knowledge areas. An understanding of basic networking protocol stack and TCP/IP suite is assumed.We speak with CyBOK Network Security Knowledge Area author Sanjay Jha for an introductory overview of the topic.
2020-07-1722 minCyBOK — The Cybersecurity Body of KnowledgeCyBOK - Operating Systems & Virtualisation Security with Herbert BosThe purpose of the Operating Systems & Virtualisation Security chapter is to introduce the principles, primitives and practices for ensuring security at the operating system and hypervisor levels. We see that the challenges related to operating system security have evolved over the past few decades, even if the principles have stayed mostly the same.We speak with CyBOK Operating Systems & Virtualisation Security author Herbert Bos for an introductory overview of the topic.
2020-07-1717 minCyBOK — The Cybersecurity Body of KnowledgeCyBOK - Human Factors with Awais RashidThe Human Factors chapter presents a foundational understanding of the role of human factors in cyber security. One key aspect of this is how to design security that is usable and acceptable to a range of human actors, for instance, end-users, administrators and developers. This knowledge area also introduces a broader organisational and societal perspective on security that has emerged over the past decade.We speak with CyBOK Human Factors co-author Awais Rashid for an introductory overview of the topic.
2020-07-1721 minCyBOK — The Cybersecurity Body of KnowledgeCyBOK - AAA with Dieter GollmannThe Authentication, Authorisation & Accountability (AAA) chapter presents the general foundations of access control and some significant instantiations that have emerged as IT kept spreading into new application areas. It will survey modes of user authentication and the way they are currently deployed, authentication protocols for the web, noting how new use cases have led to a shift from authentication to authorisation protocols, and the formalisation of authentication properties as used in today’s protocol analysis tools. On accountability, the focus is on the management and protection of audit logs.We speak with CyBOK Authentication, Authorisation & Accountability (AAA) au...
2020-07-1720 minCyBOK — The Cybersecurity Body of KnowledgeCyBOK - Risk Management and Governance with Pete BurnapThe Risk Management and Governance chapter explains the fundamental principles of cyber risk assessment and management and their role in risk governance, expanding on these to cover the knowledge required to gain a working understanding of the topic and its sub-areas.We speak with CyBOK Risk Management and Governance author Pete Burnap for an introductory overview of the topic.
2020-07-1718 min
CyBOK — The Cybersecurity Body of KnowledgeCyBOK - Digital Forensics with Vassil RoussevThe Forensics chapter provides a technical overview of digital forensic techniques and capabilities, and to put them into a broader perspective with regard to other related areas in the cybersecurity domain. The discussion on legal aspects of digital forensics is limited only to general principles and best practices, as the specifics of the application of these principles tend to vary across jurisdictions.We speak with CyBOK Forensics author Vassil Roussev for an introductory overview of the topic.
2020-06-2617 min
CyBOK — The Cybersecurity Body of KnowledgeCyBOK - Cyber-Physical Systems Security with Alvaro CardenasCyber-Physical Systems Security are engineered systems that are built from, and depend upon, the seamless integration of computation, and physical components. While automatic control systems like the steam governor have existed for several centuries, it is only in the past decades that the automation of physical infrastructures like the power grid, water systems, or chemical reactions have migrated from analogue controls to embedded computer-based control, often communicating through computer-based networks.We speak with CyBOK Cyber-Physical Systems Security author Alvaro Cardenas for an introductory overview of the topic.
2020-06-2519 min
CyBOK — The Cybersecurity Body of KnowledgeCyBOK — Software Security with Frank PiessensThe purpose of the Software Security chapter is to provide a structured overview of known categories of software implementation vulnerabilities, and of techniques that can be used to prevent or detect such vulnerabilities, or to mitigate their exploitation.We speak with CyBOK Software Security Knowledge Area author Frank Piessens for an introductory overview of the topic.
2019-12-2417 min
CyBOK — The Cybersecurity Body of KnowledgeCyBOK — Cryptography with Nigel SmartThe purpose of this chapter is to explain the various aspects of cryptography which we feel should be known to an expert in cyber-security.We speak with CyBOK Cryptography Knowledge Area author Nigel Smart for an introductory overview of the topic.
2019-12-1720 min
CyBOK — The Cybersecurity Body of KnowledgeCyBOK — Security Operations and Incident Management with Hervé DebarAfter nearly 40 years of research and development, the Security Operations and Incident Management domain has reached a sufficient maturity to be deployed in many environments.We speak with CyBOK Security Operations and Incident Management Knowledge Area author Hervé Debar for an introductory overview of the topic.
2019-12-1016 min
CyBOK — The Cybersecurity Body of KnowledgeCyBOK — Secure Software Lifecycle with Laurie WilliamsThe purpose of this Secure Software Lifecycle knowledge area is to provide an overview of software development processes for implementing secure software from the design of the software to the operational use of the software.We speak with CyBOK Secure Software Lifecycle Knowledge Area author Laurie Williams for an introductory overview of the topic.
2019-12-0420 min
CyBOK — The Cybersecurity Body of KnowledgeWelcome to CyBOK with Awais RashidWelcome to CyBOK, the Cybersecurity Body of Knowledge.A comprehensive Body of Knowledge to inform and underpin education and professional training for the cyber security sector.The CyBOK project aims to bring cyber security into line with the more established sciences by distilling knowledge from major internationally-recognised experts to form a Cyber Security Body of Knowledge that will provide much-needed foundations for this emerging topic.The project, funded by the National Cyber Security Programme, is led by the University of Bristol's Professor Awais Rashid, along with other leading cyber security expert...
2019-09-2309 min