Cybersecurity: it's personal

What are the big questions you’re trying to explore with your research?

I am interested in how we can improve cybersecurity by looking at human factors. This essentially goes into two different directions. On the one hand, how can we use formal methods and automated reasoning to model and analyse the interaction between humans and cybersecurity systems. This is in order to identify attacks before they happen, in order to attribute attacks if they have happened, or in order to prove the absence of attacks.

The second sub-problem is in the human dimension of cybersecurity; how can we actually explain cybersecurity? And I mean explain it to every possible person. So, obviously lay users but also experts, in order that they understand what humans are actually doing when interacting with systems. And even attackers! How can we explain that it is not worth attacking our system because we are protected so much that they would be wasting their time? 

Is there an example where something has gone wrong because of poorly explained cybersecurity? 

I would say probably every single social engineering attack that has been carried out can be at least in part attributed to a lack of explanation. Say you find a USB stick lying on the ground. The first thing that you do, because you're a good person, is you plug it into your laptop in order to find out if there is some information on who it belongs to. Well, that USB stick has been loaded with a virus, and the moment you plug it into your laptop it causes mayhem! So we need to explain to people that actually, even though your first instinct would be to help, probably the best thing is to pick up the USB and hand it to the lost and found.

I always make this example: when I bought my first mobile phone, it was a few centimetres thick, and it came with a manual that was even thicker. These days, you get smartphones that are relatively thin and no manual at all! The idea is that they are plug and play. This might be the case for digital natives, but it's certainly not the case for some senior citizens.

Now the trick is, what is the right level of explanation? You can't bombard people with a 200-page manual that details every single step of how to make your system secure, because people won't read it! But at the same time, you can't really say, okay, now you're on your own, deal with it. You need to find the right level, and you need to find the right language, which will change depending on who you're talking to.

You have used fairy tales to explain cybersecurity. Why do you think that is effective?

Fairy tales are a good initial metaphor. For some people, they can be the final explanation - you can stop there and they've already understood. But for the majority of people, you will then need to follow that up with more technical information.

But you have broken the ice, and nothing beats a smile, right? If you can make people smile, you take away that fear people typically have when they think about cybersecurity. They often think “I'm going to do something wrong, and they're going to steal all my money and everything”. And these are legitimate worries! If you can somehow not exaggerate with the metaphors but find the right level to start a conversation, that can hopefully lead to a level of understanding. 

How has the way you do your research changed over your career?

When I started working in cybersecurity about 30 years ago, the approaches that we were following were essentially in their infancy. We were able to come up with formal and automated reasoning for systems that were not much more than toy examples. But that was quite challenging!

These days we are able to look at real life protocols [sets of rules and procedures that govern how data is securely transmitted online]. The best example I can give is the work by some friends of mine. So, 30 years ago, we could look at messages exchanged by two agents with a little bit of cryptography. But today, these colleagues looked at the protocols underlying 5G technology, which have hundreds of messages and complicated cryptography. They were able to find potential attacks even after the protocols were deployed. We have made a lot of progress in the sense that we understand problems better, and have developed refined techniques that are much, much better.

And is cybersecurity more important now than before?

Cybersecurity is obviously becoming more and more pervasive. 30 years ago, I needed to walk 3 miles to get online whereas, these days, we all carry the internet in our pockets! And that means, of course, that the attack surfaces have incredibly increased. So, in that sense, cybersecurity has become even more relevant, and the kinds of attacks have become even more interesting, in a kind of ironic way.

Obviously, Artificial Intelligence (AI) is a bit of an elephant in the room. It's currently very chaotic, and that makes it more difficult to find out what is happening both in terms of using AI for defences and using AI for attacks. And in the vast majority of cases, there’s nothing particularly intelligent about what these systems are doing.

But AI can also be very, very good. You know, even large language models and predictive models, which are not that intelligent, can be very useful. I've been using them to look at phishing and how you can improve messages related to phishing. So even fairly dumb AI systems can actually be very, very interesting!

So how does research like yours make it into like a consumer-facing product?

Looking at the human dimension and looking at users is one way to do so. You can come up with the most secure system which can fail if people don't use it properly: A car is a relatively safe device, but if you drive at 300 kilometres an hour in the city centre, it becomes deadly!

The other way is obviously not to carry out research in a vacuum, but to collaborate with whoever actually develops systems for cybersecurity. I've been working with quite a few companies over the years who are system developers, and they're very keen to collaborate with academics like me, in order to analyse, verify, validate their systems. And that kind of collaboration has been incredibly productive, and ultimately has led to companies putting products on the market that are much more secure than they were originally.

What's a kind of typical working day like for you?

I have many different roles, so a typical working day will be a mix of a lot of different things, with quite a lot of leadership and administration these days. That is the vast majority of my time, but I also carry out research, meet with colleagues, with my PhD students and postdocs. I would say my typically working day is fairly “schizophrenic”, meaning that I jump from one topic to the other, which is part of the excitement, because it's never dull!

This is also the hardest part of my job, because being able to constantly context switch is challenging. It's an acquired skill. You learn how to do that, very much like you learn how to be a better teacher, learn to be a better researcher. So, I would say a typical day for me is very mixed, and that is the excitement and the reward of it, but also the issue with it. You need to be prepared to do a lot of different things in a short amount of time!

What subjects did you enjoy at school as a teenager? 

I wasn't particularly interested in computer science! I'm the son of a computer scientist mum, who was a programmer and started programming on punch cards, and a movie and theatre critic and high school teacher dad. And I think I've become the perfect mix of my parents.

I got a computer as a child, but I wasn’t really interested in programming. I’m still a lousy programmer, which is kind of ironic, because I've been teaching software engineering for a while! I think my favourite topic was probably philosophy and literature, but I was also very good at maths. 

You also write plays alongside research. Do you find that that helps you be a better scientist?

I think it helps incredibly! Essentially everything is a matter of the story that you tell. Be it theatre, writing prose or whatever, good storytelling is crucial. What I've come to realise is that there is not much difference between a good plot for a play and a good plot for a research paper.

Essentially, what you're trying to do is convince your audience that what you're going to tell them about, be it your research or a drama or a comedy, is worth listening to and is going to improve their life. And improving their life can just be they laugh for 90 minutes and that's it right? It's not that they are changed forever.

There is virtue in entertainment, like there is virtue in a good paper that doesn't provide incredibly groundbreaking results, but that does advance the state-of-the-art in some way. And that advancing the state-of-the-art, is obviously a function of the quality of your work. 

Are you able to combine these two areas of interest in your research?

After having kept these two souls, these two areas of interest separate for many years, I decided, actually, I want to have more fun in what I'm doing! So I've been bringing them together. And I think that my strength lies in that combination.

I'm a good researcher, good enough to be professor at King's, but my research results are not going to change the world. There are some colleagues who I've worked with, whose results are changing the world, right? My research results are very honest, interesting results that help advance the state-of-the-art. And that is good enough!

I think my strongest contribution lies in that ability to actually bring these two areas together: the humanities and the mathematical computer science, and the ability to speak these two languages and being credible in both.

What advice would you give to young people interested in a career in this field? 

Cybersecurity is incredibly interesting, because there will always be problems. You will never exhaust the set of interesting questions that you can answer, and you'll never be out of a job!

You will need to change, you will need to adapt, of course, but that is natural. But at the same time, there will always be interesting questions. And if you have a solid basis, then you will be able to adapt and you will be able to live a happy and interesting researcher life.

What I think is important for longevity, at least for me, is keeping your enthusiasm. I think that the recipe for not being bored is to have a solid basis that is as wide as possible. So don't just focus on computer science and mathematics but find connections with other disciplines. This way, you're able to be stimulated by questions or by solutions that come from areas that might be unexpected.