1. Research for Cyber Security Warwick University Industry Day 2018
Pete Vincent - IBM Security
19/03/2018

2. Agenda What the software engineers of tomorrow need to learn
The post quantum era
The human element

3. The OWASP Top 10 A1:2017-Injection A2:2017-Broken Authentication
A3:2017-Sensitive Data Exposure
A4:2017-XML External Entities (XXE)
A5:2017-Broken Access Control
A6:2017-Security Misconfiguration
A7:2017-Cross-Site Scripting (XSS)
A8:2017-Insecure Deserialization
A9:2017-Using Components with Known Vulnerabilities
A10:2017-Insufficient Logging & Monitoring

4. What the software engineers of tomorrow need to learn
Security professionals don't code, developers typically don't know much about security
Security relies on penetration testing to find bugs, it would be better to eradicate them by writing secure code:
Teach threat modelling
Teach OWASP
Most security spending is still on infrastructure security rather than application security
The cost of fixing a defect increases significantly the later in the development cycle you find it
Possible research:
Are there wider business benefits of adopting a secure coding methodology?
Hardware vulnerabilities

5. The post quantum era
Due to their ability to solve much more complex problems in far less time, large-scale quantum computers have the potential to severely impact cryptography.
Asymmetric cryptographic algorithms base their security on hard mathematical problems. This changes when running Shor’s algorithm, which can factor large numbers in days (or even hours), on a quantum computer.
Symmetric algorithms, such as Advanced Encryption Standard (AES), do not face the same threat as asymmetric algorithms, but the key sizes need to be doubled to provide the same level of protection due to Grover’s algorithm.
Google have developed “New Hope”, a post-quantum algorithm.
The impact of quantum computing on cybersecurity will likely not be felt for many years.
"New Hope" is promising but it's not yet had extensive cryptoanalysis.

6. The human element
Information security is a human issue. Even as security technology gets better, most breaches come down to a human failure. Someone clicking, someone making assumptions, someone not following policy. Mistakes get made. Users need continuous awareness education, this needs to be effective.
People are by nature helpful, attackers play on this.
Badly written policies that are practically impossible to comply will encourage the wrong behaviour.
Not giving users the right tools to do their job encourage the wrong behaviour.
Possible research:
The carrot vs the stick
Changing the context
Usable security
- The Psychology of Information Security by Leron Zinatullin

7. Questions?