Advanced Persistent Threats (APTs) are characterized by their complexity and ability to stay rela... more Advanced Persistent Threats (APTs) are characterized by their complexity and ability to stay relatively dormant and undetected on a computer system before launching a devastating attack. Numerous unsuccessful attempts have utilized machine learning techniques and rule-based technologies to try and detect these sophisticated attacks. In this paper, we opt for a more theoretical approach to identify unique APT characteristics, distinguishable from other multi-stage attacks. We model four well-known APTs, based on the kill chain framework, and we identify common behavior to create abstract models which describe generalized APT behavior. We find that attributes from the Command and Control phase of these attacks provide unique features that can be used by any anomaly detection systems. We further validate how expressive our abstract models are by formalizing a fifth APT and examining the behavior that was not captured.
IFIP advances in information and communication technology, 2016
Privacy is a well-understood concept in the physical world, with us all desiring some escape from... more Privacy is a well-understood concept in the physical world, with us all desiring some escape from the public gaze. However, while individuals might recognise locking doors as protecting privacy, they have difficulty practising equivalent actions online. Privacy salience considers the tangibility of this important principle; one which is often obscured in digital environments. Through extensively surveying a range of studies, we construct the first taxonomies of privacy salience. After coding articles and identifying commonalities, we categorise works by their methodologies, platforms and underlying themes. While web browsing appears to be frequently analysed, the Internet-of-Things has received little attention. Through our use of category tuples and frequency matrices, we then explore those research opportunities which might have been overlooked. These include studies of targeted advertising and its affect on salience in social networks. It is through refining our understanding of this important topic that we can better highlight the subject of privacy.
While the public claim concern for their privacy, they frequently appear to overlook it. This dis... more While the public claim concern for their privacy, they frequently appear to overlook it. This disparity between concern and behaviour is known as the Privacy Paradox. Such issues are particularly prevalent on wearable devices. These products can store personal data, such as text messages and contact details. However, owners rarely use protective features. Educational games can be effective in encouraging changes in behaviour. Therefore, we developed the first privacy game for (Android) Wear OS watches. 10 participants used smartwatches for two months, allowing their high-level settings to be monitored. Five individuals were randomly assigned to our treatment group, and they played a dynamically-customised privacy-themed game. To minimise confounding variables, the other five received the same app but lacking the privacy topic. The treatment group improved their protection, with their usage of screen locks significantly increasing (p = 0.043). In contrast, 80% of the control group continued to never restrict their settings. After the posttest phase, we evaluated behavioural rationale through semistructured interviews. Privacy concerns became more nuanced in the treatment group, with opinions aligning with behaviour. Actions appeared influenced primarily by three factors: convenience, privacy salience and data sensitivity. This is the first smartwatch game to encourage privacy-protective behaviour.
Despite alternative authentication methods, passwords remain the most common method of restrictin... more Despite alternative authentication methods, passwords remain the most common method of restricting access to online information and services 1. It is important to develop 'strong' passwords (i.e., passwords that are difficult to guess) in order to prevent hackers from accessing important personal information (e.g., bank account details). Despite a wealth of public advice available on protecting online data, many individuals still choose weak passwords or engage in risky password practices such as sharing their passwords with others 2-6. This is, in part, because choosing memorable, long and strong passwords is difficult and unintuitive for humans 7 .
Department of Computing Science Technical Report Series, 2001
One can therefore say that a structure also features a behaviour, particularly, relative to depen... more One can therefore say that a structure also features a behaviour, particularly, relative to dependability impairments, even if the pace of changes considered relative to, on the one hand, the user's requests and, on the other the dependability impairments, areas should be notedradically different.
In opinion polls, the public frequently claim to value their privacy. However, individuals often ... more In opinion polls, the public frequently claim to value their privacy. However, individuals often seem to overlook the principle, contributing to a disparity labelled the 'Privacy Paradox'. The growth of the Internet-of-Things (IoT) is frequently claimed to place privacy at risk. However, the Paradox remains underexplored in the IoT. In addressing this, we first conduct an online survey (N = 170) to compare public opinions of IoT and less-novel devices. Although we find users perceive privacy risks, many still decide to purchase smart devices. With the IoT rated less usable/familiar, we assert that it constrains protective behaviour. To explore this hypothesis, we perform contextualised interviews (N = 40) with the public. In these dialogues, owners discuss their opinions and actions with a personal device. We find the Paradox is significantly more prevalent in the IoT, frequently justified by a lack of awareness. We finish by highlighting the qualitative comments of users, and suggesting practical solutions to their issues. This is the first work, to our knowledge, to evaluate the Privacy Paradox over a broad range of technologies.
We introduce refinement checking for privacy policies expressed in P3P and XACML. Our method invo... more We introduce refinement checking for privacy policies expressed in P3P and XACML. Our method involves a translation of privacy policies to a set of process specifications in CSP, which describe how the privacy policy is enforced. The technique is described through an example involving medical data collected by a biobank.
Over the past half-century, technology has evolved beyond our wildest dreams. However, while the ... more Over the past half-century, technology has evolved beyond our wildest dreams. However, while the benefits of technological growth are undeniable, the nascent Internet did not anticipate the online threats we routinely encounter and the harms which can result. As our world becomes increasingly connected, it is critical we consider what implications current and future technologies have for security and privacy. We approach this challenge by surveying 30 predictions across industry, academia and international organisations to extract a number of common themes. Through this, we distill 10 emerging scenarios and reflect on the impact these might have on a range of stakeholders. Considering gaps in best practice and requirements for further research, we explore how security and privacy might evolve over the next decade. We find that existing guidelines both fail to consider the relationships between stakeholders and do not address the novel risks from wearable devices and insider threats. Our approach rigorously analyses emerging scenarios and suggests future improvements, of crucial importance as we look to preempt new technological threats.
Journal of Internet Services and Applications, Jul 14, 2017
Policy discussions often assume that wider adoption of cyber insurance will promote information s... more Policy discussions often assume that wider adoption of cyber insurance will promote information security best practice. However, this depends on the process that applicants need to go through to apply for cyber insurance. A typical process would require an applicant to fill out a proposal form, which is a self-assessed questionnaire. In this paper, we examine 24 proposal forms, offered by insurers based in the UK and the US, to determine which security controls are present in the forms. Our aim is to establish whether the collection of security controls mentioned in the analysed forms corresponds to the controls defined in ISO/IEC 27002 and the CIS Critical Security Controls; these two control sets are generally held to be best practice. This work contains a novel research direction as we are the first to systematically analyse cyber insurance proposal forms. Our contributions include evidence regarding the assumption that the insurance industry will promote security best practice. To address the problem of adverse selection, we suggest the number of controls that proposal forms should include to be in alignment with the two information security frameworks. Finally, we discuss the incentives that could lead to this disparity between insurance practice and information security best practice, emphasising the importance of information security economics in studying cyber insurance.
The concept of 'social machines' is increasingly being used to characterise various socio-cogniti... more The concept of 'social machines' is increasingly being used to characterise various socio-cognitive spaces on the Web. Social machines are human collectives using networked digital technology which initiate real-world processes and activities including human communication, interactions and knowledge creation. As such, they continuously emerge and fade on the Web. The relationship between humans and machines is made more complex by the adoption of Internet of Things (IoT) sensors and devices. The scale, automation, continuous sensing, and actuation capabilities of these devices add an extra dimension to the relationship between humans and machines making it difficult to understand their evolution at either the systemic or the conceptual level. This article describes these new socio-technical systems, which we term Cyber-Physical Social Machines, through different exemplars, and considers the associated challenges of security and privacy.
The growing centrality of cybersecurity has led many governments and international organisations ... more The growing centrality of cybersecurity has led many governments and international organisations to focus on building the capacity of nations to withstand threats to the public and its digital resources. These initiatives entail a range of actions that vary from education and training to technology and related standards, as well as new legal and policy frameworks. While efforts to proactively address security problems seem intuitively valuable, they are new, meaning there is relatively little research on whether they achieve their intended objectives. This paper takes a crossnational comparative approach to determine whether there is empirical support for investing in capacity-building. Marshalling field research from 73 nations, the comparative data analysis: (1) describes the status of capacity-building across the nations; (2) determines the impact of capacity-building when controlling for other key contextual variables that might provide alternative explanations for key outcomes and (3) explores the factors that are shaping national advances in capacity-building. The analysis finds a low, formative status of cybersecurity capacity in most of the nations studied and also shows that relatively higher levels of maturity translate into positive outcomes for nations. The study provides empirical support to international efforts aimed at building cybersecurity capacity.
Researchers have questioned whether there is a relationship between personality and patterns of o... more Researchers have questioned whether there is a relationship between personality and patterns of online self-presentation. This paper examined, more specifically, whether personality predicts profile choices as well as image choice behaviour on two different SNSs: Twitter and Facebook. We found that personality does, to some extent, predict choices regarding profile images; however, not always in the direction we predicted and results differed across sites. We found that participants who scored higher on conscientiousness and lower on extraversion were more likely to change their Facebook profile image. Participants who scored lower on extraversion were more likely to choose a Twitter profile image that included a photograph of themselves compared to participants who scored higher on extraversion. For participants whose Facebook profile image was a photograph of themselves, a greater proportion of participants selected a recent photograph from the past six months. However, this was not the case for Twitter. We conclude that personality can predict some image choices and behaviours that might be useful for future work on authentication and identification, although other predictor variables are potentially also important when considering the types of individual characteristics which might predict online behaviour on SNSs.
Advanced Persistent Threats (APTs) are characterized by their complexity and ability to stay rela... more Advanced Persistent Threats (APTs) are characterized by their complexity and ability to stay relatively dormant and undetected on a computer system before launching a devastating attack. Numerous unsuccessful attempts have utilized machine learning techniques and rule-based technologies to try and detect these sophisticated attacks. In this paper, we opt for a more theoretical approach to identify unique APT characteristics, distinguishable from other multi-stage attacks. We model four well-known APTs, based on the kill chain framework, and we identify common behavior to create abstract models which describe generalized APT behavior. We find that attributes from the Command and Control phase of these attacks provide unique features that can be used by any anomaly detection systems. We further validate how expressive our abstract models are by formalizing a fifth APT and examining the behavior that was not captured.
IFIP advances in information and communication technology, 2016
Privacy is a well-understood concept in the physical world, with us all desiring some escape from... more Privacy is a well-understood concept in the physical world, with us all desiring some escape from the public gaze. However, while individuals might recognise locking doors as protecting privacy, they have difficulty practising equivalent actions online. Privacy salience considers the tangibility of this important principle; one which is often obscured in digital environments. Through extensively surveying a range of studies, we construct the first taxonomies of privacy salience. After coding articles and identifying commonalities, we categorise works by their methodologies, platforms and underlying themes. While web browsing appears to be frequently analysed, the Internet-of-Things has received little attention. Through our use of category tuples and frequency matrices, we then explore those research opportunities which might have been overlooked. These include studies of targeted advertising and its affect on salience in social networks. It is through refining our understanding of this important topic that we can better highlight the subject of privacy.
While the public claim concern for their privacy, they frequently appear to overlook it. This dis... more While the public claim concern for their privacy, they frequently appear to overlook it. This disparity between concern and behaviour is known as the Privacy Paradox. Such issues are particularly prevalent on wearable devices. These products can store personal data, such as text messages and contact details. However, owners rarely use protective features. Educational games can be effective in encouraging changes in behaviour. Therefore, we developed the first privacy game for (Android) Wear OS watches. 10 participants used smartwatches for two months, allowing their high-level settings to be monitored. Five individuals were randomly assigned to our treatment group, and they played a dynamically-customised privacy-themed game. To minimise confounding variables, the other five received the same app but lacking the privacy topic. The treatment group improved their protection, with their usage of screen locks significantly increasing (p = 0.043). In contrast, 80% of the control group continued to never restrict their settings. After the posttest phase, we evaluated behavioural rationale through semistructured interviews. Privacy concerns became more nuanced in the treatment group, with opinions aligning with behaviour. Actions appeared influenced primarily by three factors: convenience, privacy salience and data sensitivity. This is the first smartwatch game to encourage privacy-protective behaviour.
Despite alternative authentication methods, passwords remain the most common method of restrictin... more Despite alternative authentication methods, passwords remain the most common method of restricting access to online information and services 1. It is important to develop 'strong' passwords (i.e., passwords that are difficult to guess) in order to prevent hackers from accessing important personal information (e.g., bank account details). Despite a wealth of public advice available on protecting online data, many individuals still choose weak passwords or engage in risky password practices such as sharing their passwords with others 2-6. This is, in part, because choosing memorable, long and strong passwords is difficult and unintuitive for humans 7 .
Department of Computing Science Technical Report Series, 2001
One can therefore say that a structure also features a behaviour, particularly, relative to depen... more One can therefore say that a structure also features a behaviour, particularly, relative to dependability impairments, even if the pace of changes considered relative to, on the one hand, the user's requests and, on the other the dependability impairments, areas should be notedradically different.
In opinion polls, the public frequently claim to value their privacy. However, individuals often ... more In opinion polls, the public frequently claim to value their privacy. However, individuals often seem to overlook the principle, contributing to a disparity labelled the 'Privacy Paradox'. The growth of the Internet-of-Things (IoT) is frequently claimed to place privacy at risk. However, the Paradox remains underexplored in the IoT. In addressing this, we first conduct an online survey (N = 170) to compare public opinions of IoT and less-novel devices. Although we find users perceive privacy risks, many still decide to purchase smart devices. With the IoT rated less usable/familiar, we assert that it constrains protective behaviour. To explore this hypothesis, we perform contextualised interviews (N = 40) with the public. In these dialogues, owners discuss their opinions and actions with a personal device. We find the Paradox is significantly more prevalent in the IoT, frequently justified by a lack of awareness. We finish by highlighting the qualitative comments of users, and suggesting practical solutions to their issues. This is the first work, to our knowledge, to evaluate the Privacy Paradox over a broad range of technologies.
We introduce refinement checking for privacy policies expressed in P3P and XACML. Our method invo... more We introduce refinement checking for privacy policies expressed in P3P and XACML. Our method involves a translation of privacy policies to a set of process specifications in CSP, which describe how the privacy policy is enforced. The technique is described through an example involving medical data collected by a biobank.
Over the past half-century, technology has evolved beyond our wildest dreams. However, while the ... more Over the past half-century, technology has evolved beyond our wildest dreams. However, while the benefits of technological growth are undeniable, the nascent Internet did not anticipate the online threats we routinely encounter and the harms which can result. As our world becomes increasingly connected, it is critical we consider what implications current and future technologies have for security and privacy. We approach this challenge by surveying 30 predictions across industry, academia and international organisations to extract a number of common themes. Through this, we distill 10 emerging scenarios and reflect on the impact these might have on a range of stakeholders. Considering gaps in best practice and requirements for further research, we explore how security and privacy might evolve over the next decade. We find that existing guidelines both fail to consider the relationships between stakeholders and do not address the novel risks from wearable devices and insider threats. Our approach rigorously analyses emerging scenarios and suggests future improvements, of crucial importance as we look to preempt new technological threats.
Journal of Internet Services and Applications, Jul 14, 2017
Policy discussions often assume that wider adoption of cyber insurance will promote information s... more Policy discussions often assume that wider adoption of cyber insurance will promote information security best practice. However, this depends on the process that applicants need to go through to apply for cyber insurance. A typical process would require an applicant to fill out a proposal form, which is a self-assessed questionnaire. In this paper, we examine 24 proposal forms, offered by insurers based in the UK and the US, to determine which security controls are present in the forms. Our aim is to establish whether the collection of security controls mentioned in the analysed forms corresponds to the controls defined in ISO/IEC 27002 and the CIS Critical Security Controls; these two control sets are generally held to be best practice. This work contains a novel research direction as we are the first to systematically analyse cyber insurance proposal forms. Our contributions include evidence regarding the assumption that the insurance industry will promote security best practice. To address the problem of adverse selection, we suggest the number of controls that proposal forms should include to be in alignment with the two information security frameworks. Finally, we discuss the incentives that could lead to this disparity between insurance practice and information security best practice, emphasising the importance of information security economics in studying cyber insurance.
The concept of 'social machines' is increasingly being used to characterise various socio-cogniti... more The concept of 'social machines' is increasingly being used to characterise various socio-cognitive spaces on the Web. Social machines are human collectives using networked digital technology which initiate real-world processes and activities including human communication, interactions and knowledge creation. As such, they continuously emerge and fade on the Web. The relationship between humans and machines is made more complex by the adoption of Internet of Things (IoT) sensors and devices. The scale, automation, continuous sensing, and actuation capabilities of these devices add an extra dimension to the relationship between humans and machines making it difficult to understand their evolution at either the systemic or the conceptual level. This article describes these new socio-technical systems, which we term Cyber-Physical Social Machines, through different exemplars, and considers the associated challenges of security and privacy.
The growing centrality of cybersecurity has led many governments and international organisations ... more The growing centrality of cybersecurity has led many governments and international organisations to focus on building the capacity of nations to withstand threats to the public and its digital resources. These initiatives entail a range of actions that vary from education and training to technology and related standards, as well as new legal and policy frameworks. While efforts to proactively address security problems seem intuitively valuable, they are new, meaning there is relatively little research on whether they achieve their intended objectives. This paper takes a crossnational comparative approach to determine whether there is empirical support for investing in capacity-building. Marshalling field research from 73 nations, the comparative data analysis: (1) describes the status of capacity-building across the nations; (2) determines the impact of capacity-building when controlling for other key contextual variables that might provide alternative explanations for key outcomes and (3) explores the factors that are shaping national advances in capacity-building. The analysis finds a low, formative status of cybersecurity capacity in most of the nations studied and also shows that relatively higher levels of maturity translate into positive outcomes for nations. The study provides empirical support to international efforts aimed at building cybersecurity capacity.
Researchers have questioned whether there is a relationship between personality and patterns of o... more Researchers have questioned whether there is a relationship between personality and patterns of online self-presentation. This paper examined, more specifically, whether personality predicts profile choices as well as image choice behaviour on two different SNSs: Twitter and Facebook. We found that personality does, to some extent, predict choices regarding profile images; however, not always in the direction we predicted and results differed across sites. We found that participants who scored higher on conscientiousness and lower on extraversion were more likely to change their Facebook profile image. Participants who scored lower on extraversion were more likely to choose a Twitter profile image that included a photograph of themselves compared to participants who scored higher on extraversion. For participants whose Facebook profile image was a photograph of themselves, a greater proportion of participants selected a recent photograph from the past six months. However, this was not the case for Twitter. We conclude that personality can predict some image choices and behaviours that might be useful for future work on authentication and identification, although other predictor variables are potentially also important when considering the types of individual characteristics which might predict online behaviour on SNSs.
Uploads
Papers by Sadie Creese