Cyber security underpins almost every online interaction we have and has never been so important. With several grants under her belt, and a career spanning decades, our Information Security Head of Department discusses the learning environment on offer and her latest research.
Image by Pete Linforth
How did you first get involved in the world of information security?
I’ve worked in information security since 1990. I'm not a computer scientist but a linguist by background. I went to work for a UNIX software house after my undergraduate degree in Scandinavian Studies and Linguistics.
I graduated from university speaking fluent Swedish and so when a Swedish organisation wanted the company I was working for to develop a secure version of its software I joined the development team and got interested in information security.
In 1997, I became the information security officer for the British Council and took the MSc Information Security course at Royal Holloway as a part-time student. Coming to Royal Holloway as a student all those years ago and seeing how you could combine academia with information security practice was interesting to me.
What are the advantages of studying information security here?
Our Information Security Group has always had a big focus on practice. It’s a truly interdisciplinary department that features academics from a wide range of disciplines, from maths and computer science to social science, arts and humanities. Twelve years ago, we became a department in our own right, but retained the name Information Security Group.
When I started in information security, the focus was on how to securely access a computer and how to make sure your files were secure. That’s still important - but it’s a much bigger field now. Our research and teaching addresses the digital protection and safety of people and society, as well as information and technology protection. The learning environment here is research-infused but it’s also practice-led.
Over 35 years, we’ve built strong connections and partners in information security. We have an incredibly rich programme of external talks, and actively encourage students to meet and hear from our wider security ecosystem and work in practice settings while they’re with us.
Your research projects often have an element of social purpose. Why is that?
Soon after I joined as a lecturer, I was awarded a grant for an online privacy project called VOME looking at why people disclose the information that they do online. I started working with marginalised and underserved groups and looking at what information security meant for them.
At the time, there was an assumption that everybody had the resources, time, money and bandwidth to adopt security controls which our research showed was not the case. I became really interested in what it means to have fair, equitable, secure access to computers and information. I’ve continued to research that area for 15 years.
I’m happy to have helped us become thought leaders in how to research information security in hard-to-reach communities and what information security means for wider society, not just early adopters of technology or big organisations.
Tell me about your current project Digital Security by Design Social Science Hub+ (DiScriBE)?
Digital Security by Design (DSbD) is a UK government backed technology project designed by Cambridge University and Arm that is redesigning the computer chip to give it more security functionality.
The DSbD programme is focused on protecting against memory-based attacks and creating more nuanced ways of controlling access to data.
Traditionally, responses to emerging computer security threats involve running software updates when issues occur. The aim of DSbD technologies such as the chip architecture CHERI, is to prevent those problems at source so we don’t have to patch software, as the underlying hardware is able to repel and protect itself against attacks.
To help implement DSbD, I’m working as part of a social science-led research team called DiScriBE to articulate future uses of CHERI, identify barriers to adoption, and explore what the regulatory and legal framework might look like.
It’s challenging because we’re having to find ways to research technology for use cases that don’t yet exist. This means we’re creating new research methods to help us identify potential challenges and how we might respond to them.
We’ve run workshops and recently worked with StoryFutures, Punch Drunk and the School of International Futures to explore future scenarios where CHERI might be used. We even held a short story competition called the Secret Life of Data to find new ways of discussing technologies such as CHERI. Now, we’re developing speculative case studies to see how a wide range of organisations might use CHERI, across healthcare services to cryptocurrency wallets and autonomous vehicles.
Find out more about the Department for Information Security
