Encryption Isn’t Just A Switch!

Encryption Isn’t Just A Switch!

We received great news this week, and where our undergraduate programme (BEng (Hons) in Cyber Security and Forensics) will receive full NCSC accreditation (and one of the first in the UK to receive full accreditation). I think it showcases the quality of our academic environment — and which is always informed by academic fundamentals and industry practice — and in the quality of our graduates. This adds to our MSc accreditation and gets us accreditation through every year of our programmes.

What industry wants …

One of the best things about being a Professor is meet up with graduates from the past and share their successes. I might bump into someone while shopping and they tell me about all the great things they have been doing. Recently, though, I’ve been “sharing the stage” in presentations with some of our amazing graduates, and it gives me a great feeling of the impact our students are making on the world.

Last week I listened to a fantastic presentation from Ian Lowe — one of our MSc graduates — and I already knew his presentation was going to be good because I was his second market for his dissertation, and my head is still spinning with his low-level analysis of Bluetooth. In this dissertation, Ian knew exactly how to take apart Bluetooth LE, and then rebuild it.

For the presentation, Ian outlined that a strong underpinning of JavaScript and Python were important languages that were used [Link] and that graduates, of course, need strong written and spoken English skills. For him, too, the ability to drive Wireshark to understand how network protocols were key to the work of a specialist.

And, of course, a fundamental skill was that students need to understand the detail of how networks work and have strong debugging and analysis skills. For him, he wanted to see graduates who looked at a menu option of 1, 2, 3 and 4, and ask:

“What happens if I press zero?”,

or

“What happens if I continually press 4?”.

But along with this, he outlined that graduates should not see encryption as a switch, which is just turned on and off. He thought that too many graduates just see it that way, and where you just encrypt or don’t. For him, graduates need to understand that there’s key exchange, and hashing, and symmetric keys, and access tokens, and so on. All of these make up a core element of security, and where graduates sometimes fail to see the complexity around encryption. For strong analysis skills, all the elements need to be understood, and especially in how they relate to network traces.

This was all useful, as this week’s lecture to my third-year class was all about SSL and TLS. If you’re interested, here it is:

And here are some of the other areas that we cover [here], including public key encryption, symmetric key, key exchange, digital certificates, and hashing.

Conclusions

Encryption is patching the Internet, and, if done properly, can save companies from having to report breaches. But that shouldn’t be the core if it, as companies increasingly need to respect the rights of their customers to privacy.

Unfortunately, I continually come across PhD graduates in cybersecurity, who struggle to even the basics of public key encryption, and we need to make sure that every computer science graduate — at least — understands the basics of encryption, and that it is not just a switch to turn off or on. It is a complex entanglement which preserves privacy, defines integrity, and proves identity.

I can’t wait to teach cryptography in Semester 2 of our MSc, as I’ve expanded it with lots of new areas, including within elliptic curve cryptography, zero-knowledge proofs and Blockchain. If you’re interested in doing an MSc with us, contact Richard ([email protected]).

Our impact is best shown through our graduates, and we are proud of their contribution to our society, and to our economy. We, hopefully, provide them with the tools and the confidence to go an make their place in the world.