Attending conferences is a crucial way our staff can keep up to date with cutting-edge research, be introduced to important new ideas and perspectives, and help inspire and support the next generation of cyber security professionals. Our ID Cyber Solutions Conference Report series aims to showcase some exciting and ground breaking ideas presented at these events.

Report by Alice, Cyber Essentials Assessor and Technical Editor

It’s hard to deny the value of conferences. Meeting new people and developing networks, learning about new technologies and ideas, and even just reinforcing your existing interests – I don’t think I’ve ever been to a conference and not a) massively enjoyed it b) gained a lot from it on both a personal and professional level, and I’m happy and grateful to be working for a company that supports its staff attending these events.

However, there’s more to be done at a conference than (just?!) attending, listening, networking, and learning, and I’ve recently been appreciating the importance and the satisfaction of directly contributing. This means that our usual conference wrap-up post is going to be a little different this time, given I didn’t manage to actually attend many talks at all!

On 24^th June 2023, I attended BSides Leeds as a conference volunteer. I had signed up for this several months before, and had dedicated the odd morsel of time here and there to tasks passed on by the conference organising team. As regards the event itself, my weekend looked something like this:

Friday

14.30: Leave Glasgow (sharing the car with two other volunteers and an attendee)

19.00: Arrive in Leeds

19.30: Attend pre-event social gathering

Saturday

01:00: Arrive back at hotel after social gathering

06.00: Go for an optimistic but probably ill-advised run with another volunteer

07.30: Leave hotel

08.00: Arrive at venue to don volunteer garb and to help with outstanding setup

09.00: Attend opening remarks

09.30: Attend opening keynote (Holly-Grace Williams discussing red teaming)

10.00: Complete general runner duties – setting out biscuits for the coffee break, retrieving items, retrieving people

12.30: Have a quick lunch (accompanied by an excellent brownie)

13.00: Complete Green Room duties – providing a secure space for speakers’ personal belongings, helping settle speakers before their sessions, (unexpectedly) helping teams obtain scavenger hunt items

14.30: Go back to being a runner – more biscuits, more retrieving items and people, undertaking critical missions (finding coffee for tired speakers)

16.45: Attend final panel session, juggled with the theme of the day – retrieving items and people

17.30: Attend closing remarks

17.45: Point attendees in the direction of the afterparty

17.46: Frantically tidy up in the few minutes left before the venue closure

18.00: Say hello to attendees at the afterparty

19.15: Begin the drive back to Glasgow

21.30: Stop at M6 services for expensive fuel (for both car and people)

Sunday

01.15: Arrive home, having deposited other car-occupiers in various locations

Being a volunteer essentially guarantees an incredibly busy day with not a lot of downtime. I managed to tot up almost 14k steps during the event, and only saw the opening keynote and part of the final panel. However, this doesn’t mean it’s not an amazing experience. Seeing attendees having a great time, an appreciative nod from a tired organiser or presenter as you silently pass them a coffee during a session, the volunteers’ WhatsApp group exploding with messages because something is needed and everyone is leaping to help – these things all mean you have an absolute blast and have the additional satisfaction of knowing: you helped make this happen. I would wholeheartedly recommend volunteering to anyone who just enjoys getting stuck in.

And then SteelCon… that was a different kettle of fish entirely. When I finished my academic endeavours and embarked on a publishing career, I swore to myself I wouldn’t ever put myself back in a position where public speaking was required. And then I came to cyber security and actively sought it out.

My application to speak at SteelCon was accepted, and I duly made my way there for the conference on 8^th July 2023. I’m not afraid to say that I was extremely, extremely nervous. I’m not a natural public speaker and, while my experience from academia was that fully scripting a talk was the norm, my foray into cyber security presenting would involve speaking with only a few Presenter Notes against my slides. In fact, I was so nervous that I couldn’t attend anything in the morning beyond the opening remarks, because I needed to try and calm my nerves through mindless repetitive action (playing Space Invaders at a sponsor’s stall).

My talk (about effective communication in cyber security) seemed to go well, with lots of positive feedback, and after the lunch break I was finally able to attend some talks. First, I went to Maya Boeckh’s talk on how creating JavaScript challenges for Capture the Flag events has helped them with reverse-engineering. This was a highly technical talk, and I’m not ashamed to say that aspects were far beyond my coding capabilities, but Maya had structured their talk carefully and in such a way that anyone, possibly even someone with no coding knowledge whatsoever, could follow their logic.

I then saw Ian Thornton-Trump speak on “Good, Better & The Best Security!”, which was a passionate and important discussion about how security controls can and should fit within an organisation. Ian is a really excellent speaker and this was a highly engaging and entertaining talk about compliance, controls, and context.

And, aside from closing remarks, that was all I saw. The nerves and adrenaline of giving my own talk had really taken it out of me, and, although I did attend the afterparty for a couple of hours, I was honestly ready for bed from partway through the afternoon. But I really enjoyed it. I felt good about the talk I gave and the feedback I received, and I loved that, after attending my first SteelCon in 2022, I was able to actually contribute to it in 2023. I loved that aspect to such a degree that, despite loudly proclaiming to fellow SteelCon attendees that they had witnessed my first, last, and only presentation, I applied to speak at G3C (to be held at Glasgow Caledonian University in November 2023) only a couple of weeks later.

Am I sad that I saw barely any talks from Leeds and SteelCon? Yes. But! YouTube is a wonderful thing. Cooper (@ministraitor on Twitter/X) manages, with the support of a small team, to record the talks at a huge array of conferences, meaning you can catch up online afterwards. And while I didn’t see the talks on the day, it’s been really lovely over the last few weeks to spend a lunch break or a random hour at a weekend revisiting the events and seeing what I missed at the time.

If you’re interested in copying me and spending your spare time seeing the honestly brilliant offerings from these events, check out their YouTube channels (BSides Leeds and SteelCon).

And if you’re interested in copying me and volunteering or speaking at one of these events, please please do. I can assure you that you won’t regret it.

Attending conferences is a crucial way our staff can keep up to date with cutting-edge research, be introduced to important new ideas and perspectives, and help inspire and support the next generation of cyber security professionals. Our ID Cyber Solutions Conference Report series aims to showcase some exciting and ground breaking ideas presented at these events.

Report by Alice, Cyber Essentials Assessor and Technical Editor

On Thursday 11th May, Ahmed, Steve, and I attended the 6th International Conference on Big Data, Cybersecurity and Critical Infrastructure, organised by Basil (Vassilis) Manoussos (Manager of The Cyber Academy, Edinburgh Napier University) and held at Edinburgh Napier University. Attendees largely consisted of industry professionals and academics, with a small number of students also in attendance.

After the official opening and a welcome from Cllr Robert Aldridge, Lord Provost and Lord Lieutenant of The City of Edinburgh, we heard from Prof. Nikos Antonopoulous, Deputy Vice Chancellor at Edinburgh Napier, who spoke about the current state of security research and where he saw future attention being focused.

We were then introduced to Becky Pinkard (MD of Global Cyber Operations, Barclays) who spoke about ‘The Evolution of Cybersecurity Operations’. After pointing out that ‘security is being brought to the boardroom’ in the US, with a predicted 40% of boards to have dedicated cyber security committees by 2025 according to Gartner, she spoke about the future security landscape and what she thinks will feature. Finally, she spoke about ways organisations can work to protect themselves — for example, knowing your technical estate, mapping defence capabilities and needs against business risk to inform priorities, and holding more technical expertise at leadership levels as technical complexity evolves (but not at the cost of organisational maturity). Last, but by no means least, Becky highlighted the importance of diversity in hiring and of creating, nurturing, and maintaining a great organisational culture.

Prof. Berk Canberk (Edinburgh Napier University) presented research on ‘Digital Twins: A New Frontier in Infrastructure and Digital Innovation’. He outlined potential future uses for this technology that included trialling changes to processes at offshore oil plants and personalising medical approaches, in all cases helping eliminate or reduce risk since the impacts of changes would be better understood.

Next, Don Smith (VP Threat Research, Counter Threat Unit, SecureWorks) spoke about ‘Big Data, Cybersecurity & CNI’. This talk largely presented confidential and heavily redacted stories, but I particularly enjoyed this quote: “Most incidents are like being called out to deal with a deer that’s been hit by a car, but it was hit 5 weeks ago, is a bit whiffy, and half of it’s been eaten by a badger.”

We then heard about ‘Realistic Cyber Security in 2023’ from Rory Alsop (Head of Information Security and Cyber Risk, Tesco Bank). Rory spoke about businesses’ competing priorities and how cyber security needs to be implemented realistically, supporting businesses to conduct operations in a way that balances risk alongside cost and opportunity. He highlighted the industry need for people who can communicate, understand risk, and are flexible, and for solutions that fit within businesses’ existing structures and aims.

Next, Mark Cunningham-Dickie (Senior Incident Responder, Quorum Cyber) spoke on big data and artificial intelligence in incident response and digital forensics. He pointed out that IR is constantly evolving, with detection and defence mechanisms becoming faster and more effective, but attacks are also evolving. He argued that incident responders will need artificial intelligence to help respond to incidents, and that incident response and digital forensics will need artificial intelligence and machine learning specialists. He finished by predicting that the next big global cyber event will contain at least an element of artificial intelligence or machine learning.

An Industry Experts Panel — comprising Tim McNulty (Barclays), Becky Pinkard (Barclays), Don Smith (SecureWorks), and Harry McLaren (SenseOn) — was next, chaired by Prof Bill Buchanan (Edinburgh Napier University). The panel answered questions posed by the audience, including whether artificial intelligence could replace humans and how to counteract deep fakes.

The next section of the event was devoted to Critical Infrastructure. First, Prof. Sokratis Katsikas (Norwegian Center for Cybersecurity in Critical Sectors (NORCICS), Norwegian University of Science and Technology (NTNU)) treated us to an overview of NORCICS and its focus as he presented on ‘Industry-research, public-private, and cross-sector partnerships for the secure digitalization of industry’, showing how NORCICS’ work is fully aligned with national strategy.

Next, Prof. Leandros Maglaras (Edinburgh Napier University) spoke about protecting critical infrastructure, including current challenges and solutions, and discussed such topics as how Android malware can bypass MFA on banking applications.

Last in this section, Elzbieta Momola (SGN) spoke from a gas perspective about the challenges in protecting critical national infrastructure, highlighting the need for different methods in IT and OT environments and the skills gap that affects the industry.

The final section of the event focused on Law, Data Protection, and Compliance. First we heard from Laura Irvine (Partner and Head of Regulatory Law, Davidson Chalmers Stewart LLP) who gave a really engaging talk focusing on the regulation of automated decision making. She presented a thorough rundown of the proposals for change to the regulation under the Data Protection and Digital Information (No 2) Bill, peppered with her own thoughts on effectiveness and motives.

Next, we heard from Alexandr Chernykh (Advocate, Official Representative of Ukrainian National Bar Association) who spoke on ‘Digital Reality in Ukraine – Practice, Theory, Law and Procedure’. Alexandr discussed the heavy reliance on smartphones and face ID in Ukraine and gave an overview of the state services portal – an application that stores a user’s official documentation (including ID card, driver’s license, and international passport) and in which they can carry out official procedures (e.g., registering as self-employed, controlling power of attorney, submitting tax declarations). He also shared information about the e-court and e-cabinet, which enable legal parties to perform a range of duties and tasks including viewing cases and conducting online hearings. He pointed out that such capabilities are useful because of the size of the country and the deficit of advocates in some regions.

The final talk of the event was delivered by Prof. Bill Buchanan (Edinburgh Napier University), who spoke on ‘AI, Privacy and Trust within Cybersecurity: Sinners or Saviours?’. Bill discussed the evolution of technology, remarking that we are now entrapped by our phones (in an interesting juxtaposition with Alexandr’s presentation), and the current abilities of machine learning. I particularly enjoyed the theatrical style of this talk, with Bill blending his content with both music and film.

Our thanks to the organisers and speakers! We look forward to next year’s event.

Terms like 'Big Resignation', 'Big Quit', and 'Great Reshuffle' are commonplace on social channels; a great deal has been discussed and written about around the recent movement of employees.

The mass exodus is a post-pandemic trend primarily driven by job dissatisfaction; the most common reasons cited are wage stagnation compounded by the rising cost of living, lack of opportunity for advancement, and inflexible hybrid or remote working options. Whatever the reason, it is clear that many people are taking stock, assuming control, and making adjustments that suit their desired work-life balance.

The theory is excellent, but what if you're in a job that you genuinely don't enjoy any longer but are not qualified to do much else? Many people would like to make career changes, but they need to maintain the salary levels to which they've become accustomed. Retraining and starting at the bottom is not a viable option. But is there an option?

One of the best ways to make a career change that can maintain your lifestyle whilst providing the challenge you crave is to look at new and emerging sectors; cyber undoubtedly falls into this category, and the demand for qualified people grows daily. What's more, skilled people working in cyber can command good money and, in many cases, work for themselves and do the hours that suit them.

It may seem that your current role is a million miles from a role in cyber, but there are many facets to the work, and more than likely, there will be an area that lends itself to your experience and skillset; Cyber Security Technician, Ethical Hacker, Network Defender, and Digital Forensics Specialist are all job titles you will see with increasing regularity in the future, and you'd be surprised at how your current skills and experience can be adapted to such roles.

Indeed, some of the most senior people in cyber security did not set out in cyber security. For example, in episode 12 of CyberVersed, the podcast published by the National Cyber Resilience Centre Group, Microsoft's Chief Security Advisor, Lesley Kipling, and Chief Security Advisor - UK Partners, Jonathan Davies, both explain they started their working life doing entirely different jobs. In Jonathan's case, he began as an engineer in electrical electronics before moving into science metallurgy and then into cyber security. Both go to great lengths to encourage everyone to explore a cyber career.

Much closer to home, team members here at ID Cyber Training have come into cyber from other careers. Gary and Ahmed both worked in IT before moving into cyber security. However, others are now following much more diverse paths; Steve was a personal trainer, Keven was an electrician, and Alice was an editor in educational publishing. So, almost anyone can explore cyber security as a career option.

You might also be surprised at how easily you can retrain and gain the qualifications that are increasing in demand. ID Cyber Training offers extensive training and certification, and many people attending these courses are doing so because they want a different career with better opportunities. Many who have completed their training now enjoy better pay, increased job satisfaction, and genuine appreciation. Still, the primary benefits are total control of their work-life balance and being part of a thriving and in-demand cyber community.

We are excited to announce our Global Operations Director, Cary Hendricks, will be one of the speakers at the upcoming 'Know Your Cyber' event at the HALO Enterprise and Innovation Centre, Kilmarnock, on 2nd March.

The event forms part of 'Cyber Scotland Week', a programme of events across Scotland designed to make businesses, organisations, and individuals more cyber-aware and resilient. 

Cary's talk is entitled 'Creating a Culture', where he will offer advice on making cyber part of the everyday conversation in the workplace. Cary is no stranger to the speaker's podium, having spoken at many events worldwide; however, he relishes the prospect of addressing an audience here in Scotland.

Speaking about the event, Cary commented: "I'm delighted to have been invited to participate at the 'Know Your Cyber' conference. People like me and businesses such as ID Cyber Solutions need to share their experience and knowledge to raise awareness of the increasing threat of cyber attacks.

"Every business must address the topic and know the threats, and they need to have the plan to deal with any attack. It starts by creating a culture where cybercrime is at the forefront of decision-making and business operations. If I can help more business owners appreciate this, I am delighted to do so."

Other experts speaking on the day include Douglas McLachlan, Partner at Anderson Strathern, who will explore the legal implications of cyber attacks and personal data breaches, and Ged Freel, Head of Business & Computing at Ayrshire College will highlight opportunities for individuals and employees to follow careers in the cyber world.

Dr Marie Macklin CBE, Founder and Executive Chair at HALO Urban Regeneration Co. comments on the event, "Tech, Digital and Cyber are at the heart of HALO and in a fast-paced world where technology is changing how we start, grow, and scale our businesses we need to be aware of the cyber challenges we face. This event, part of Cyber Scotland Week, will allow the business community to come together and hear from our speakers who specialise in the industry, helping us all know our cyber. I hope you can join us for a great event on the HALO #RockMe Trading Floor."

If you'd like to come along and hear Cary and the other cyber experts share their knowledge, you can sign up for 'Know Your Cyber' event here.

#RockTogetherIn2023 | #EventsThatMatter

Attending conferences is a crucial way our staff can keep up to date with cutting-edge research, be introduced to important new ideas and perspectives, and help inspire and support the next generation of cyber security professionals. Our ID Cyber Solutions Conference Report series aims to showcase some exciting and ground breaking ideas presented at these events.

Report by Alice, Cyber Essentials Assessor and Technical Editor

On Saturday, 5th November 2022, I attended G3C, a student-run conference at Glasgow Caledonian University, now in its second year. 250 tickets were sold for the event, with attendees including industry professionals, recent university graduates, current students, and interested members of the public.

The conference ran four separate tracks—three presentation tracks and a workshop track focusing on lockpicking—so I could not attend every talk. However, the track in the main auditorium was live-streamed and uploaded to YouTube so that I could catch up on a few of the missed talks after the event. After an introduction from Dominik Hanlon (president of the Glasgow Caledonian Ethical Hacking Society), I made my way to Scott McGready's talk 'There's a hole in your bucket'. Scott revealed that one of his hobbies is 'bucket-hunting'—checking online repositories (like AWS S3 buckets) that companies or individuals have made publicly available and alerting the company if the data contained within should be privately stored. He provided several examples of buckets, freely searchable by the general public, that included HR phone call recordings, passwords and credit card information, and private email conversations before going on to advise on bucket security, how researchers can responsibly disclose that a company's data is freely available, and how a company could best respond to a disclosure.

Next, I attended Gemma Craig's talk 'Nursing to cyber security'. After 14 years as a nurse, Gemma transitioned into a career in cyber security, including roles in the SOC (Security Operations Centre) and Incident Response. She highlighted the significant similarities between her nursing and cyber security careers, helping her audience see the value of transferable skills and understand how someone with a seemingly different professional background can quickly pick up critical cyber security skills. This was a very engaging talk, full of personal touches and good humour, and it helped me think of additional ways to explain technical ideas to those who don't work in a technical field. Dave McKenzie followed Gemma with a presentation on 'Digital Deception'. This talk encouraged the audience to consider the usefulness of honeypots and canary tokens and how to add them effectively into a network, helping companies quickly identify when an unauthorised individual (whether external or an insider threat) has accessed the system. Using a live demonstration involving the audience and a series of QR codes, Dave showed how easily canary tokens could be set up and the information they could pass to the token owner. This was undoubtedly a talk that made the audience think about the security of their networks and ways to protect them better.

After the lunch break, I attended Sean Wright's presentation on 'Software supply chain woes', which pointed out security issues resulting from using existing libraries or packages in applications. Sean showed how some packages contained vulnerabilities yet were still incorporated, unchecked, into large numbers of applications—a talk of interest to anyone relying on pre-built libraries or packages, anyone using plug-ins, or anyone asking third parties to develop applications for them.

Andy Gill's closing keynote, 'Expanding your horizons', comprised a whistle-stop tour through his cyber security career, including tips and tricks on avoiding burnout and career progression (and an array of impressive photographs, the hobby being one of his ways to avoid burnout). The talk was very well-received by current or recent students in the audience hoping to begin in the industry on the right footing and was a fitting end to a student-led event.

After the event, I took the opportunity to use the YouTube recordings to catch up on one of the talks I missed—Gerard Barrett's 'To SOC Analyst... and Beyond!'. Gerard, like Gemma, discussed his transition into cyber security from a different industry (in his case, fraud investigation). However, the two talks had very different focuses, making them equally valuable. My main takeaways from Gerard's presentation were the various ways that the cyber security community had shaped his career path, with a vast number of people offering him a wealth of friendly support and advice, and how he built his knowledge through the use of different online courses.

Other scheduled talks that I wasn't able to attend were:

▪ David Edwards—The Darkness of Powers Hell (Powershell Abuse)

▪ Rory McCune—Wonder the world of container security

▪ Petros Wallden—Cyber Security In The Quantum Era

▪ Fred Crowson—Openbsd secure operating system for everyone

▪ Joshua Brown—"Kind of Blue" Working in SOC

▪ Eliot Bolster—Demo-Democracy Directly Doomed

Thanks to G3C and all the speakers for a fun and informative conference, and I look forward to using my new knowledge and ideas to support ID Cyber Solutions' customers better.

Is the ever-growing threat of cyber attacks, along with a scarcity of cyber-skilled workers, a cause for concern for your business? If so, the solution may be closer than you think…

Your own workforce! 

Enrich and strengthen your business cybersecurity by nurturing employees who show enthusiasm and desire in improving their skill set and attaining industry-recognised certifications.

Why Should You Focus on Developing a Cyber-Aware Workforce?

With the advancement of technology, cyber criminals are becoming more sophisticated and destructive. In 2021, cybercrime cost medium to large businesses an average of £19,200. You may feel that you're fully protected with premium security systems in place but, without thorough employee training, you may be fighting a losing battle. Your employees are critical to your company's daily operations, and it's paramount they understand how to deal with impending threats.

What are the Advantages of a Cyber-Aware Workforce?

We’ve outlined below the three main advantages of developing and upskilling your workforce and how this can be achieved through our robust training courses and certifications.

Increase individual resilience to cyber threats

Human error is without a doubt one of the most serious security threats to businesses, accounting for 82% of security breaches. Human errors can be split into two categories: skill-based and decision-based. Skill-based errors are minor mistakes which are caused by “distracted” employees, while decision-based errors are caused by a lack of knowledge. With robust training, you can transform your workforce from a security liability to a security asset.

Drive retention of highly valuable employees

With the shortage of cyber skills having more than doubled from 23% to 51% since 2014, the stakes are considerably higher when it comes to employee retention as businesses are continuously searching for and poaching talent to fill their gaps. If you’re fortunate enough to have acquired top talent, you’ll want to stay tuned in.

Employee retention is often significantly greater in businesses that support and encourage ongoing education and development. By actively offering development opportunities to each team member and allowing them to select professional training that they believe best matches and maximises their potential, you’re creating a loyal workforce to be reckoned with.

A more skilled, confident, and knowledgeable workforce

When resilience and retention are combined, you will benefit from a workforce that is considerably more skilled, confident, and knowledgeable in safeguarding your business from damaging cyber attacks. Our courses not only equip participants with effective knowledge and skills, but also ensure attendees leave with a sense of empowerment.

Why Choose ID Cyber Training UK for your Cyber Training Solutions? 

Here at ID Cyber, it is our promise to guarantee the highest standards of integrity in the industry, carrying out the most beneficial cyber education in a constantly changing environment. Through cyber training and certification, we’ll provide the professional knowledge to protect your company from cyber attacks from opportunistic criminals, counterfeiters, fraudsters, employees, and other sources.

Throughout the year, we offer a variety of specialised cybersecurity courses hosted by world-renowned industry professionals.  

Click to view our 2023 schedule and how you can register. Early booking is advised as spaces are limited.

Contact us

If our course dates collide with your business agenda, please click here to contact us and one of our specialists will be in touch to discuss your availability.