Cyber Security CDT Phase Two (University of Oxford)

This proposal is for a renewal, following a successful first phase, of the Oxford University CDT in Cyber Security. The CDT is presently in its third year of operation, and has recently admitted the third (and final) cohort funded under its initial grant. (EP/K035606/1) Following a very positive external review undertaken in summer 2015, we propose to continue its operation on a similar pattern to that which has been established, and in this proposal request funds to support a further three intakes of cohorts.

We set a broad scope for the CDT initially - in some ways transcending the original scope from the call, whilst retaining its core focus on the technical domains originally identified as our strength. Our research programme was intended to focus on (but not be entirely exclusive to) four key themes:
- big data security
- assurance
- cyber-physical systems
- real-time security

The themes are deliberately broad - designed to help form ideas, not to constrain them - and so we expect the great majority of student projects to fall into these areas. We are mindful that the community's understanding of cyber security continues to evolve, and so will continue to review of the CDT's emphasis and scope, guided by our Advisory Board, Sponsor Representatives, and our internal Academic Board.

It is part of the nature of Cyber Security - and a key reason for the urgency in developing new research approaches - that it now is a concern of every section of society, and so the successful CDT will have a very broad impact indeed. We will ensure impact for:

* The IT industry; vendors of hardware and software, and within this the IT Security industry;

* High value/high assurance sectors such as banking, bio-medical domains, and critical infrastructure, and more generally the CISO community across many industries;

* The mobile systems community, mobile service providers, handset and platform manufacturers, those developing the technologies of the internet of things, and smart cities;

* Defence sector, MoD/DSTL in particular, defence contractors, and the intelligence community;

* The public sector more generally, in its own activities and in increasingly important electronic engagement with the citizen;

* The not-for-profit sector, education, charities, and NGOs - many of whom work in highly contended contexts, but do not always have access to high-grade cyber defensive skills.

Impact in each of these will be achieved in fresh elaborations of threat and risk models; by developing new fundamental design approaches; through new methods of evaluation, incorporating usability criteria, privacy, and other societal concerns; and by developing prototype and proof-of-concept solutions exhibiting these characteristics. These impacts will retain focus through the way that the educational and research programme is structured - so that the academic and theoretical components are directed towards practical and anticipated problems motivated by the sectors listed here.