Featured Publications

New RISCS Policy briefing: a framework to assess evidence quality in cyber security policy making

We are thrilled to share our new policy briefing based on the Evaluating Cyber Security Evidence for Policy Advice” (ECSEPA) project led by Professor Madeline Carr (UCL) and Professor Siraj Shaikh (Coventry University). Civil servants across the UK Government are...

Cyber Insurance and Risk Management: Challenges and Opportunities

UCL gates in March 2020 A new playground for underwriters? Corporate boards the world over are scrambling to address the unique challenges of the COVID-19 global pandemic – particularly the impact of social distancing. In addition to the obvious problems this causes...

Talking about Security with Professional Developers

Tamara Lopez, Helen Sharp, Thein Tun, Arosha Bandara (School of Computing & Communications, The Open University) and Mark Levine (Department of Psychology, University of Exeter) and Bashar Nuseibeh (Lero – The Irish Software Research Centre, University of Limerick).

An Anatomy of Security Conversations in Stack Overflow

Abstract As software-intensive digital systems become an integral part of modern life, ensuring that these systems are developed to satisfy security and privacy requirements is an increasingly important societal concern. This paper examines how secure coding practice...

An Investigation of Security Conversations in Stack Overflow: Perceptions of Security and Community Involvement

Developers turn to Stack Overflow and other on-line sources to find solutions to security problems, but little is known about how they engage with and guide one another in these environments or the perceptions of software security this may encourage. This study joins...

Captchat: A Messaging Tool to Frustrate Ubiquitous Surveillance

Paul Dunphy, Johannes Schöning, James Nicholson, Patrick Olivier Abstract There is currently a widespread uncertainty regarding the ability of citizens to control privacy online in the face of ubiquitous surveillance. This is a huge and complex societal problem....

Do You Love Me? Psychological Characteristics of Romance Scam Victims

Abstract The online dating romance scam is an Advance Fee Fraud, typically conducted by international criminal groups via online dating sites and social networking sites. This type of mass-marketing fraud (MMF) is the most frequently reported type of MMF in most...

Hopefully We Are Mostly Secure: Views on Secure Code in Professional Practice

Abstract Security of software systems is of general concern, yet breaches caused by common vulnerabilities still occur. Software developers are routinely called upon to ”do more” to address this situation. However there has been little focus on the developers’ point...

Ransomware and Reputation

Abstract Ransomware is a particular form of cyber-attack in which a victim loses access to either his electronic device or files unless he pays a ransom to criminals. A criminal’s ability to make money from ransomware critically depends on victims believing that the...

Taking the Middle Path: Learning about Security Through Online Social Interaction

Abstract As software-intensive digital systems become an integral part of modern life, ensuring that these systems are developed to satisfy security and privacy requirements is an increasingly important societal concern. Integrating security into software development...

All Publications

Cyber Insurance and Risk Management: Challenges and Opportunities

UCL gates in March 2020 A new playground for underwriters? Corporate boards the world over are scrambling to address the unique challenges of the COVID-19 global pandemic – particularly the impact of social distancing. In addition to the obvious problems this causes...

Talking about Security with Professional Developers

Tamara Lopez, Helen Sharp, Thein Tun, Arosha Bandara (School of Computing & Communications, The Open University) and Mark Levine (Department of Psychology, University of Exeter) and Bashar Nuseibeh (Lero – The Irish Software Research Centre, University of Limerick).

RISCS Annual Report 2016

The RISCS Annual Report 2016 was released at the UK Cyber Security Research Institutes Conference in October 2016, and is available to download.

RISCS Annual Report 2017

The RISCS Annual Report 2017 was released at the UK Cyber Security Research Institutes Conference in October 2017, and is available to download here (opens PDF)

RISCS Annual Report 2018

The 2018 RISCS Annual Report was released at the UK Cyber Security Research Institutes Conference in October 2018, and is available to download here (opens PDF).

RISCS Annual Report 2019

We are delighted to present the 2019 RISCS Annual Report. The Report brings you progress updates of the RISCS projects, informs of recent changes at RISCS and shares our plans for 2020. Download the report here.

A Decision Making Model of Behavior in Information Security

Iryna Yevseyeva, Charles Morisset, Thomas Groß, Aad van Moorsel Abstract Information security decisions typically involve a trade-off between security and productivity. In practical settings, it is often the human user who is best positioned to make this trade-off...

A Formal Model for Soft Enforcement: Influencing the Decision-Maker

Charles Morisset, Iryna Yevseyeva, Thomas Groß, Aad van Moorsel Abstract We propose in this paper a formal model for soft enforcement, where a decision-maker is influenced towards a decision, rather than forced to select that decision. This novel type of enforcement...

A Tactile Visual Library To Support User Experience Storytelling

Makayla Lewis and Lizzie Coles-Kemp Abstract This paper presents an adult visual narrative stimulus (tactile visual library) that supports the reduction of physical distance between the user-centred design practitioner (maker of the visual narrative artefact) and the...

A Year is a Short Time in Cyber-Space

Date: June 2014Published: Industry & Parliament Trust Report: Cyber Security 2.0: Reflections on UK/EU Cyber-Security Co-OperationPublisher: Industry and Parliament TrustPublisher URL: http://www.ipt.org.ukFull Text:...

Adding Insult to Injury

Jennett, Charlene; Brostoff, Sacha; Malheiros, Miguel; Sasse, M. Angela Abstract: To inspire confidence in consumer credit and improve outcomes for consumers, negative experiences such as being denied credit must be handled appropriately. We conducted an online survey...

Addressing Consumerisation of IT Risks with Nudging

Iryna Yevseyeva, James Turland, Charles Morisset, Lynne Coventry, Thomas Gross, Christopher Laing, Aad van Moorsel Abstract In this work we address the main issues of Information Technology (IT) consumerization that are related to security risks, and vulnerabilities...

An Anatomy of Security Conversations in Stack Overflow

Abstract As software-intensive digital systems become an integral part of modern life, ensuring that these systems are developed to satisfy security and privacy requirements is an increasingly important societal concern. This paper examines how secure coding practice...