Home / About
Professor of Information Security at Royal Holloway, University of London. An information security specialist by profession, with a background in computer science.
I joined the Information Security Group at Royal Holloway in September 2002 as a lecturer. I am now a full Professor of Information Security and Director of the Trustworthy, Embedded and Autonomous Systems Centre.
My research focuses on the security, trustworthiness and resilience of embedded, connected and AI-enabled autonomous systems. This encompasses trusted execution environments; embedded-device and cyber-physical-system security; resilient cloud execution; automotive, avionics and drone security; payment and transport systems; mobile platforms, NFC and secure elements; ambient sensing; and the Internet of Things.
Alongside my academic work I have acted as an independent consultant on NFC and smart card security, security protocol design and review, and chip migration programme management. Before academia I was a Senior Consultant at Steer Davies Gleave, advising transport operators and financial institutions on smart card technology, and a manager in multi-application smart card technology at Visa International.
I am actively engaged in innovation and commercialisation, and have developed and evaluated the commercial potential of three research-led projects — Seclea, PrineSec and TensorCrypt — through the Innovate UK CyberASAP programme.
I also served as co-secretariat for the All-Party Parliamentary Group on Cyber Security, and previously directed the Royal Holloway Transformative Digital Technologies, Security and Society Catalyst.
Education
School of Business and Management, Royal Holloway, University of London
Royal Holloway, University of London — Secure Logging Mechanisms for Smart Cards
Royal Holloway, University of London
Lancaster University
Consultancy
Alongside my academic work I advise industry through Royal Holloway Research and Innovation. I first took on information security consulting while completing my PhD, and have since led teams of Information Security Group consultants on high-profile projects for financial institutions, transport operators and technology integrators. These are the areas in which that work is normally commissioned.
Physical and logical security analysis of smart cards, secure elements and embedded platforms, including Common Criteria evaluation and the drafting of Security Targets and Protection Profiles.
Independent design, analysis and review of authentication, payment and provisioning protocols before they are committed to a deployment.
Structured assessment of the technology, protocols and operational processes on which a deployed system depends, and of what an attacker would reach first.
Migration strategy, business case development and programme management for banks, card schemes and transport operators.
Security of mobile handsets, secure elements, trusted execution environments and the NFC services built on them.
Contactless smart card, RFID and MIFARE deployments, and the transport ticketing infrastructure that relies on them.
Java Card, SIM and MULTOS application review, design and development, where the platform leaves very little room for error.
Protection of AI models, data and decision-making in embedded, connected and autonomous deployments, and the attestation that makes their behaviour checkable.