Nalin Arachchilage

Lecturer in Cyber Security
UNSW

Dr Nalin Asanka Gamagedara Arachchilage currently works as a Lecturer in Cyber Security at the University of New South Wales (UNSW at the Australia Defence Force Academy, Australia). He holds a Ph.D. in Usable Security entitled “Security Awareness of Computer Users: A Game-Based Learning Approach” from Brunel University London, the UK where he developed a game design framework to protect computer users against “phishing attacks”. Prior to undertaking his current position at UNSW, he worked as Research Fellow in Usable Security and Privacy in the Laboratory of Education and Research in Software Security Engineering (LERSSE) at the University of British Columbia (UBC), Canada. Before moving to Vancouver, he was a Postdoctoral Researcher in Systems Security Engineering in the Cyber Security Centre, Department of Computer Science at Oxford University. Nalin has presented his research at Facebook Headquarters, Menlo Park, California, USA and collaborated with HP in a research capacity at the HP Lab, Bristol, UK. His research has been featured in numerous media outlets including ABC News Radio, SYN Radio 90.7 FM, Sky News Australia, Daily show on Radio 2SER 107.3, Choice - Australia, Guardian labs (sponsored by Intel Corporation, Australia) and UNSW TV. He has been an invited speaker for conferences both nationally and internationally. Nalin worked on a number of academic positions in Computer Science at Brunel University, University of Bedfordshire, Westminster University and Central Bedfordshire College in the UK. Before moving to UNSW, he briefly worked as Sessional Lecturer in Computer Science at Deakin University, Victoria University and Central Queensland University (CQUniversity) in Melbourne, Australia. Nalin is a Sun Certified Java Programmer (SCJP) at Sun Microsystems (now Oracle), USA. He is also a professional member of Association for Computing Machinery (MACM), the Institute of Electrical and Electronics Engineers (MIEEE) and the Australian Computer Society (MACS). Apart from his academic career, he also worked on a number of software engineering roles ranging from Programmer, Software Engineer to IT Manager.

Check out the incredible speaker line-up to see who will be joining Nalin.

Download The Latest Agenda

Pre-Conference Intensive Workshops: Monday, 26 November 2018

Monday, November 26th, 2018

1:00 PM Achieving a Digital Stranger Danger Mentality by Heightening the Basic Cyber Skills and Awareness Standards across Departments

In 2017 the Australian Cyber Security Centre reported that 90% of 113 organisations surveyed (including 45 Government organisations) experienced phishing and social engineering as the most common form of attack in attempted security breaches.

Making basic cyber practices second nature and consistently improving staff awareness and skills can improve stakeholder confidence, minimises system interruptions, and potentially other ancillary benefits including breach prevention. Creating a strong security culture and behaviour locks the front door to the most common malicious breaches and is essential in achieving a secure system.

The essential security check list for all levels of workers within departments and organisations to make basic security prevention a behaviour
Strategies in providing detection skills and awareness training in a resourceful and effective way – virtual training programs and educational suites
Bridging the skills gap during digital transitions and up-skilling capability in responding to cyber threats
Establishing a successful business case to influence leaders in uplifting department skills beyond technical expertise

Conference Day One: Tuesday, 27 November 2018

Tuesday, November 27th, 2018

2:20 PM PANEL DISCUSSION: Examining the Cloud as a Divergent Digital Landscape Instigating New Security Risks for Data

Government departments and agencies are trending towards aggregation critical systems. Unlike on premise data storage, the cloud produces a superior capacity, greater savings, convenience and increased data access flexibility. However, cloud services have created a systematic economic risk which requires reliance on vendors as a second party supply chain; reducing data control. Subsequently, a new environment requires new methods of defence.

Exploring vendor inspection frameworks to ensure a trustworthy and secure cloud solution.
Defining cyber security risk management and insurance as cloud service providers are not accountable for breaches.
Exploring cloud innovation and encouraging staff to have a positive attitude and active training participation towards the cloud.

3:30 PM CASE STUDY: Developing a Threat Model for Organisations through a Gamified Approach to Thwart Phishing Attacks:

A recently published threat report from Australian Cyber Security Centre has revealed that phishing is still one of the dangerous cyber-crimes to both individuals and organisations. Automated antiphishing tools have been developed and used to alert users of potentially fraudulent emails and websites. However, these tools are not entirely reliable in detecting phishing attacks, missing over 20 per cent of phishing websites because of the sensitive trust decisions made by humans during their online activities. It is not possible to completely avoid the end-user, one mitigating approach for cyber security is to educate and train the end-user in security prevention. Therefore, the aim of this research proposal focuses on designing and developing a serious game to educate individuals about online identity theft (phishing emails and URLs from legitimate ones).

Defining the proposed game which encourages users to enhance their avoidance behaviour through motivation to protect themselves from phishing attacks.
Analysing records of how users employed their strategies to differentiate phishing attacks from legitimate ones through the game and then develop a threat model understanding of how cybercriminals leverage their attacks within the organisation through the human exploitation.
The future use of the developed threat model an be used to develop countermeasures i.e. both technical and non-technical) and educational interventions to the organisation.