Teaching Crypto - How Students Learn Enough to Save the Day

Teaching Crypto How Students Learn Enough to Save the Day 1 • About me • What is crypto – Infosec – Blockchain (as gateway drug) • Why crypto important • Goal of teaching crypto to non-cryptographers • How we do it – Blockchains – Mixed class – CU course 2 2 1 About me: Laboratory for Experimental Information Security 3 3 About me: Research, teaching and commercialization of security-critical systems • Privacy-preserving technology • Zero-knowledge proofs • Privacy-preserving cryptocurrencies • Cryptography-based financial regulation compliance for blockchains • Teaching information security 4 4 2 “Crypto”? Cryptography and information security • Ensuring integrity of computation • Protecting privacy • Controlling the flow of information • Enforcing economic mechanism Cryptocurrencies and blockchains ← used for: • Decentralized, code-mediated architecture for finance • Reducing risks and inefficiencies of traditional finance and its intermediaries • Enabling new services and business models 5 5 Grokking cryptography and information security • technical foundations • risks and threats • mitigation technology and products • rigorous analysis Technical Business Legal • cost of attacks • cost of mitigation • capabilities and opportunities enabled • laws and regulations • compliance processes … all rapidly evolving 6 6 3 For computer scientists and engineers Technology and rigorous analysis come naturally, but… We teach “Information security = CIA” • Confidentiality • Integrity Technical • Availability Business • Compliance (not going to jail, adoption) – US HIPAA, EU GDPR, California CPA, Canada PIPEDA, Brazil GDPA, … • Market needs and realistic applications • Cost/benefit analysis • Legal/contractual alternatives to technical solutions Legal 7 7 For business folks • Security as an obstacle – So is gravity. • Security mindset is unnatural – “What are the chances this convoluted corner case will ever happen”? 100% when monetizable. Technical Business • Awareness of costs Legal 8 8 4 Average cost of data breach Excluding the cost of ransom [IBM, Cost of a Data Breach Full Report 2022] 9 9 Why data breaches are so expensive Detection and escalation Post breach response – Forensic and investigative activities – Assessment and audit services – Crisis management – Communications to executives and boards – Help desk and inbound communications – Credit monitoring and identity protection services – Issuing new accounts or credit cards – Legal expenditures – Product discounts – Regulatory fines Notification – Emails, letters, calls to the affected – Determination of regulatory requirements – Communication with regulators – Engagement of outside experts 10 Lost business – Business disruption and revenue losses from system downtime – Cost of losing customers – Reputation losses and diminished goodwill [IBM, Cost of a Data Breach Full Report 2022] 10 5 For business folks (cont.) • “We’ll worry about security it later” – Requires drastic, expensive, disruptive rebuilding+retraining – Corners will be cut, which will lead to attacks – Likely runs afoul of regulation Technical Business • Vendor snake oil – “our solution uses NIST FIPS-197 compliant AES-256” – Market for lemons Legal • Assume old way of doing things – Old costs and constraints – Example: TradFi → blockchain 11 11 For legal/compliance folks Paranoid mindset comes naturally… hackers Technical security • mathematical guarantees • system mechanisms • formal proofs, • technical audits 12 regulator/ lawsuits Legal compliance and risk management • letter of the law/regulation • best practices ... but different fears lead to different outlook. 12 6 Approach Build a comprehensive understanding Build focused expertise + enable effective collaboration Technical Business Common language across disciplines: • Key concepts • Key constraints • Recognizing red flags • Recognizing innovation opportunities Legal • Realistic expectations 13 13 Approach • Viscerally connect cross-disciplinary elements to core knowledge • Avoid the “blah blah visiting lecture, not on final exam” effect • Interdisciplinary elements in pertinent courses – Foundations – Case studies of applications and what cross-discipline challenges/opportunities they encounter • Mixed courses • “Holistic” mixed-discipline student projects 14 14 7 Example: Blockchains and their Applications course • “Crypto” as in blockchain is a perfect study area – Strong elements from all disciplines – Student motivation – Low barrier to real-world impact • Course covers blockchain technology from a systematic and interdisciplinary perspective, including: – core technical elements – business applications – legal, regulation and taxations 15 • Mixed-discipline course staff & guest lecturers • Student projects: Mixed teams design and build prototypes of blockchain-based applications. “Holistic” analysis expected and graded. 15 8