CYBERUK 2023

### Overview This session represents the final plenary and closing proceedings of CYBERUK 2023, hosted in Belfast, Northern Ireland, and led by National Cyber Security Centre (NCSC) CEO Lindy Cameron. The event features an excerpted interview with tech pioneer Hermann Hauser, a speculative dystopian video depicting an overwhelmed cyber ecosystem in 2033, an expert panel titled 'Fixing the Foundations', the Cyber Den startup pitch competition awards, and formal closing remarks reflecting on the conference and announcing Birmingham as the host city for CYBERUK 2024.

### Key Topics - **Fixing the Foundations & Memory Safety:** The session emphasizes moving past reactive patching to embed security directly into fundamental hardware and software design, specifically tackling long-standing memory safety issues. - **Market Pull vs. Vendor Push:** Panelists debate the economic and supply chain barriers to adopting secure-by-design architectures, noting that creating widespread commercial demand across large industries is essential to drive unit costs down. - **Securing 'Hard Tech' and Global Supply Chains:** A significant portion of the discussion addresses heavy engineering, defense, nuclear, and aerospace sectors, where massive digitization and multinational supply chains vastly expand attack surfaces. - **Innovation and Startup Ecosystem:** Highlighting early-stage innovators addressing practical problems through the Cyber Den competition and showcasing Northern Ireland's cyber ecosystem.

### Technical Details - **Foundational Architecture and Memory Safety:** Panelists highlighted that approximately 70% of exploitable vulnerabilities originate from memory safety flaws such as buffer overflows. Discussion focused on the UKRI-supported Digital Security by Design (DSbD) program and Arm's prototype Morello chip, which incorporates CHERI (Capability Hardware Enhanced RISC Instructions) technology developed by the University of Cambridge and SRI. - **Formally Verified Software:** Hauser noted proof theory achievements in operating systems, highlighting seL4 as a proven-correct microkernel, contrasting it with the broader challenge of securing the estimated three trillion lines of code written over the last two decades. - **Hard Tech Digitization:** Small Modular Reactors (SMRs) and jet engines involve extensive IT integration, including 100,000-core computing clusters for simulation, digital twinning, IoT pallet tracking, and the full codification of manufacturing methods across millions of parts (e.g., 30 million codified parts in an SMR and 36,000 components in a jet engine). This codification risks theft of proprietary manufacturing techniques across tiered global suppliers. - **Cyber Den Technologies:** Pitch finalists included Visible (managing digital footprints), Sightec/Sight Hop (low-latency hardware-enforced encryption for high-speed data links), and the winning startup ITUS Secure Technologies (aggregating third-party risk assessments to enable cyber insurance underwriting).

### Takeaways - **Demand Generation Over Pure Technology Push:** Proving secure hardware concepts requires building multi-industry demand—combining defense, telecommunications, and hyperscalers—to make secure chips economically viable for consumer hardware. - **Broader Sector Engagement:** The cybersecurity community must actively engage hard tech, heavy engineering, and manufacturing CIOs rather than remaining an isolated deep-tech echo chamber. - **Proactive Implementation:** Organizations cannot wait for future crises or slow regulatory mandates; requirements for secure-by-design capabilities must be written into systems procured today for deployment in the 2030s.