STE WILLIAMS

SophosLabs is at the center of Sophos. It’s the place where highly skilled experts in the field work round the clock to build protection from the latest threats.

But who works there?

This week we’re talking to Vincent Lynch, Senior Threat Researcher from SophosLabs UK.

I grew up not so far away from SophosLabs UK, in Milton Keynes. I spent eight years at Warwick University. I finished a PhD in mathematics, with no great desire to stay in academia, but no real plans to do anything else.

After a few weeks poring through endless job adverts, the opening of ‘virus researcher’ jumped out at me. It just so happened I’d taken an interest in assembly language for a bit when I was younger, so I could convincingly argue that I’d have the patience to trawl through binary code, byte by byte, working out exactly what it’s doing.

I started at Sophos in 2004, and I spent my first five years here analysing viruses and spam, and really getting into every aspect of the work I could – writing generic detection rules, analyzing encryption routines used in obfuscating executable files, working out how to undo the damage malware has done to a system, and training new recruits to do all of these things.

About five years ago, there was an opportunity for someone to focus on testing the core virus scanning engine – in particular someone familiar with malware, and also with VDL, the ‘Virus Description Language’ Sophos uses to write the detection updates we publish several times a day. I volunteered to do this for six months, and five years later testing is still essentially what I do.

I work closely with the threat researchers, but also with the engine developers and QA engineers, ensuring that Sophos Antivirus has the low-level features the researchers need to do their job, and that it all works as required.

Outside of work, I’ve taken up music quite seriously in recent times, playing guitar, bass, drums, violin, mandolin, and a few other things. None of them to any great standard, but well enough to get by playing in a few local bands over the years. I’ve also been taking classes in improvised comedy, but it’ll be some time before I’m doing that in front of a paying audience.

What about the future of security?

With children using sophisticated technology from a very early age, people are surely going to become more security-aware, and have higher expectations of security from others, and from companies that store their information.

It would be good to see application developers favouring open file formats for document files, with more built-in validation. There’s a lot less scope for vulnerabilities if everyone agrees to simply not load files that don’t conform to a standard.

At the same time, criminals are only going to work harder to trick people or work around software security.

My top security tips?

A lot of security isn’t about right or wrong ways to do things, it’s about being aware of the risks you’re taking. It’s incredibly convenient having all your data available at the touch of a button, but that one bundle of data is also very valuable to anyone else who can get hold of it.

It’s scary how often proving your identity comes down just to knowing your date of birth, your address, or your mother’s maiden name – maybe not your closest guarded secrets. You’ll probably let your birthday slip to someone at some point, but maybe you don’t need it on your Facebook profile.

Do you really need to have your credit card details saved on your phone? Perhaps you do – but if so, you’d better keep your phone locked with a decent password or keycode. And always question why anyone else needs your information, particularly over the phone or email.

Want to know more about SophosLabs?

Read the other articles in this series on Rowland Yu, Peter Szabo, Numaan Huq, Joanne Garvey and James Wyke who all work at SophosLabs, check out our YouTube playlist, or see more on the Sophos website.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/hANYvrq1jmo/