Starting my PhD at the University of Glasgow

I have recently started my PhD at the University of Glasgow. It has been an exciting beginning, and I want to use this blog to document the work as it develops.

My interests sit around cybersecurity, operational technology and the resilience of connected energy systems. The PhD has not taken a definite shape yet. I am exploring the field broadly, including how we identify risks, protect systems, detect threats, respond to incidents and recover from disruption, before deciding where to focus.

Building on my MSci work

This follows my MSci project on APT emulation and detection in ICS/OT. That project involved a segmented industrial control system testbed, physical Siemens PLCs and provenance data connecting activity across different layers of the environment.

The PhD gives me the opportunity to explore related questions in more depth. The proposal is a starting point, and the research questions and technical approach will develop as I learn more.

Where I am starting

At the moment, much of the work involves reading and finding a clearer direction: understanding smart-grid architectures, looking at cybersecurity research, and connecting academic questions to the problems electricity networks face in practice.

I have also been exploring the tools that support the research process: using Zotero to organise my reading and Obsidian to manage my notes and connect ideas across papers. I want to keep track of the questions a paper raises, the assumptions it makes and how it relates to the wider picture. Reading surveys helps with that wider view; working through individual studies makes the details and trade-offs more concrete.

From detecting a problem to understanding it

One paper I have been working through is Anomaly Diagnosis in Cyber-Physical Systems by Cook and colleagues. It looks at a useful distinction: detecting that something is wrong with an industrial process does not necessarily tell you whether the cause is a cyberattack or an equipment fault. Both can produce similar effects in the physical system. The paper explores a two-stage approach to identifying and classifying those events using controller and network data.

That distinction raises questions about what an operator can do with an alert. If a detection system reports unusual behaviour, what evidence would help someone understand the cause and choose a response? It connects the technical detection problem to the practical decisions needed to keep a process running safely.

Another useful starting point has been NIST's Guide to Operational Technology Security. A detail that may surprise people coming from everyday computing is how difficult a restart can be in an industrial environment. NIST explains that some processes cannot simply be stopped and started without affecting production, and outages may need to be planned days or weeks ahead. A routine security update can therefore require careful testing and coordination with the people responsible for the physical process.

These are examples from my reading, rather than a settled direction for the PhD. I am still exploring how the different parts of cyber resilience fit together and where I could make a useful contribution.

I would like this space to hold occasional updates, ideas and things I learn along the way. This is the beginning of that record.