The first CISPA satellite is currently being built in Hanover in cooperation with Leibniz University and the state of Lower Saxony. In the coming years, scientists will conduct research there on industrial security and user-oriented cybersecurity. CISPA faculty member Sascha Fahl and his research group are paving the way.
Together with nine doctoral students, cybersecurity researcher Sascha Fahl moved into the new premises in downtown Hanover a few weeks ago. There is more space for the computer scientists, and they will need it. In the future, the CISPA satellite, which is not only Fahl's label for the dependent branch in Lower Saxony, is to grow many times over. A first step has already been taken: the position of a research group leader in the field of industrial security is currently being advertised. "The cybersecurity of industrial plants is a very important topic in Lower Saxony because there is a lot of manufacturing industry here," Fahl explains. Last October, CISPA and Leibniz Universität Hannover (LUH) signed a cooperation agreement for joint research on cybersecurity and data protection. The state and the Volkswagen Foundation are funding the research groups with a total of 4.5 million euros over the next five years with funds from the Niedersächsisches Vorab funding program. Another 16 million is to flow into the new building of the LUH's "Digital Innovation Campus," where the research groups also are to move.
Fahl's area of expertise is behavioral and user-oriented cybersecurity. "My conviction is that technological innovation alone is not enough. We get more IT security and data protection primarily when technology works well with people." According to Fahl, this approach runs counter to the long-standing practice of developing technology from an expert perspective and expecting users to become experts themselves - which usually doesn't happen. And so Fahl and his team are investigating why IT security often doesn't work as well in the "real world" as it does on paper. "We're thinking about how existing systems can be improved or future ones can be designed to take into account user capabilities and limitations." The focus of his research, however, is not on end-users but on program developers and administrators, according to Fahl. Most software developers have studied computer science, he said, but don't bring much cybersecurity expertise to the table. "Our goal is to help people make their software secure."
Fahl has held the chair of Usable Security and Privacy at LUH since 2018. Looking at his professional career and the awards the native of northern Hesse has already collected at just 36 years old - including, for example, the prestigious Heinz Maier Leibnitz Prize of the German Research Foundation - it's hard to believe that Fahl didn't get his first computer until he was a not-so-delicate 19 years old. Originally, the CISPA faculty member wanted to study mathematics. It was only by chance and, as he himself says, a certain "clumsiness" that he ultimately ended up in computer science at the University of Marburg: the computer science course was also offered in the summer semester, whereas he could only have started mathematics in winter.
At the time, Fahl could not have imagined that his passion for research would one day reach so far that he would even turn down an offer from Google in Mountain View, California, to do it. "After my intermediate diploma, I didn't feel like studying anymore, I thought it was totally awful," says Fahl with a laugh. So he founded a social media start-up with three friends and took a year and a half off from university life. He didn't get rich with it and the portal wasn't very successful - also because of strong competition like studiVZ and Facebook, which had just been launched in Germany at the time. But the start-up experience solidified his decision to go back to university, Fahl says. "And then I wanted to at least do a doctorate," says the 36-year-old. He did that at LUH and also worked as a researcher and later as a research group leader at CISPA before returning to LUH in Hanover as head of the Institute for Information Security in 2017 and becoming chair there a year later. Since January 2021, he has also been tenured faculty at CISPA, where he is also affectionately referred to as "our man in Lower Saxony."
The text was translated by: Oliver Schedler