Ricardo J. Rodríguez: "Computer security is a never-ending process, a field that is constantly evolving"

Why did you decide to go into research?

When I finished my degree in Computer Engineering I had my moment of "existential crisis", of what I wanted to do with my professional life. I didn't see myself very much in private enterprise and I have always liked solving problems, facing challenges, so I saw the way out in research. A valid way out, but also a complicated one, as it is a long-distance race that has its peaks and valleys.

Was it always clear what you wanted to do?

Until around 2008, when I made the decision, I was not sure whether to go into research. Then, within research, I had always liked cybersecurity issues. At the beginning, during my thesis, I was not able to focus as much on the more technical part as I would have liked from a cybersecurity point of view.

Even so, I do not regret the framework in which I moved as it is the one that allowed me to have a mental structure that I am now grateful for. A structure that, in fact, I sometimes miss with some PhD students. From my point of view, there are certain skills that I acquired during my training as a doctoral student, through the PhD courses, which it would be good if they were taken up again for new students.

How long have you been linked to the I3A and what would you highlight about the Institute?

I have been an associate member since 2009, when I enrolled as a PhD student at the University of Zaragoza, but I have been a permanent member since 2016.

I would highlight the closeness of the people at the Institute. It is a big little family where a lot of things are done, where there are many very good people in various fields of research. I would also highlight the interest of the I3A management in establishing synergies between the different groups, which benefits us all because in the end we are stronger and more multidisciplinary together.

In your research group, what are your most important lines or areas of work?

My research group, DisCo (Distributed Computing), is mainly dedicated to distributed computing. Although one of the research lines of this group is the application/evaluation of cybersecurity in different fields, which is where I am most active.

Do you have any ongoing projects that you would like to highlight?

I could highlight the last one we have been awarded, TED 21, where we are working to provide certain advances in incident response processes. Incident response is triggered when an incident happens in a company related to cybersecurity, that is. there has been an attack, a data breach or some kind of event that affects or compromises some dimension of security in some way within the system. Within that field, we are developing new tools that allow for a fast response to possible indicators of compromise, which would facilitate early detection of possible harmful activities in the system, allowing the company to act before the incident has further impact on the system. This research also has a certain impact on society, as any company could implement or deploy our developed software to improve their cybersecurity.

On the other hand, we are now also working on several strategic cybersecurity projects, financed by the European Union's Recovery, Transformation and Resilience Plan Funds (Next Generation) and developed with the National Cybersecurity Institute (INCIBE). All are related to early response to incidents, but from different fields, such as the analysis of network traffic or the activity of an end system.

What do you enjoy most about your profession? And what do you enjoy least?

Most of all, the freedom to be able to work on whatever I want (restricted, of course, to the framework of the funding project, although there is always maneuverability, which is the interesting thing). And, above all, that you may have some initial ideas, but then when you start working you see that these ideas take other directions. That's the interesting thing about research, arriving at results that you already expected to arrive at, different or even contradictory resolutions.

What I like least is the Spanish research quality assessment system. In the end, it restricts me in terms of having to focus on publishing in certain places when my community, cybersecurity, really moves more through conferences than through journals. For me, since I am already established, I don't mind; but for those who come after me, my doctoral students, it is a problem, because they have to follow these imposed rules in order to get their thesis. This is a bit counterproductive.

On the other hand, it is quite a vocational job, which has a small downside, and that is that in the end you end up putting in more hours than you should. But also because you want to, because if you don't want to, you just don't do it and that's it. The bad thing is that the work accumulates...

What would you say to anyone thinking of going into research?

First of all, you have to be aware that you are going to work for about 40 years of your life, being optimistic, so whatever you do, do what you want to do. If you want to do research, go ahead. Try to get a grant or some kind of funding, work in research and when you finish, decide if you want to stay in Spain, knowing the limitations that exist here, or decide if you want to go abroad or if you want to try to work in a company that recognises what research work is.

One of the things why people don't come to research, at least in my field, is because the salaries are low. This is true. At the University of Zaragoza we have certain limitations that restrict our capacity to manoeuvre when it comes to hiring staff. However, doing a PhD should be seen as an investment in the future. I agree, you are going to be paid very little during the 3 or 4 years you are here doing your thesis, but when you leave you are going to have a salary that is going to grow much faster than if you had followed a career in a company as soon as you finish your degree or Master's degree.

In my group, some students have had offers in the range of 60,000 to 80,000 euros with full remote (without finishing the thesis), even six-figure offers on the table for some of the professors in the group. And we are still here, simply because we like this. Therefore, this has to be seen as an investment in the future. You get paid badly for your professional worth today, but not tomorrow. It's not about now, it's about the after. You always have to think about the after and be optimistic.