The increasing importance of the Internet as an integral part of contemporary society has stressed the need to formalize the process of response to security incidents that accompany it inseparably. Security teams of the CERT/CSIRT type are established at different levels for this purpose. These teams respond to reports from their constituency and cooperate with other teams. This thesis introduces the reader to the issues these teams deal with and analyzes their needs in resolving threats and problems related to DNS and its domains. Part of the work is an overview of the basic existing tools to support the work of CERT/CSIRT teams to solve problems with domains, the design of a tool Malicious Domain Manager and description of its implementation. The results of test run of this tool by CZ.NIC-CSIRT team show its contribution to security of DNS.

<p>Information och data har i en allt större utsträckning blivit en resurs som organisationer är beroende av och grundar sin verksamhet på. Precis som andra värdefulla resurser så måste också denna skyddas mot obehörigas åtkomst. Detta examensarbete handlar om systemförvaltning och arbetet med att revidera säkerheten i ett datorsystem. Eftersom denna typ av revision är en väsentlig del av arbetet med att upprätthålla säkerheten i ett system, är det följaktligen viktigt att känna till hur en säkerhetsrevision genomförs. I resultatet presenteras ett antal olika aspekter och delområden som bör granskas vid en revision av säkerheten hos datorer i ett datorsystem. Resultatet visar även att det är svårt att finna någon enskild modell eller standard som täcker samtliga aspekter som bör undersökas vid en säkerhetsrevision</p>

Information och data har i en allt större utsträckning blivit en resurs som organisationer är beroende av och grundar sin verksamhet på. Precis som andra värdefulla resurser så måste också denna skyddas mot obehörigas åtkomst. Detta examensarbete handlar om systemförvaltning och arbetet med att revidera säkerheten i ett datorsystem. Eftersom denna typ av revision är en väsentlig del av arbetet med att upprätthålla säkerheten i ett system, är det följaktligen viktigt att känna till hur en säkerhetsrevision genomförs. I resultatet presenteras ett antal olika aspekter och delområden som bör granskas vid en revision av säkerheten hos datorer i ett datorsystem. Resultatet visar även att det är svårt att finna någon enskild modell eller standard som täcker samtliga aspekter som bör undersökas vid en säkerhetsrevision

Au cours de leur métabolisme, les céramides, produits de novo au niveau du réticulum endoplasmique, sont transportés vers l'appareil de Golgi pour être convertis en sphingomyéline. Le mode principal de ce transport implique la protéine cytosolique CERT (CERamide Transfer). La surexpression de CERT, responsable d'un abaissement du taux intracellulaire en céramide pro-apoptotique, a été associée au phénomène de résistance aux agents chimiothérapeutiques de plusieurs lignées de cellules tumorales. L'inhibition de CERT permet de resensibiliser ces lignées cellulaires aux agents anti-cancéreux. Cependant, une seule famille d'inhibiteurs de CERT est connue à ce jour : les HPAs. A l'extrémité C-terminale de la protéine, le domaine START contient le site de liaison du céramide nécessaire à l'activité de transport de CERT. A partir de structures cristallographiques, une méthode d'identification de nouveaux ligands, combinant des outils in silico et in vitro, a été développée. La jaspine B, des analogues HPAs et des iminosucres ont été mis à jour en tant qu'antagonistes potentiels de CERT par cette méthode. Certains des composés identifiés ont été synthétisés et évalués in vitro. Des sondes fluorescentes de la jaspine B ont été conçues afin d'approfondir la compréhension de son mécanisme d'inhibition. En parallèle, un test de liaison in vitro HTR-FRET a été développé, permettant le criblage haut-débit de la Chimiothèque Nationale Essentielle. / During its metabolism, ceramides, produced de novo in the endoplasmic reticulum, are transported to the Golgi complex to be converted into sphingomyelin. The main way of this transport involves the cytosolic CERT protein (Ceramide Transfer). Overexpression of CERT, responsible for a diminution of intracellular level of proapoptotic ceramide, is associated with the phenomenon of resistance to chemotherapeutic agents in several tumor cell lines. The CERT inhibition allows to resensitize these cell lines to anticancer drugs. Yet, only a single family of inhibitors is known to date: HPAs. Located at the C-terminal region of the protein, the START domain contains the binding site of ceramide necessary for the transport activity of CERT. Based on crystallographic structures, a method for the identification of new CERT ligands, combining in silico and in vitro tools, was developed. Jaspine B, HPAs analogs and iminosugars were identified as potential antagonists using this method. Some of these compounds were synthesized and evaluated in vitro. Fluorescent probes of jaspine B were designed for a better understanding of it mechanism of action. In parallel, an in vitro HTR-FRET binding assay was developed, allowing the high-throughput screening of the National Essential Compound Library.

Das Ceramid Transfer Protein (CERT) ist einer der geschwindigkeitsbestimmenden Proteine in der de novo Biosynthese von Sphingomyelin. Es ist verantwortlich für den nicht-vesikulären Transfer von Ceramid vom Endoplasmatischen Retikulum zum Golgi-Apparat. Die Inhibition von CERT wird als potenzielle Behandlung für Krankheiten wie Infektionen, Krebs oder Gain-of-Function-Mutationen des CERT Gens diskutiert. Kürzlich, wurde Lomitapide als potenter Inhibitor des CERT-vermittelten intermembran-Transfers identifiziert. Im ersten Teil dieser Arbeit wird die Synthese von Lomitapide Derivaten mit verbesserter Wirksamkeit und Selektivität präsentiert. Die synthetisierten Analoga wurden in vitro mithilfe eines liposomalen Transferassays auf ihre Inhibition der CERT-Transferaktivität getestet. Zusätzlich konnte durch die Messung des Ceramid-Sphingomyelin-Verhältnisses nach Inhibitor Behandlung die Aktivität in cellulo bestätigt werden. Die Selektivität gegenüber dem Mikrosomalen Triglycerid Transfer Protein (MTP) wurde durch Messung der MTP-vermittelten Sekretion von apoB ermittelt. Unter den synthetisierten Analoga zeigten einige verbesserte CERT-Transfer Inhibition und niedrigere Inhibition der apoB Sekretion, sogar bei fünffacher Konzentration verglichen mit Lomitapide. Obwohl die Bewertung der biologischen Aktivität noch im Gange ist, wurde eine vorläufige Struktur-Aktivitäts-Beziehung etabliert. Es wurden strukturelle Bestandteile identifiziert, die wichtig für die CERT-Inhibition sind und andere welche variabel sind, um die Wirksamkeit und Selektivität in Zukunft noch weiter zu steigern. Der zweite Teil dieser Arbeit beschreibt die Synthese von Lomitapide-basierten proteolysis targeting chimeras (PROTACs) für CERT. PROTACs haben sich im letzten Jahrzehnt zu einem vielversprechenden therapeutischen Ansatz entwickelt und mehrere potenzielle Wirkstoffe hervorgebracht. PROTACs sind heterobifunktionale Moleküle, die sich den zellulären Weg der Proteinzersetzung zunutze machen, indem sie das gewünschte Protein zur Zersetzung markieren. Es wurde eine erste Serie von CERT PROTACs mit vielversprechender Abbauwirkung synthetisiert, welche eine bevorzugte Zersetzung von CERT aber nicht CERTL andeuten. CERTL ist eine längere Spleiß-Variante, welche vornehmlich im Herz, Gehirn und den Skelettmuskeln exprimiert wird. Eine zweite Serie von PROTACs mit variierter Linker Kettenlänge wurde synthetisiert. Untersuchung des Einflusses auf die apoB Sekretion aus HepG2 Zellen zeigte sogar bei 50-facher Konzentration einen niedrigeren Einfluss auf diese als Lomitapide. / The ceramide transfer protein (CERT) is one of the rate-limiting proteins in the de novo biosynthesis of sphingomyelin, facilitating the non-vesicular transfer of ceramide from the Endoplasmic Reticulum to the Golgi-apparatus. Inhibition of CERT has been proposed as a potential treatment for pathogenesis like infectious diseases, cancer, or disease-causing gain-of-function mutations within the CERT gene. Recently Lomitapide has been identified as a potent inhibitor of CERT-mediated intermembrane transfer. In the first part of this thesis, the synthesis of Lomitapide derivatives with improved potency and selectivity is presented. The synthesized analogs were tested in vitro for their inhibition of CERT-transfer using a liposomal transfer assay. Additionally, the activity could be confirmed in cellulo by monitoring the ceramide-sphingomyelin-ratio after inhibitor treatment. Selectivity against the microsomal triglyceride transfer protein (MTP) has been determined by monitoring the MTP-mediated cellular secretion of apoB. Among the synthesized analogs, several showed improved CERT-transfer inhibition and lower inhibition of apoB secretion even at five-fold higher concentrations compared to Lomitapide. Although the biological evaluation is still underway, a preliminary structure-activity-relationship has been established and identified structural motifs important for CERT inhibition and modifiable moieties to increase potency and selectivity even further in the future. The second part of the thesis describes the synthesis of Lomitapide-based proteolysis targeting chimeras (PROTACs) for CERT. PROTACs have evolved in the last decade as a promising therapeutic technique and resulted in the development of several drugs which are currently in clinical trials. PROTACs are heterobifunctional small molecules that mediate the degradation of the target protein by hijacking the cellular proteasomal pathway. A first series of synthesized CERT PROTACs showed promising preliminary results for CERT degrader activity and indicated a preferred degradation of CERT over CERTL, a longer splicing variant expressed in the heart, brain, and skeletal muscles. Motivated by this a second generation of PROTACs with varying linker chain lengths was synthesized. Investigation of their inhibition of apoB secretion from HepG2 cells revealed lower activity on secretion than Lomitapide even at 50-fold concentrations for a set of CERT PROTACs.

L'obésité et le diabète de type 2 sont associés à la sédentarité et à une alimentation riche en graisses. En effet, les acides gras saturés s'accumulent dans les tissus non adipeux, comme les muscles squelettiques pour générer des lipides appelés céramides (CER). Mon projet de thèse s'est articulé en deux parties dont l'objectif est d'empêcher les CER d'agir. Nous avons montré que, selon la structure de la membrane plasmique, les CER altèrent la voie de signalisation insulinique en ciblant la PKB, protéine clef de la voie insulinique, via la voie PKC? dans les myotubes L6 et la voie PP2A dans les myotubes C2C12. Nous avons aussi mis en évidence que les CER altèrent la sensibilité à l'insuline via la voie PKC? dans les cellules musculaires humaines. Une fois les CER produits au niveau du réticulum endoplasmique (RE), ils sont transportés au Golgi par un transporteur CERT pour y être métabolisés en sphingomyéline (SM) et des études ont montré que la transformation des CER en SM pouvait être une étape cruciale pour empêcher les CER d'agir. Dans plusieurs modèles d'insulino-résistance musculaire, l'expression de CERT est diminuée et nous avons démontré l'importance du transport des céramides du RE vers le Golgi en inhibant artificiellement l'activité ou l'expression de CERT. A l'opposé, la surexpression de CERT améliore la sensibilité à l'insuline dans les cellules musculaires dans des conditions lipotoxiques. Nos résultats montrent que CERT joue un rôle crucial dans les mécanismes conduisant au développement de l'insulinorésistance musculaire puisque sa présence est essentielle pour le maintien d'un trafic normal des CER entre le RE et le golgi. / Obesity and type 2 diabetes are associated with a sedentary lifestyle and a diet rich in fat. Indeed, saturated fatty acids accumulate in non-adipose tissue such as skeletal muscle to generate lipids called ceramides (CER). My thesis project was divided into two parts with the objective to prevent CER to act. We have shown that, depending on the structure of the plasma membrane, CER alter the insulin signaling pathway by targeting PKB, a key insulin signalling protein, via a PKCζ pathway in L6 myotubes and a PP2A pathway in C2C12 myotubes. We also demonstrated that CER affect insulin sensitivity via the PKCζ pathway in human muscle cells. Once CER generated in the endoplasmic reticulum (ER), they are transported to the Golgi by a carrier called CERT to be metabolized into sphingomyelin (SM). Studies have shown that the transformation of CER into SM could be a crucial step to prevent CER to act. In several muscle insulin resistance models, expression of CERT is decreased and we demonstrated the importance of the transport of ceramide from the ER to the Golgi by inhibiting artificially the activity or the expression of CERT. In contrast, overexpression of CERT enhances insulin sensitivity in muscle cells in lipotoxiques conditions. Our results show that CERT plays a crucial role in mechanisms leading to the development of muscle insulin resistance since its presence is essential for maintaining normal traffic of CER between the ER and the Golgi.

This thesis focuses on development of software for security incident reporting from GPON networks. The theoretical part introduces the principles of GPON and provides an introduction to security incidents. The practical part is focused on the selection of suitable open-source systems and the design of an application in Python for the creation of alerts. The output of the work is the deployment of TheHive, Cortex and MISP systems and the creation of an application enabling the creation of various types of alerts based on prepared template. The thesis is finalized by a detailed description of deployment, custom configuration and testing.

Security is a critical part of every software developed today and it will be even more important going forward when more devices are getting connected to the internet. By striving to improve the quality of the code, in particular the security aspects, there might be a reduction in the number of vulnerabilities and improvements of the software developed. By looking at issues from past problems and studying the code in question to see whether it follows the SEI CERT secure coding standards, it is possible to tell if compliance to this standard would be helpful to reduce future problems. In this thesis an analysis of vulnerabilities, written in C and C++, reported in Common Vulnerabilities and Exposures (CVE), will be done to verify whether applying the SEI CERT secure coding standard will help reduce vulnerabilities. This study also evaluates the SEI CERT rule coverage of three different static analysis tools, Rosecheckers, PVS-Studio and CodeChecker by executing them on these vulnerabilities. By using three different metrics, true positive, false negative and the run time. The results of the study are promising since it shows that compliance to the SEI CERT standard does indeed reduce vulnerabilities. Of the analyzed vulnerabilities it was found that about 60% of these could have been avoided, if the standard had been followed. The results of the tools were of great interest as well, it showed that the tools did not perform as well as the manual analysis, however, all of them found some SEI CERT rule violations in different areas. Conclusively, a combination of manual analysis and these three static analysis tools would have resulted in the highest number of vulnerabilities avoided.

IT-security is a global problem and over the world Computer Emergency Response Teams (CERT) are created in order to solve the problem. The common understanding is that IT-security is important but no straight guideline how to deal with it. The Swedish IT-incident centre (SITIC) started 2003. It is a Swedish solution on an international problem. There are challenges to be met when handling an IT-incident centre – organisation form, activity and result. We believe a general solution in IT-incident management that will suit all parties in the society, is a hard task for SITIC as things stand today. What we can deduce from our investigation is that there is no greater need of SITIC among the global companies. We believe one reason for this is that they are going to create within their companies some sort of CERT function by themselves in the future. This in its turn, depend on that the companies do not have any trust to SITIC, they do not see the benefit with an activity as SITIC because they only see the reporting, they do not believe they are going to get something in return. Conclusion: Incident management is not only about reporting incidents, but a continuous life cycle with phases: detect, report, measure and follow-up. / IT-säkerhet är ett globalt problem och över världen skapas Computer Emergency Respons Teams (CERT) för att försöka att lösa olika problem. Den vanliga uppfattningen är att IT-säkerhet är viktigt men att inga direkta guidelines finns för hur man skall hantera det. SITIC som är det svenska IT-incident centret, startade 1 januari, 2003. Det är en svensk lösning på ett internationellt problem. För ett IT-incident center finns det utmaningar att hantera såsom organisations form, verksamhet och resultat. Vi tror att en generell lösning av hanteringen IT-incidenter som skulle passa alla parter i samhället blir svårt för SITIC att klara av som det ser ut idag. Vad vi kan härleda från vår utredning är att det inte finns något större behov av SITIC för de globala företagen. Vi tror att en av anledningarna är att företagen själva i framtiden tänker starta egna CERT-funktioner. Detta i sin tur kan bero på att företagen inte har något större förtroende för SITIC, de kan inte se någon fördel men verksamheten, de ser endast rapporteringsdelen. Företagen tror inte att de kommer att få något tillbaka när dom rapporterar sina incidenter till SITIC. Slutsats: Incident hantering handlar inte bara om att rapportera incidenter, utan det är en kontinuerlig livscykel innehållande faserna: upptäcka, rapportera, åtgärda och följa upp.

IT-security is a global problem and over the world Computer Emergency Response Teams (CERT) are created in order to solve the problem. The common understanding is that IT-security is important but no straight guideline how to deal with it. The Swedish IT-incident centre (SITIC) started 2003. It is a Swedish solution on an international problem. There are challenges to be met when handling an IT-incident centre – organisation form, activity and result. We believe a general solution in IT-incident management that will suit all parties in the society, is a hard task for SITIC as things stand today. What we can deduce from our investigation is that there is no greater need of SITIC among the global companies. We believe one reason for this is that they are going to create within their companies some sort of CERT function by themselves in the future. This in its turn, depend on that the companies do not have any trust to SITIC, they do not see the benefit with an activity as SITIC because they only see the reporting, they do not believe they are going to get something in return. Conclusion: Incident management is not only about reporting incidents, but a continuous life cycle with phases: detect, report, measure and follow-up. / IT-säkerhet är ett globalt problem och över världen skapas Computer Emergency Respons Teams (CERT) för att försöka att lösa olika problem. Den vanliga uppfattningen är att IT-säkerhet är viktigt men att inga direkta guidelines finns för hur man skall hantera det. SITIC som är det svenska IT-incident centret, startade 1 januari, 2003. Det är en svensk lösning på ett internationellt problem. För ett IT-incident center finns det utmaningar att hantera såsom organisations form, verksamhet och resultat. Vi tror att en generell lösning av hanteringen IT-incidenter som skulle passa alla parter i samhället blir svårt för SITIC att klara av som det ser ut idag. Vad vi kan härleda från vår utredning är att det inte finns något större behov av SITIC för de globala företagen. Vi tror att en av anledningarna är att företagen själva i framtiden tänker starta egna CERT-funktioner. Detta kan bero på att företagen inte har något större förtroende för SITIC, de kan inte se någon fördel men verksamheten, de ser endast rapporteringsdelen. Företagen tror inte att de kommer att få något tillbaka när dom rapporterar sina incidenter till SITIC. Slutsats: Incident hantering handlar inte bara om att rapportera incidenter, utan det är en kontinuerlig livscykel innehållande faserna: upptäcka, rapportera, åtgärda och följa upp. / Ulrika Isaksson, 0708-353984 Karin Kvarnström 0708-140151 Malin Nilsson 0708-626844