Detta examensarbete tar upp digitala hot mot webbapplikationer och kategoriserar allmänhetens uppfattning om dem. Digitala hot är oftast kopplade till ekonomiska konsekvenser varvid även dessa kommer att studeras. Målet med detta arbete är att bidra till en vetenskaplig artikel i framtiden, som kan vara värdefull för allmänheten, samt för framtida arbete och sysselsättning. För att analysera samlade uppfattningar användes konstant jämförande metoden. Resultatet avslöjar flera spännande fynd för teori och praktik, där uppfattningar om cybervärlden presenteras för att kunna förstå mer hur andra ser på cybersäkerhet idag. Det visar även betydande variationer bland deltagarnas uppfattningar och att informationssäkerhet, även om den gradvis utvecklas, har en lång väg tills den blir en obruten del av affärsverksamheten och arbetskraftens verklighet.  Denna studie kan även fungera som en guide för de olika uppfattningarna om cyberattacker eftersom den ger en översikt över de idag mest relevanta cyberattackerna. Arbetet kompletterades med en studie som belyser ekonomiska konsekvenser av cyberattacker. Utöver detta studerades även cyberattacken mot Coop under sommaren 2021. / This thesis presents a categorization of conceptions about digital threats on web applications with a study showing the economic consequences of cyber-attacks. The aim of this thesis is to contribute to a scientific article, which can be valuable to the public, as well as for future work and employment. Constant comparison method was used to analyse aggregate perceptions. The results reveal several exciting findings for theory and practice, where perceptions of the cyber world were presented in order to understand more how others see cybersecurity today. It also shows significant variations among the participants' perceptions. This shows that information security, even if it is gradually developed, has a long way to go until it becomes an unbroken part of the business.  This study can also serve as a guide for the different perceptions of cyber-attacks as it provides an overview of the most relevant cyber-attacks today. This thesis was supplemented with a study that highlights the economic consequences of cyberattacks. In addition to this, the cyber-attack on Coop during the summer of 2021 was also studied.

The rapid growth of the internet over the past two decades has been accompaniedby a significant increase in cyberattacks, including ones targeting websites. Among thevast number of websites, approximately 50% are built using popular Content ManagementSystems (CMS) such as WordPress, Shopify, and Wix. Furthermore, websites created usingCMS platforms may be more attractive targets for attackers due to common frameworksand shared vulnerabilities. This study examines the prevalence of security vulnerabilitiesin the category "Vulnerable and Outdated Components" in these CMS-created websiteswith a focus on the WordPress CMS. From scanning one million of the largest websites,version information of WordPress and related extensions is collected and matched againstexploits in publicly available databases (exploit databases). The study finds that approxi-mately 65% of the WordPress websites are up-to-date, and that approximately 1.1% of thelargest websites running WordPress are susceptible to severe vulnerabilities to the Word-Press Core, and more to plugin vulnerabilities. The study also finds that 70% of all severepublic exploits both recently and historically spawn from 3 categories, including cross-sitescripting attacks, cross-site request forgery, and SQL injection. Based on the results gath-ered, a well-designed demonstration showcasing two vulnerabilities is develo

This study investigates the legal and ethical challenges posed by cyber warfare in the ongoing Russian-Ukraine war. Cyber warfare represents a transition from traditional conflict dynamics, impacting civilian populations and national security without direct physical confrontations. The significance of this research is the inadequacy of current legal norms that govern the rapidly evolving techniques of cyber-attacks which challenge established norms of International Humanitarian Law. Hence, the research question explores how cyber warfare challenges existing legal and ethical norms for civilian protection, and what the broader implications are for the regulation of modern conflicts. Through a qualitative case study approach, the thesis analyses three cases of Russian cyber-attacks on Ukrainian civilian infrastructure: the 2015 attack on the Ukrainian power grid, the 2023 cyber-attack on Kyivstar, and the 2022 Asylum Ambuscade. In the simplified legal framework by Hoffman and Rumsey, these cases were analysed using the Tallinn Manual, and Mary Kaldor’s New Wars theory to highlight the challenges and violations of IHL. The findings conclude that the IHL framework is insufficient for the unique challenges of cyber warfare. Moreover, the study addresses for the revaluation and updating of international legal norms to keep up with the constant development of cyber warfare. In all, this thesis showcases the need for enhanced legal standards that can safeguard civilian populations and maintain international security, contributing to the fields of international law and conflict resolution.

The introduction of cyber technology, accompanied by its fast developing nature, has not only resulted in numerous advantages to its user and society as a whole but has also produced harmful consequences specifically impacting on cyber crime. One of these harmful effects is cyber stalking. Cyber stalking is the use of the Internet or any electronic medium to stalk, harass and pursue victims. This unwanted perusal has various negative implications for the victim, as cyber stalking can disrupt many aspects of an individual’s lifestyle. In this study, the occurrence, nature and the impact of cyber stalking among the victims of cyber stalking were explored. Additionally, protective measures available to victims of cyber stalking were examined as a way to facilitate the operational efficiency of related legislation. This was done through determining the occurrence, nature and the impact of cyber stalking as well as the extent of the usage of social networks in the commission of cyber stalking. Legislation specific to South Africa and the effectiveness of such legislation were examined. The study implemented a qualitative approach. Twelve research participants who met the requirements of the study were selected by means of purposive and snowball sampling methods. The study was publicised on the Internet through current popular social network sites. In conjunction to the cyber theme of the study, the research participants were requested to complete an online e-mail interview to share their personal cyber stalking victimisation experiences. Within the constraints of the e-mail interview, a semi-structured interview schedule was incorporated in order to guide the research participants in sharing their cyber stalking victimisation experiences. The findings of the study were extensive; ranging from emerged patterns to unique and exclusive experiences. In brief, the study concludes that cyber stalking is occurring in South Africa, its nature and impact is complex and although there are many common themes within cyber stalking, it is uniquely situated to individual cyber stalking incident(s). Although there is no current South African legislation specifically aimed at addressing cyber stalking, South African legislation comprehensively deals with addressing the problem of cyber stalking within various related legislation. It was determined that although cyber stalking is effectively addressed in the drafting of legislation, it is ineffectively administered at grass roots level, where the police act as the gatekeepers and vital role players in the reporting and intervention of crime. Based upon the findings, as guided by the aims and objectives of the study, recommendations for the prevention and intervention of cyber stalking as well as recommendations for future research were made. As derived from the research participants’ responses as well as from current literature, recommendations focused on all victims of cyber stalking while specifically paying attention to young victims and victims who are business users. Recommendations were also made to assist in dealing with cyber stalking as well as recommendations aimed at assisting professional role players. In the final chapter of the study, emphasis is placed on awareness and educational campaigns aimed at informing the cyber community of cyber stalking. / Criminal & Procedural Law / Masters of Arts (Criminology)

The introduction of cyber technology, accompanied by its fast developing nature, has not only resulted in numerous advantages to its user and society as a whole but has also produced harmful consequences specifically impacting on cyber crime. One of these harmful effects is cyber stalking. Cyber stalking is the use of the Internet or any electronic medium to stalk, harass and pursue victims. This unwanted perusal has various negative implications for the victim, as cyber stalking can disrupt many aspects of an individual’s lifestyle. In this study, the occurrence, nature and the impact of cyber stalking among the victims of cyber stalking were explored. Additionally, protective measures available to victims of cyber stalking were examined as a way to facilitate the operational efficiency of related legislation. This was done through determining the occurrence, nature and the impact of cyber stalking as well as the extent of the usage of social networks in the commission of cyber stalking. Legislation specific to South Africa and the effectiveness of such legislation were examined. The study implemented a qualitative approach. Twelve research participants who met the requirements of the study were selected by means of purposive and snowball sampling methods. The study was publicised on the Internet through current popular social network sites. In conjunction to the cyber theme of the study, the research participants were requested to complete an online e-mail interview to share their personal cyber stalking victimisation experiences. Within the constraints of the e-mail interview, a semi-structured interview schedule was incorporated in order to guide the research participants in sharing their cyber stalking victimisation experiences. The findings of the study were extensive; ranging from emerged patterns to unique and exclusive experiences. In brief, the study concludes that cyber stalking is occurring in South Africa, its nature and impact is complex and although there are many common themes within cyber stalking, it is uniquely situated to individual cyber stalking incident(s). Although there is no current South African legislation specifically aimed at addressing cyber stalking, South African legislation comprehensively deals with addressing the problem of cyber stalking within various related legislation. It was determined that although cyber stalking is effectively addressed in the drafting of legislation, it is ineffectively administered at grass roots level, where the police act as the gatekeepers and vital role players in the reporting and intervention of crime. Based upon the findings, as guided by the aims and objectives of the study, recommendations for the prevention and intervention of cyber stalking as well as recommendations for future research were made. As derived from the research participants’ responses as well as from current literature, recommendations focused on all victims of cyber stalking while specifically paying attention to young victims and victims who are business users. Recommendations were also made to assist in dealing with cyber stalking as well as recommendations aimed at assisting professional role players. In the final chapter of the study, emphasis is placed on awareness and educational campaigns aimed at informing the cyber community of cyber stalking. / Criminal and Procedural Law / M. A. (Criminology)

This study aims to shed light on what a comparison between cybersecurity intelligence and public health surveillance systems can yield in practical improvements. The issue at hand is best described by the amount of threats both systems must detect. Intelligent malicious software, malware, designed by humans to spread and reap havoc in the abundance of unprotected networks worldwide and contagious diseases with millions of years of evolution behind their design to bypass human defences, infect and multiply. These two threats stand as mighty competitors to actors who try to monitor their presence to be able to give advice on further action to hinder their spread. The sheer amount of experience in public health of dealing with surveillance of contagious disease can contribute with important lessons to cyber intelligence when malware is becoming an even more alarming threat against everybody who uses the Internet. To compare them both this study uses high reliability theory to understand how Folkhälsomyndigheten, Sweden’s main authority in public health surveillance, and CERT-SE, Sweden’s national computer emergency response team, operate to make their surveillance as reliable as possible to detect emerging threats. Some key findings of the study points to the lack of regional or global binding policy’s to share information in the cyber security sector of which CERT-SE takes part in. The major roll of trust-based information sharing can be subject to shifts in relationships between states and excludes states with which no bilateral arrangements are made, but who may possess information of urgent necessity. The lack of arrangements in the cybersecurity sector, correspondent to the International health regulations by World Health Organization in public health, stands as a major difference between the two sectors access to information. However, this study may not stretch as far as to prove that the greater access to information would have proved to be of ease in a specific cyberincident. Case studies of this kind or further research of how agreements can be made in an anarchistic domain like the Internet are to be continued from this study.

Approved for public release; distribution is unlimited. / Cyberespionage is a prolific threat that undermines the power projection capacity of the United States through reduced economic prowess and a narrowing of the technical advantage employed by the American military. International attempts to limit hostile cyber activity through the development of institutions, normative patterns of behavior, or assimilation of existing laws do not provide the American national security decision maker with a timely or effective solution to address these threats. Unfortunately, the stove-piped, redundant and inefficient nature of the U.S. counterintelligence community does not deliver a viable alternative to mitigating cyberespionage in an effective manner. Instituting a domestic and international micro-restructuring approach within the Department of Defense (DoD) addresses the need for increased effectiveness within an environment of fiscal responsibility. Domestic restructuring places emphasis on developing a forcing mechanism that compels the DoD counterintelligence services to develop joint approaches for combating cyberespionage by directly addressing the needs of the Combatant Commands. International restructuring places an emphasis on expanding cybersecurity cooperation to like-minded nations and specifically explores the opportunity and challenges for increased cyber cooperation with Taiwan. This approach recognizes that Taiwan and the United States are both negatively affected from hostile cyber activity derived from within the People’s Republic of China.

The Internet of Things is a growing area with growing security concerns, new threat emerge almost everyday. Keeping up to date, monitor the network and devices and responding to compromised devices and networks are a hard and complex matters.  This bachelor’s thesis aims to discover how a IT-company can work with security management within the Internet of Things, this is done by looking into how a IT-company can work with updating, monitoring and responding within the Internet of Things, as well what challenges there are with working with this.  A qualitative research approach was used for this case study along with an interpretative perspective, as well as abductive reasoning. Interviews were performed with employees of a large IT-company based in Sweden, along with extensive document analysis.  Our bachelor’s thesis results in challenges with Security Management within the areas updating, monitoring and responding along with how our Case Company works with these security challenges. Largely these challenges can be summarized that everything is harder with the number of devices there are within the Internet of Things / Internet of Things eller Sakernas internet är ett växande område med en växande hotbild och nya hot uppkommer dagligen. Att hålla sig uppdaterad, övervaka nätverk och enheter samt att reagera på att enheter och nätverk blir hackade är en svår och komplicerad uppgift. Den här uppsatsen ämnar undersöka hur ett IT-företag kan arbeta med säkerhetshantering inom Internet of Things. Detta har gjorts genom att kolla utmaningar och säkerhetslösningar inom de tre områdena uppdatera, övervaka och reagera.  En kvalitativ forskningsmetod har använts i denna fallstudie tillsammans med ett tolkande synsätt och en abduktiv ansats. Vi har utfört intervjuer på ett stort IT-företag baserat i Sverige tillsammans med en utförlig dokumentanalys.  Resultatet av denna uppsats påvisar ett antal utmaningar inom säkerhetshanteringen inom områdena uppdatera, övervaka och reagera tillsammans med hur vårt fallföretag jobbar med att motarbeta dessa utmaningar. I stort sett kan utmaningarna sammanfattas till att allting är svårare när mängden enheten är så hög som den är inom Internet of Things.

MGS / Institute for Gender and Youth Studies / Most people view bullying as a childhood challenge which children outgrow with age. However, bullies grow up and even go to universities where they continue with their bullying tactics; harassing their fellow students. The development of technology has allowed bullying to be taken to adulthood through cyber-bullying. Technology has become a big part of young people’s lives and it plays an increasingly important role in their day-to-day activities. However, it has also become a platform for young people to intimidate and harass each other. Cyber-bullying has become a huge problem for university students, which can cause long term effects to victims. It involves sending hurtful, threatening or embarrassing messages to one another. Cyber-bullying causes problems such as depression, anxiety, suicide, poor school attendance and performance for the victims of such an act. Both males and females take part in cyber-bullying. Avenues for cyber-bullying by students include emails, blogs, text messages, and social network sites such as Facebook, My Space, Whatsapp, Instagram and twitter among others. The main aim of this study was to probe cyber-bullying experiences of both male and female first year students at the University of Venda. Qualitative research approach was used. Snowball sampling, a subtype of non-probability sampling was used to select the respondents for the study. Semi-structured interviews were used as the data collecting tool. The data was analysed using thematic analysis. Confidentiality, anonymity, voluntary participation and informed consent were among the ethical considerations that were followed. The study found that cyber-bullying is prevalent at the University of Venda and it socially, academically, psychologically and physically affects students. More female students were found to be victims of cyber-bullying when compared to male students. In view of the magnitude of cyber-bullying among university students; there is a need for urgent action by the University of Venda management to come up with / NRF

Digitalisation and globalisation are increasing the number of integrated and interconnected information technology (IT) systems worldwide. Consequently, these relationships and dependencies develop technological relationships through their services. Identifying all these relations is for organisations a challenge and complex since it involves millions of source code lines and global connections. For this reason, cyber supply chain risk management (C-SCRM) is becoming ever more critical for organisations to manage risks associated with information technology and operational technology (OT). At the same time, during a press conference, the Swedish Minister for Defense Peter Hultquist estimated that there are approx. 100.000 cyber activities against Swedish targets every year that targets both the Private and Public sector. In response to the evolving threat landscape, Sweden is experiencing a paradigm shift in protective security processes with new legislation entering into force that aims to protect Sweden's security against espionage, sabotage, terrorist offences and other crimes against national security. These rules on protective security, the Protective Security Act (2018:585) and Protective Security Ordinance (2021:955) apply to operators that are important for Sweden's national security and affect how public procurement processes are regulated. This thesis aims to study how the Swedish Security Protected Procurement with Security Protective Agreements (SUA) process and Cyber Supply Chain Risk Management (C-SCRM) relate and to understand what practices increase and decrease the level of C-SCRM in the current SUA process. The research questions are Q1) How does the SUA process relate to C-SCRM? and Q2) How does the SUA process affect the level of C-SCRM? This research paper contributes to understanding C-SCRM in the context of the Swedish Security Protected Procurement with Security Protective Agreements (SUA). To answer the research questions a Case study strategy was used, and interviews were conducted with eight key experts as well as a document analysis. The results showed that audit, regulation and people and processes are essential to managing C-SCRM and that processes within other international models, including the CMMC and Cyber Essential Plus, should be adopted to the SUA process to better manage cyber supply chain risks.