abstract: With the rise of the Internet of Things, embedded systems have become an integral part of life and can be found almost anywhere. Their prevalence and increased interconnectivity has made them a prime target for malicious attacks. Today, the vast majority of embedded devices are powered by ARM processors. To protect their processors from attacks, ARM introduced a hardware security extension known as TrustZone. It provides an isolated execution environment within the embedded device in which to deploy various memory integrity and malware detection tools. Even though Secure World can monitor the Normal World, attackers can attempt to bypass the security measures to retain control of a compromised system. CacheKit is a new type of rootkit that exploits such a vulnerability in the ARM architecture to hide in Normal World cache from memory introspection tools running in Secure World by exploiting cache locking mechanisms. If left unchecked, ARM processors that provide hardware assisted cache locking for performance and time-critical applications in real-time and embedded systems would be completely vulnerable to this undetectable and untraceable attack. Therefore, a new approach is needed to ensure the correct use of such mechanisms and prevent malicious code from being hidden in the cache. CacheLight is a lightweight approach that leverages the TrustZone and Virtualization extensions of the ARM architecture to allow the system to continue to securely provide these hardware facilities to users while preventing attackers from exploiting them. CacheLight restricts the ability to lock the cache to the Secure World of the processor such that the Normal World can still request certain memory to be locked into the cache by the secure operating system (OS) through a Secure Monitor Call (SMC). This grants the secure OS the power to verify and validate the information that will be locked in the requested cache way thereby ensuring that any data that remains in the cache will not be inconsistent with what exists in main memory for inspection. Malicious attempts to hide data can be prevented and recovered for analysis while legitimate requests can still generate valid entries in the cache. / Dissertation/Thesis / Masters Thesis Computer Science 2018

No abstract / Mini Dissertation (LLM)--University of Pretoria, 2016. / Mercantile Law / LLM / Unrestricted

This research investigates 202 data breach events occurring between 2015 and 2019 and the related financial effects on the USA's impacted private firms. From examining previous research, it is obvious that no known studies evaluate the financial impacts of cybercrimes on private firms. Prior studies mostly focus on public firms and stock market reactions even though there is the increasing number of cyberattacks on private firms too. This study seeks to fill the gap by providing the empirical evidence of the impacts on those firms' cash holding after experiencing a cybersecurity attack. Overall, the results of this research show if the private firms that have been cyberattacked face the connate aftermath and follow the similar precautions as public firms with data breaches or not. I find that the firms that experienced an attack two years ago increase their cash holdings significantly, while an attack that happened a year ago can only impact cash holdings while interacting with tangibility and ROA of a firm. These results are essential as the private firms draw up a budget and reform strategies for coping with cyber incidents.

Whitelisting IP addresses and hostnames allow organizations to employ a default-deny approach to network traffic. Organizations employing a default-deny approach can stop many malicious threats, even including zero-day attacks, because it only allows explicitly stated legitimate activities. However, creating a comprehensive whitelist for a default-deny approach is difficult due to user-supplied destinations that can only be known at the time of usage. Whitelists, therefore, interfere with user experience by denying network traffic to user-supplied legitimate destinations. In this thesis, we focus on creating dynamic whitelists that are capable of allowing user-supplied network activity. We designed and built a system called Harbinger, which leverages user interface activity to provide contextual information in which network activity took place. We built Harbinger for Microsoft Windows operating systems and have tested its usability and effectiveness on four popular Microsoft applications. We find that Harbinger can reduce false positives-positive detection rates from 44%-54% to 0%-0.4% in IP and DNS whitelists. Furthermore, while traditional whitelists failed to detect propagation attacks, Harbinger detected the same attacks 96% of the time. We find that our system only introduced six milliseconds of delay or less for 96% of network activity.

The space systems industry is moving towards smaller multi-vendor satellites, known as Small Space. This shift is driven by economic and technological factors that necessitate hardware and software components that are modular, reusable, and secure. This research addresses two problems associated with the development of modular, reusable, and secure space systems: developing software for space systems (the Development Problem) and securing space systems (the Security Problem). These two problems are interrelated and this research addresses them together. The Development Problem encompasses challenges that space systems developers face as they try to address the constraints induced by reduced budgets, design and development lifecycles, maintenance allowances, multi-vendor component integration and testing timelines. In order to satisfy these constraints a single small satellite might incorporate hardware and software components from dozens of organizations with independent workforces and schedules. The Security Problem deals with growing need to ensure that each one of these software or hardware components behaves according to policy or system design as well as the typical cybersecurity concerns that face any information system. This research addresses the Development Problem by exploring the needs and barriers of Small Space to find the best path forward for the space systems industry to catch up with the methodology advancements already being widely used in other software fields. To do this exploration a series of five surveys, referred to as SISDPA, was conducted to assess current attitudes and state of practice among space system developers. This crystallized a need in space system development — modular reusable open networks can help Small Space realize its potential, but there is still need to address certain security threats. This research addresses the Security Problem by augmenting a modular reusable open-network software development framework, called SSM, by adding policy enforcement in the form of authentication, access control, and encryption provisions, to create a new development framework, SSSM. This design and implementation adds security provisions while minimizing the impact on developers using the framework. SSSM is evaluated in terms of developer and system resource burden and shows that SSSM does not significantly increase developer burden and preserves the ease-of-use of SSM.

No description available.

The increase in solar energy installation capacity and the versatility of modern power inverters have enabled widespread penetration of distributed generation in modern power systems. Islanding detection techniques allow for fast identification and corrective action in the face of abnormal events. Current standards specify the operational limits for voltage, frequency, and detection time. Grid codes specify the procedures for disconnection to establish safe network maintenance conditions. Passive, active, and remote techniques require voltage, current, and frequency measurements and the definition of thresholds for detection. Operational parameters such as load mismatch and quality factors influence the detection capabilities. False-positive triggering due to grid transients can lead to unnecessary disconnection of distributed generation resources. Cybersecurity threats pose a critical challenge for power systems and can result in significant operational disruptions and security risks. In particular, when a power system initiates communication links between different nodes or ends, it becomes more vulnerable to various forms of cyber-attacks. As such, it is imperative to address the potential cybersecurity risks associated with communication links. Through a literature review, this work analyzes the performance of several islanding detection techniques and proposes a modified 9-bus benchmark system to verify the robustness of passive and active methods against false-positive detections upon severe grid-side transients. Furthermore, this thesis conducts a detailed analysis of cyber-attacks on the remote islanding detection technique, using a real-time simulator to assess the potential impact of such attacks on the technique's effectiveness by simulating various attack scenarios. The findings of this analysis can help power system operators to better protect their systems from cyber-attacks and ensure the reliable operation of their distributed generation resources. Moreover, it discusses a conceptual implementation of hardware-in-the-loop testing. The modeling of the systems is discussed. Guidelines and international standards are presented. Various setups for experimental work are suggested and implemented.

The criticality of desalination plants, which greatly rely on Industrial Control Systems (ICS), has heightened due to the scarcity of clean water. This reliance greatly emphasizes the necessity of securing these systems, alongside implementing a robust risk assessment protocol. To address these challenges and the existing limitations in prevalent risk assessment methodologies, this thesis proposes a risk assessment approach for ICS within desalination facilities. The proposed strategy integrates Bayesian Networks (BNs) and Dynamic Programming (DP). The thesis develops BNs into multilevel Bayesian Networks (MBNs), a form that effectively handles system complexity, aids inference, and dynamically modifies risk profiles. These networks account for the interactions and dynamic behaviors of system components,providing a level of responsiveness often missing in traditional methods. A standout feature of this approach is its consideration of the potential attackers’perspective, often neglected but critical for a comprehensive risk assessment and the development of solid defense strategies. DP supplements this approach by simplifying complex problems and and identifying the most optimal paths for potential attacks. Therefore, this thesis contributes greatly to enhancing the safety of critical infrastructures like water desalination plants, addressing key deficiencies in existing safety precautions.

The explosive growth of the Internet of Things ecosystem has thrust these devices into the center of our lives. Unfortunately, the desire to create these devices has been stronger than the one to secure them. Recent attacks have shown us ignoring security in Internet of Things devices can cause severe harm in both a digital and physical sense. This thesis outlines a framework for developers and managers to assess the risk of IoT devices using a weighted scoring system across five different categories. Our case studies suggest that devices with higher security considerations have a better security posture and lower risk than those without.

Yes / The increase in cybersecurity threats and the challenges for organisations to protect their information technology assets has made adherence to organisational security control processes and procedures a critical issue that needs to be adequately addressed. Drawing insight from organisational theory literature, we develop a multi-theory model, combining the elements of the theory of planned behaviour, competing value framework, and technology—organisational and environmental theory to examine how the organisational mechanisms interact with espoused cultural values and employee cognitive belief to influence cybersecurity control procedures. Using a structured questionnaire, we deployed structural equation modelling (SEM) to analyse the survey data obtained from public sector information technology organisations in Nigeria to test the hypothesis on the relationship of socio-organisational mechanisms and techno-cultural factors with other key determinants of employee security behaviour. The results showed that knowledge of cybersecurity and employee cognitive belief significantly influence the employees’ intentions to comply with organisational cybersecurity control mechanisms. The research further noted that the influence of organisational elements such as leadership on employee security behaviour is mediated by espoused cultural values while the impact of employee cognitive belief is moderated by security technologies. For effective cybersecurity compliance, leaders and policymakers are therefore to promote organisational security initiatives that ensure incorporation of cybersecurity principles and practices into job descriptions, routines, and processes. This study contributes to behavioural security research by highlighting the critical role of leadership and cultural values in fostering organisational adherence to prescribed security control mechanisms. / National Information Technology Development Agency, Nigeria