Cette thèse traite des problèmes de fuite de données accidentelles au sein des entreprises. Ces fuites peuvent être dues à l’utilisation conjointe de politiques de Contrôle d’Accès (CA) et de Contrôle de Transmission (CT). De plus, l’utilisation conjointe de ces deux types de politique génère plusieurs problèmes pour les personnes ayant la charge de créer et maintenir ces politiques. Parmi ces problèmes, nous pouvons citer des problèmes de généricité des modèles existants, de cohérence entre les règles de CA et de CT ainsi que des problèmes de densité, d’adaptabilité, d’interopérabilité et de réactivité. Dans cette thèse, nous proposons en premier lieu un méta-modèle pour prendre en compte la plupart des modèles de CA utilisés dans les entreprises. Nous proposons ensuite la génération cohérente et semi-automatique des politiques de CT à partir de politiques de CA existantes pour répondre au problème de cohérence. De plus, différentes fonctionnalités sont proposées pour résoudre les problèmes de densité, d’adaptabilité et d’interopérabilité. Afin de valider la pertinence de notre solution, nous proposons une étude (type questionnaire) auprès d’experts sécurité et d’administrateurs. Cette étude révèle des informations sur la taille des politiques gérées, la pénibilité à les définir ou encore l’utilité des fonctionnalités proposées pour résoudre les problèmes précédents. Enfin, nous testons notre preuve de concept sur des données aléatoires et réelles en prenant en compte les performances et la réactivité, validant ainsi que notre solution répond bien aux problèmes soulevés. / The main objective of this thesis is to solve the problem of unintentional data leakage within companies. These leaks can be caused by the use of both Access Control (AC) and Transmission Control (TC) policies. Moreover, using both AC and TC can lead to many problems for the security experts and the administrators that are in charge of the definition and maintenance of such policies. Among these problems, we can underline the genericity problem of existing models, the coherence problem between AC and TC rules and problems such as density, adaptability, interoperability and reactivity. In this thesis, we first define a meta-model to take into account the main AC models that are used within companies. We also propose a coherent and semi-automatic generation of TC policies based on existing AC to tackle the coherence problem. Moreover, several mechanisms have been proposed to tackle complexity, adaptability and interoperability issues. In order to validate the relevance of our solution, we have first conducted a survey among security experts and administrators. This survey has highlighted several information regarding the policies’ size and density, the tiresomeness of having to define them and the interest for several functionalities that can cover the aforementioned problems. Finally, our solution has been tested on stochastically generated and real policies in order to take performances and reactivity under consideration. Results of these tests have validated that our solution covers the underlined problems.

Molntjänster i olika former har fått en allt större roll för IT-drift inom många organisationer. Framförallt grundat i det faktum att molnteknik bidrar till förbättrad drift genom tillgång till ökad skalningsförmåga, vilket möjliggör att organisationer på ett flexibelt sätt kan hantera snabba förändringar vid inkommande arbetsbelastning. Att implementera egen lokal IT kräver även en hög kapacitet och stark resurstillgång, faktorer som inte alltid finns till hands. Beskrivna anledningar tillsammans med effekterna av Covid-19 pandemin har gjort att implementering och bruk av molntjänster ökat.  Fördelarna kommer dock inte utan nackdelar, molntjänster erbjuds ofta via molnleverantörer, vilket i sig inte behöver innebära en riskfaktor. Molntjänsternas struktur går däremot att koppla till en uppsjö av relaterade säkerhetsrisker, vilka till största del måste hanteras av leverantören. Konsumenten blir således beroende av att leverantören bibehåller säkerheten i molnet, ett stort förtroende placeras därmed till en extern aktör. Detta arbete fokuserar därför på att analysera hur konsumenten upplever förtroendet till leverantörens förmåga att bibehålla säkerheten relaterat till de säkerhetsrisker som kunnat kopplas till molntjänster. För att undersöka konsumentens upplevda förtroende till leverantören har en fallstudie med intervjuer som datainsamlingsmetod genomförts, fokus låg på att undersöka individer verksamma inom IT-branschen relaterat till molnfrågor.  Resultat visade på att förtroendet till leverantören i generell bemärkelse är högt, konsumenten litar på leverantörens förmåga att skydda tjänsterna mot intrång och bibehålla tillgängligheten. Vanligen rör det sig om stora välkända aktörer, konsumenten upplevde att detta talade för kapacitet och därmed en säkrare tjänst. Komplikationer uppkommer snarare kring juridiska aspekter och vem som äger tillgång till data, i detta anseende ansågs leverantörerna som mindre förtroendeingivande.

An organization with such a big responsibility as the Swedish armed forces constantly needs to find new ways to develop and increase their effectiveness when it comes to management, administration and organization. An information system with cloud computing as a basis would mean a modernization of the Swedish armed force’s administration and could potentially live up to the security standards within the organization. The primary goal of the thesis is to present and analyze cloud solutions that the Swedish armed forces eventually could integrate in to their activities. The first part of the thesis gives an introduction to the cloud technology with the security aspects of a cloud as a large part of the focus. This is followed by information about the Swedish armed forces and their current IT-systems, as well as information on the requirements they have for the implementation of new IT-systems within the organization. Two different cloud services from VMware and Cloudstack have been examined in order to see whether these could be used for a future implementation. The focus of the analysis lies heavily on the security issues and questions, that arise, for each solution, as the security aspect is something that is very important for the Swedish armed forces. The thesis also touches on the economical benefits and economical difficulties associated with cloud service implementation. The purpose of this is to see whether an eventual implementation is beneficial or not. / En organisation med ett så stort ansvar som Försvarsmakten behöver ständigt nya sätt att utvecklas och effektivisera sin drift, administration och organisation. Ett informationshanteringssystem i molnmiljö som grund skulle innebära en modernisering av administrationen inom organisationen och har potentialen att uppfylla Försvarsmaktens förbättringskrav. Arbetet har som huvudmål att ta fram och analysera lösningsförslag för hur Försvarsmakten skulle kunna använda sig av molnbaserade IT-system. I den första delen av arbetet ges en grundläggande introduktion till molnteknologin som även innefattar säkerhetsaspekter. Efter detta presenteras allmän information om Försvarsmakten, deras nuvarande IT-system samt de krav som ställs när det kommer till implementation av nya IT-system inom organisationen. Två olika molntjänster från WMware och Cloudstack undersöks för att se hur dessa skulle kunna användas för en eventuell implementation inom Försvarsmakten. Analysen av de två olika molntjänsterna fokuserar främst på säkerhetsaspekter, då det är ett viktigt fokusområde för Försvarsmakten. Ett annat område som arbetet har som syfte att undersöka är ekonomin för molntjänster. Detta för att se om en eventuell implementation är lönsam för Försvarsmakten eller inte.

Title: IT Security in Biomedicine Author: Ing. Anna Schlenker Supervisor: Ing. Milan Šárek, CSc. Abstract: The aim of this work is to propose a solution to the biomedical data security strategy. The work provides an overview of the most commonly used biometric methods designed to identify or authenticate users. From these methods, the keystroke dynamics was chosen and used in the application solution. The reliability of this method has been tested by classical and modern classification methods. The greatest benefit of the work is the use of the created application in combination with the measurement using integrated electromyography to objectify the evaluation of the work related to keyboard typing in terms of local muscle load. Keywords: Biometrics, Data Security, Keystroke Dynamics, Local Muscle Load

The amount of data and the development of new technologies used by all society-critical organizations are increasing dramatically. In parallel, data breaches, cyber-attacks, and their devastating consequences are also on the rise, as well as the number of individuals and organizations that are potential targets for such attacks. This places higher demands on security in terms of protecting data against cyber-attacks and controlling access to data that authenticated users want to access. The paper focuses on studying concepts of secure data practices in a GitLab-based cloud environment. The objective is to give answers to questions such as how to ensure the guarantee of secure data and protect it from unauthorized access and changes. The work behind this thesis includes exploring techniques for access control, data encryption, and data immutability. The study is followed by an implementation project that includes fetching code from GitLab verifying user identity and access control, managing data access, and displaying the results. The results of the thesis demonstrate the effectiveness of the implemented security measures in protecting data and controlling access. / Mängden av data och utvecklingen av banbrytande teknologier som idag används av alla samhällsbärande organisationer ökar drastiskt. I samma takt ökar dataintrång, cyberattacker och dess förödande konsekvenser samt antalet personer och organisationer som utgör potentiella offer för sådana typer av attacker. Detta ställer högre krav på säkerheten när det gäller att skydda data mot cyberattacker, men även att kontrollera åtkomsten till data som autentiserade användare vill komma åt. Rapporten fokuserar på att studera hur data säkras i GitLab-baserade molnsystem. Syftet med detta arbete är att ge svar på frågeställningar som till exempel att lova säker åtkomst och skydd för data från obehörig åtkomst och ändringar. Arbetet bakom detta projekt inkluderade undersökning av tekniker som används inom accesskontroll, datakryptering och data-omutlighet. Studien resulterade i en implementation som möjliggör att hämta signerade ändringar (Commits) från GitLab, verifiera användaridentiteten och åtkomstbehörighet, hantera dataåtkomst samt presentera resultaten. Resultaten av detta examensarbete demonstrerar effektiviteten av den implementerade säkerhetsteknikerna i att skydda data och kontrollera access.

<p>The prevalence of offline password attacks, resulting from attackers breaching authentication servers and stealing cryptographic password hashes, poses a significant threat. Users' tendency to select weak passwords and reuse passwords across multiple accounts, coupled with computation advancement,  further exacerbate the danger.</p> <p><br></p> <p>This dissertation addresses this issue by proposing password authentication mechanisms that aim to minimize the number of compromised passwords in the event of offline attacks, while ensuring that the server's workload remains manageable. Specifically, we present three mechanisms: (1) DAHash: This mechanism adjusts password hashing costs based on the strength of the underlying password. Through appropriate tuning of hashing cost parameters, the DAHash mechanism effectively reduces the fraction of passwords that can be cracked by an offline password cracker. (2) Password Strength Signaling: We explore the application of Bayesian Persuasion to password authentication. The key idea is to have the authentication server store a noisy signal about the strength of each user password for an offline attacker to find. We demonstrate that by appropriately tuning the noise distribution for the signal, a rational attacker will crack fewer passwords. (3) Cost-Asymmetric Memory Hard Password Hashing: We extend the concept of password peppering to modern Memory Hard password hashing algorithms. We identify limitations in naive extensions and introduce the concept of cost-even breakpoints as a solution. This approach allows us to overcome these limitations and achieve cost-asymmetry, wherein the expected cost of validating a correct password is significantly smaller than the cost of rejecting an incorrect password.</p> <p><br></p> <p>When analyzing the behavior of a rational attacker it is important to understand the attacker’s guessing curve i.e., the percentage of passwords that the attacker could crack within a guessing budget B. Dell’Amico and Filippone introduced a Monte Carlo algorithm to estimate the guessing number of a password as well as an estimate for the guessing curve. While the estimated guessing number is accurate in expectation the variance can be large and the method does not guarantee that the estimates are accurate with high probability. Thus, we introduce Confident Monte Carlo as a tool to provide confidence intervals for guessing number estimates and upper/lower bound the attacker’s guessing curves.</p> <p><br></p> <p>Moreover, we extend our focus beyond classical attackers to include quantum attackers. We present a decision-theoretic framework that models the rational behavior of attackers equipped with quantum computers. The objective is to quantify the capabilities of a rational quantum attacker and the potential damage they could inflict, assuming optimal decision-making. Our framework can potentially contribute to the development of effective countermeasures against a wide range of quantum pre-image attacks in the future.</p>

​​Cloud computing is an area that many companies use in order to stay in line with technological development. To keep these systems productive and easily managed, a reference architecture can be used as a framework and also as a manual on how to structure an organization to suit its specific needs and goals. The reference architecture can make it easier to divide responsibility as well as working tasks within an organization. One company facing the challenges that comes with cloud based systems is Vattenfall, one of the biggest energy companies in Europe. An organization like Vattenfall handles a great load of customer data which is to be controlled and protected in every way. In order to keep on making sure that these systems are efficient and secure, a reference architecture could be a helpful tool.   ​With the purpose of investigating how a section within Vattenfall’s IT department can use a reference architecture to determine the ownership of customers’ personal data more easily, an interview study was conducted. The interviews focused on evaluation of how employees’ reason when handling customers’ personal data within cloud environments. The reference architecture found most suitable for handling personal data was the international standard ISO/IEC 17789. It describes multiple work roles within cloud computing which can make the process of handling sensitive information clearer and easier. The data collected from the interviews was later applied to this reference architecture in order to see how it can be used in order to more easily divide responsibility. The study could in the end present several recommendations as to how the department should divide responsibilities and raise awareness regarding the topic amongst employees in order to increase data security.   ​Finally, the expected value created from implementing these recommendations and applying the reference architecture to the organization is expected to be high. The thesis concluded that the chosen reference architecture can be applied to the Vattenfall organization. With a few organizational changes, the responsibility regarding customers’ personal data can be divided more easily amongst the employees and the security can be improved. The recommendations presented could benefit the organization and raise awareness of the topic amongst employees.

<p dir="ltr">VANET is formed by vehicles, road units, infrastructure components, and various con- nected objects.It aims mainly to ensure public safety and traffic control. New emerging applications include value-added and user-oriented services. While this technological ad- vancement promises ubiquitous deployment of the VANET, security and privacy challenges must be addressed. Thence, vehicle authentication is a vital process to detect malicious users and prevent them from harming legitimate communications. Hover, the authentication pro- cess uses sensitive information to check the vehicle’s identity. Sharing this information will harm vehicle privacy. In this thesis, we aim to deal with this issues:</p><ul><li>How can we ensure vehicle authentication and avoid sensitive and identity information leaks simultaneously?</li><li>When nodes are asked to provide identity proof, how can we ensure that the shared information is only used by an authorized entity?</li><li>Can we define an effective scheme to distinguish between legitimate and malicious network nodes?This dissertation aims to address the preservation of vehicle private information used within the authentication mechanism in VANET communications.The VANET characteristics are thoroughly presented and analyzed. Security require- ments and challenges are identified. Additionally, we review the proposed authentication techniques and the most well-known security attacks while focusing on the privacy preser- vation need and its challenges.To fulfill, the privacy preservation requirements, we proposed a new solution called Active Bundle AUthentication Solution based on SDN for Vehicular Networks (ABAUS). We intro- duce the Software Defined Networks (SDN) as an authentication infrastructure to guarantee the authenticity of each participant. Furthermore, we enhance the preservation of sensitive data by the use of an active data Bundle (ADB) as a self-protecting security mechanism. It ensures data protection throughout the whole data life cycle. ABAUS defines a dedicated registration protocol to verify and validate the different members of the network.</li></ul><p dir="ltr">first solution focused on legitimate vehicle identification and sensitive data pro- tection. A second scheme is designed to recognize and eliminate malicious users called BEhaviour-based REPutation scheme for privacy preservation in VANET using blockchain technology (BEREP). Dedicated public blockchains are used by a central trust authority to register vehicles and store their behavior evaluation and a trust scoring system allows nodes to evaluate the behavior of their communicators and detect malicious infiltrated users.</p><p dir="ltr">By enhancing sensitive data preservation during the authentication process and detect- ing malicious attempts, our proposed work helps to tackle serious challenges in VANET communications.</p>

<p dir="ltr">In the modern, internet-connected world, online actions have a big impact. Organizational information system security is a complex issue, with both external attacks and internal vulnerabilities posing serious risks. Although there is ample evidence linking job discontent and stress in the context of insider threat prediction, the stress caused by a perceived lack of social support is mostly unstudied. This research seeks to address this gap by assessing how aggressive behaviors outside the workplace and the absence of offline social support can predict insider threat behaviors within organizations. Given the prevalence of insider threats, a comprehensive investigation into their motivations and actions is imperative. Understanding these dynamics can provide organizations with crucial insights to effectively manage this persistent risk. The widespread nature of insider threats calls for a thorough study into their roots, motives, and behaviors. By comprehensively analyzing these factors, companies can gain valuable insights into insider threats' dynamics and develop effective risk management strategies.</p><p dir="ltr">The study conducted a survey with 206 participants recruited through Amazon Mechanical Turk (MTurk), analyzing data using SPSS. The survey consisted of several questionnaires, including demographic information, insider threat traits, cyberaggressive behaviors, online and offline social support. The correlational analysis revealed significant variables related to insider threat characteristics. The results of the study suggested that Cyberbullying and Deception were significant predictors of Hacking and Identity Theft. Additionally, individuals displaying traits of Unwanted Contact and Online Harassment outside the workplace were more likely to exhibit insider threat behaviors within an organization. Notably, the lack of online social support was not found to be indicative of insider threats. However, the absence of offline social support was associated with an increased probability of individuals engaging in cybercrimes within organizational settings.</p><p dir="ltr">The findings suggest that organizations and information security policymakers should implement strategies to mitigate insider threats effectively. To manage insider threats, organizations should focus on behavioral cues, implement positive interventions and utilize technical monitoring to track online actions of insiders. Understanding the psychological, behavioral, and technical aspects of insider threats is crucial for early detection and prevention. Policymakers at companies should not only focus on traditional background checks related to criminal history but also consider psychological and behavioral factors to prevent insider threats effectively. By integrating these insights into policies and practices, companies can enhance their ability to mitigate potential insider threats effectively.</p><p dir="ltr">The present study augments the existing literature on insider threats and cyber aggression by examining the influence of stressors on employee behavior. Building upon prior research, this investigation delves into the nuanced impact of both offline and online social support systems on stress levels experienced by employees. It explores how the absence of adequate offline and online social support can exacerbate stress levels, consequently increasing the likelihood of insider threats and cyber aggression. In conclusion, the findings of this research contribute significantly to our understanding of the pivotal role of offline social support in mitigating workplace stress. Moreover, it underscores the importance of understanding individual online presence and background verification processes in evaluating potential risks within the workplace.</p>

<p dir="ltr">Our research revolves around the evolving landscape of Open-Source Software (OSS) supply chains, emphasizing their critical role in contemporary software development while investigating the escalating security concerns associated with their integration. As OSS continues to shape the software ecosystem, our research acknowledges the paradigm shift in the software supply chain, highlighting its complexity and the associated security challenges. Focusing on Debian packages, we employ advanced network science methods to comprehensively assess the structural dynamics and vulnerabilities within the OSS supply chain. The study is motivated by the imperative to understand, model, and mitigate security risks from interconnected software components.</p><p dir="ltr">Our research questions delve into 1) identifying high-risk packages 2) comparing risk profiles between source and build stages and 3) predicting future vulnerabilities. Data collection involves collecting source code repositories, build-info information, and vulnerability data of Debian packages. Leveraging a multifaceted methodology, we perform the following things: graph construction, subsampling, metrics creation, explorative data analysis, and statistical investigations on the Debian package network. This statistical approach integrates the Wilcoxon test, Chi-Square test, and advanced network dynamics modeling with machine learning, to explore evolving trends and correlations between different stages of the OSS supply chain.</p><p dir="ltr">Our goals include providing actionable insights for industry practitioners, policymakers, and developers to enhance risk management in the OSS supply chain. The expected outcomes encompass an enriched understanding of vulnerability propagation, the identification of high-risk packages, and the comparison of network-based risk metrics against traditional software engineering measures. Ultimately, our research contributes to the ongoing discourse on securing open-source ecosystems, offering practical strategies for risk mitigation and fostering a safer and more resilient OSS supply chain.</p>