Mémoire numérisé par la Direction des bibliothèques de l'Université de Montréal.

In this Master Thesis, several common applications and Windows operating systemservices are modeled within the field of information security. This thesis focuses onapplying the Enterprise Architecture Analysis Tool (EAAT) and the Cyber SecurityModeling Language (CySeMoL), which are developed by the Department of IndustrialInformation and Control System (ICS) at KTH. The overall objective of this study is todetermine the probability of the CySeMol model with a particular kind of attack. Theproject models six common applications on Windows platform and two Windowsoperating system services. The detailed information regarding the applications and defensemechanism are acquired from various sources. A few experiments have been carried out tovalidate the correctness of the predicted probabilities calculated by the CySeMoL. Theresults of the analysis suggest that the CySeMoL model has a good performance onoperating system vulnerability prediction. At last, some possible suggestions in the contextof the CySeMoL model are given.

In this Master Thesis an Enterprise Architecture Decision Making analysis is proposed within the field of Enterprise Architecture. A case study at a company within the financial sector has been conducted for validation of the proposed analysis. Firstly, the Enterprise Architecture Analysis Tool (EAAT), which has been developed by the Industrial Information and Control Systems (ICS) department of KTH, is described. This tool has been used during the whole Case Study in order to create present and possible future state models for measuring Service Availability. These models, which are based on a Metamodel, make possible the analysis of the Service Availability. Finally, some future research suggestions in the context of decision-making in Enterprise Architecture with EAAT are given.

No description available.

A case study at a global pharmaceutical company has been conducted toanalyse how the Hidden Structure method using the Enterprise Architecture Analyses(EAAT) tool, developed at KTH, can be used to visualize the IT architecture and tocreate a better understanding on which applications could increase a risk of therobustness of the architecture if changes was done to them. Also the measure of ITsupport metrics as incidents and changes per system has been analysed to understandif they can be used to understand the robustness of the incident. The tool was used tocreate a model of the enterprise architecture of the company and the analysis showedthat the robustness of the IT architecture was good; the core applications that couldcreate most damage were identified. The analysis of the IT support metrics showedthat it was difficult to use the change records as indicators since the number ofchanges per systems were very few. The incident analysis showed that the systemswith the highest number of incidents were classified as belonging core or peripheralcategory.

In this Master Thesis, several common applications used with MySQL and Linux server are modelled using the Enterprise Architecture Analysis Tool (EAAT) and the Cyber Security Modelling Language (CySeMoL), both developed by the Department of Industrial Information and Control System (ICS) at KTH. The objective of this study is to use the CySeMoL tool to evaluate the feasibility and correctness of the tool by simulating some particular type of attacks on a real life Linux server. A few common applications with MySQL on a Linux server and two Linux operating system services are modelled and explained together with their detailed information and defense mechanisms. A real life penetration test has then been carried out in order to validate the simulated results from the tool. The results of the analysis suggest that the security vulnerability predictions done by CySeMoL on a Linux server has good predictive performance. / I denna Masteruppsats modelleras ett antal vanliga applikationer på en MySQL- och Linuxplattform med hjälp av Enterprise Architecture Analysis Tool (EAAT) tillsammans med Cybersecurity Modeling Language (CySeMoL). Båda dessa är utvecklade vid avdelningen för industriella informations- och styrsystem (ICS) på KTH. Syftet med denna studie är att validera korrektheten av CySeMoL-verktygets sårbarhetsprediktioner genom att simulera ett antal specifika cyberattacker mot en Linuxplattform. Ett antal vanligt förekommande applikationer på en MySQL-plattform samt två operativsystemstjänster i en Linuxserver modelleras. Penetrationstest utförs därefter för att validera resultaten som simuleras i CySeMoL-verktyget. Studien visar att CySeMols förutsägelser stämmer väl med resultaten av penetrationstesterna.

This report describes a study aimed at verifying a cyber security modeling language named the Predictive, Probabilistic Cyber Security Modelling Language. This modeling language together with the Enterprise Architecture Analysis Tool acts as a tool for cyber security evaluations of system architectures. To verify the accuracy and readiness of the tool, a generic model of a real life Supervisory Control And Data Acquisition System’s system architecture was modeled using the tool and later evaluated. The evaluation process consisted of a Turing test, which was the same method used for evaluation of the Predictive, Probabilistic Cyber Security Modelling Language predecessor the Cyber Security Modelling Language. For the Turing test, interviews were held with five domain experts within cyber security. Four of which were tasked with creating attack paths given a scenario in the modeled system architecture. The Predictive, Probabilistic Cyber Security Modelling Language was given the same task as the four experts. The attack paths created were consolidated in a standardized form for the last internal company expert within cyber security to evaluate. An expert evaluator was tasked with grading the attack paths produced by the four experts and the Predictive, Probabilistic Cyber Security Modelling Language. The grading was based on how probable the attack paths were perceived by the internal expert.  The conclusion was made that given the limitations of the study, the Predictive, Probabilistic Cyber Security Modelling Language produced a cyber security evaluation that was as probable as those created by the human cyber security experts. The results produced were also consistent with the results produced by the Predictive, Probabilistic Cyber Security Modelling Language predecessor the Cyber Security Modelling Language in a previous study. Suggestions for further studies were also introduced which could complement this study and further strengthen the results. This thesis was a collaboration between ABB Enterprise Software and the members of the team behind the Predictive, Probabilistic Cyber Security Modelling Language at ICS at KTH. / Denna rapport beskriver en studie vars mål var att verifiera ett modelleringsspråk för datasäkerhet vid namn Predictive, Probabilistic Cyber Security Modelling Language. Detta modelleringsspråk tillsammans med Enterprise Architecture Analysis Tool utgör ett verktyg för datasäkerhetsutvärderingar av systemarkitekturer. För att verifiera exaktheten och mognadsnivån på verktyget så skapades en generisk modell av ett verkligt Supervisory Control And Data Acquisition System-systems arkitektur. Denna modell utvärderades i ett senare skede. Utvärderingsprocessen bestod av ett Turingtest, som är samma metod som användes i en tidigare utvärdering av Predictive, Probabilistic Cyber Security Modelling Languages föregångare Cyber Security Modelling Language. För Turingtestet hölls fem intervjuer med domänexperter inom datasäkerhet. Fyra av dessa fick i uppgift att skapa attackvägar givet ett scenario i den modellerade systemarkitekturen. Attackvägarna som skapades sammanställdes i ett standardiserat formulär för den sista interna företagsexperten inom datasäkerhet att utvärdera. En expertutvärderare fick i uppgift att betygsätta de attackvägar som hade producerats av de fyra experterna och Predictive, Probabilistic Cyber Security Modelling Language. Betygsättningen baserades på hur sannolika de olika attackvägarna uppfattades av den interna experten. Slutsatsen som gjordes var att givet begränsningarna i studien, så producerade Predictive, Probabilistic Cyber Security Modelling Language en datasäkerhetsutvärdering som var likvärdigt sannolik jämfört med de som skapades av mänskliga experter. Resultaten som producerades var också konsistenta med resultaten som producerades av Predictive, Probabilistic Cyber Security Modelling Language föregångare Cyber Security Modelling Language i en tidigare studie. Förslag på kommande studier som skulle komplettera denna studie och stärka resultaten ytterligare introducerades också. Detta examensarbete var ett samarbete mellan ABB Enterprise Software och medlemmarna i teamet bakom Predictive, Probabilistic Cyber Security Modelling Language på ICS på KTH.

This project presents a case study of modifiability analysis on the Information Systems which are central to the core business processes of Royal Institution of Technology in Stockholm, Sweden by creating, updating and using models. The case study was limited to modifiability regarding only specified Information Systems. The method selected was Enterprise Architecture together with Enterprise Architecture Analysis research results and tools from the Industrial Information and Control Systems department of the same University. Jointly used with the ArchiMate modelling language, to create the models and perform the analysis. The results demonstrated to be very varied in regards to system models and modifiability. The Alumni Commu-nity system seemed to have very high modifiability whereas the Ladok på Webben system seemed to have the low modifiability, and other systems ranging differently or in between. The case study results found three slightly more critical systems of all the systems analysed: Ladok på Webben, Nya Antagningen & La-dok Nouveau. The first two showed to have either very low or low modifiability while being highly coupled to the other systems. Therefore any modification to these two systems would most likely cause effects that would require change in interconnected systems. Whereas Ladok Nouveau, while having average modifia-bility, has a critical position to process activities, is nearly isolated from all other systems, making them indi-rectly dependent on the system through the interconnected LADOK database. The study showed that the systems developed at KTH are comparable with systems developed by commercial enterprises in terms of modifiability. The study also provided insight into an Enterprise Architecture where the systems have dif-ferent development origins and how this could affect modifiability and analysis.