Cybersecurity is an issue of great concern today; data breaches are becoming more frequent and are causing huge economic losses in almost all the industry sectors. The majority of them are caused by malicious or criminal attacks perpetrated by individuals also known as “hackers”. Although the mainstream portrait of hackers nowadays brings to mind the idea of cybercriminals, not all hackers are malicious ones. The word hacker in its original sense only describes a computer enthusiast and a skilled programmer who was eager to learn how computers work. The key to distinguish a good or a bad hacker lies only in the specific intent and the permission to hack. Recently many companies are indeed hiring hackers to test their systems and protect them from the malicious attacks. The strength of good hackers is that they possess the same skills as malicious ones but they use them to enhance security. At the present stage, the process of hiring candidates for internet security positions for the majority of organizations, and business corporations relies mainly on interviews, while few of them advertise some sort of hacking challenges to be solved by potential applicants in order to evaluate upfront their skills and abilities. Moreover, an in-depth review of the literature has revealed that, so far, no systematic investigation has been carried out on the cognitive skills that characterise ethical hackers, experts who are professionally trained to protect systems’ security. The present PhD thesis offers a contribution that starts filling this gap in the literature with an exploratory investigation on the cognitive skills related with hacking expertise on a behavioural level. Findings show that hackers possess stronger systemizing traits as compared to the general population, and suggest a role of the ability to systemize on hacking performance. Moreover, performance on hacking-related tasks is shown to be related with mental rotation abilities and a field independent cognitive style. These findings have both theoretical and practical applications that are extensively discussed; together with possible future directions.

Práce se zabývá pozicí lidí v bezpečnosti informačních systémů. První část se zaměřuje na běžné uživatele a přináší rozbor toho, jaké nejčastější nebezpečí jim hrozí. Velká část je věnována představení nejčastějších typů hackerských útoků jako phishingu, sociotechnice a nebo malwaru. Čtenáři jsou pak prezentovány možné opatření, které je možné udělat, aby se dopady hackerských útoků snížily. Druhá část práce pak přináší manažerský pohled na bezpečnost lidských zdrojů. V práci jsou ukázány styčné plochy a možnosti řízení této oblasti z pohledu ITIL Security Managementu, ČSN ISO/IEC 13335 a ČSN ISO/IEC 27001. Výsledkem je pak souhrn doporučení, které může management společnosti v oblasti bezpečnosti lidských zdrojů přijmout. Opatření jsou koncipována tak, aby je bylo možné přijmout bez ohledu na to, jaká norma a nebo standard se používá k řízení bezpečnosti v podniku.

“The Freedom of Information Hacked: Console Cowboys, Computer Wizards, and Personal Freedom in the Digital Age” examines depictions of computer hackers in fiction, the media, and popular culture, assessing how such depictions both influence and reflect popular conceptions of hackers and what they do. In doing so, the dissertation demonstrates the central concerns of hacker stories—concerns about digital security, privacy, and the value of information—have become the concerns of digital culture as a whole, hackers laying bare collective hopes and fears regarding digital networks.

This report attempts to trace a path through my time in higher education, from an undergraduate degree in English to the completion of my Master's degree in Media studies. The report will focus on examining how school has differed from my expectations, and how my difficulties and struggles therein led me through various class models and modes of learning. In the course of retelling the projects and studies I worked on, I will compare different methods of pedagogy, from the typical grad school class to the free-form space of the ACTLab. I close by reflecting on how a report on my own time here at UT might be useful to others unsure of how grad school is supposed to go, much I was when I started out. / text

This paper discusses the ways in which Hofstede’s model of ‘dimensions of (‘national’) culture’ – and similar models developed in a functionalist paradigm – are problematically used to classify people. It briefly surveys critiques of Hofstede’s research method, but focusses on the dangers of attempting to develop models of culture within a functionalist paradigm. Although such models may be parsimonious and rapidly applied, I argue that they are a poor fit for CATaC investigations of the dynamic and reciprocal interactions between human cultures and technology. Instead, I contend, we must abandon this paradigm, and embrace methodologies that permit meaningfully explorations of the multiple and dynamic conditions influencing the field of cultural practices in human societies. I discuss the merits of ‘articulation’ as theory and method, and offer Hacking’s theory of “dynamic nominalism” as one example.

A component to some forensic cases is being able to identify tool class, whether it is a murder weapon or if a tool was used postmortem in dismemberment. The goal of the present study is to determine if it is possible to identify tool class macroscopically and/or what level of force was applied in cases involving hacking. Three hypotheses are proposed. The first is that the cutmarks would appear differently at the varying levels of impact force for the same implements, including patterns of fractures, number of fragments, size of fragments, and appearance of the cutmark, i.e., the kerf. The second hypothesis is that there would be observable macroscopic differences on the cutmarks between tool classes, and the ability to distinguish between tool classes will not be affected by the differences from various levels of force of impact. The third hypothesis is that these observable macroscopic differences can be used to create prediction tables that can be used for predicting tool class and the level of force applied. Using a device created to simulate hacking, the long bones of white-tailed deer (Odocoileus virginianus), a chef’s knife, cleaver, machete, and axe were tested at three different impact forces each. The author examined the hack marks on the bones quantitatively by measuring the kerf width and depth, number of fragments present, as well as qualitatively by describing any fractures present and the appearance of the entrance and exits. It was found that there is a statistically significant relationship between the implement and the entrance width (p-value = 7.27e-13). There is a statistically significant relationship between the force of impact and the entrance width (p-value = 5.57-06), overall entrance appearance (clean cut: p-value = 2.40e-06; chattered: p-value = 0.004), and conchoidal flaking (p-value = 0.025). There is also a statistically significant relationship between the implement and the level of force as a combined influence, as opposed to separate influences, and if the overall appearance of the entrance is chattered (p-value = 0.017). These relationships support the first two proposed hypotheses. Recursive partition and regression trees were created for each implement to determine what characteristics may be used to create prediction guides based on the collected data. The results of the experiment were used in the creation of an implement prediction guide and force of impact prediction tables. A blind test showed that the implement prediction guide was accurate 50% of the time and that the force of impact prediction tables were accurate 10% of the time. While this is low accuracy, it indicates that this research has potential to help with hacking trauma analysis as a baseline for future research, but is not applicable at this time, accepting the null hypothesis for the third hypothesis.

I detta arbete uppmärksammas problematiken kring SME i relation till ITIL utifrån ett säkerhetsperspektiv. Arbetet baseras på två fallstudier där en av dessa två är mer djupgående och därmed behandlas som huvudsaklig. Dessa två fallstudier analyseras sedan utifrån en teoretisk grund baserad på litterära, vetenskapliga och muntliga källor som bearbetats utifrån studiens två övergripande frågeställningar: Vilka är de avgörande faktorer som påverkar organisationen under en ITIL implementation och vilka skillnader finns det mellan större och mindre organisationer i relation till säkerhet? Studiens huvudsakliga slutsatser är att det går att de övergripande faktorer som påverkar en implementation är relaterade till hur organisationen hanterar den organisatoriska förändring som sker i samband med implementationen samt hur de förhåller sig till ITIL innan implementationen. Vidare finner studien att det går att ifrågasätta om storleken på organisationen verkligen är en avgörande faktor i relation till arbetet med säkerhet och att det mer handlar om de kulturella skillnaderna mellan större organisationer och SME. / This work addressed the problem of SMEs in relation to ITIL from a safety perspective. The work is based on two case studies in which one of these two is more profound and thus treated as principal. These two case studies are analyzed from a theoretical foundation based on literary, scientific and oral sources that are processed on the basis of the study's two overarching questions: What are the crucial factors affecting the organization during an ITIL implementation and what are the differences between large and small organizations in relation to security? The study's main conclusions is that it is possible that the overall factors affecting the implementation are related to how the organization handles the organizational change that occurs in the context of implementation, and how they relate to ITIL before implementation. Further, the study finds that it is possible to question whether the size of the organization is really a critical factor in relation to the work on security and that it is more about the cultural differences between large organizations and SMEs.

Computer networks are used in much wider extent than 20 years ago. People use the computer mainly for communication, entertainment and data storage. Information is often stored only in electronic devices and that is why the security of the data is so important. The objective of my thesis is to describe network security problems and their solutions. First chapter deals with the network security, security checks and attacks. It describes procedures used in practise. First part deals with traffic scanning and filtering at various layers of the TCP/IP model. Second part presents the types of proxy and its pros and cons. Network Address Translation (NAT) is a favourite technique of managing IP addresses of inside and outside network which helps to improve the security and lower the costs paid for IP addresses. NAT description, IPSec, VPN and basic attacks are described in this section. The second chapter of the thesis presents set of Perl scripts for network security checking. The purpose of the project is not to check the whole network security. It is designed for contemporary needs of IBM Global Services Delivery Centrum Brno. The first script checks running applications on target object. The aim is to detect services that are not necessary to run or that are not updated. The second one checks the security of the Cisco device configuration. There is a list of rules that has to be kept. The third script inspects the Nokia firewall configuration which is on the border of IBM network. If some of the rule is broken, it shows the command that has to be proceeded at the particular device. The output of the first and the second script is an HTML file. The third script uses the command line for the final report. The last part of this chapter gives advice to configure Cisco devices. It is a list of security recommendations that can be used by configuring e.g. routers. The appendix presents two laboratory exercises. The aim is to give students an opportunity to learn something about programs and technologies which are used in practise by IT experts to check the weaknesses of their networks.

Academic institutes' networks, like commercial networks, have confidential and valuable information that attracts hackers. From 6 October 2000 to 29 March 2001, the authors collected data on possible attacks and probes against East Tennessee State University's campus network. The number of suspicious activities detected daily varied from 200,000 to more than 2,000,000, with ICMP-based attacks accounting for more than 81% of all attacks. While ICMP-based attacks were reasonably harmless, these activities as a whole depleted network bandwidth significantly. Severe attacks were detected daily. Port scans and host scans that involving 2 or more /24 subnets were detected every week. Attacks and probes were distributed throughout a typical day and week. Our research results suggested policy makers in academic institutions like ETSU should adopt standard measures to secure campus networks, including firewalls, intrusion detection systems, server management, and risk assessment.

Application Programming Interfaces (APIs) are essential in the digital realm as the bridge enabling seamless communication and collaboration between diverse software applications. Their significance lies in simplifying the integration of different systems, allowing them to work together effortlessly and share data. APIs are used in various applications, for example, healthcare, banks, authentication, etc. Ensuring the security of APIs is critical to ensure data security, privacy, and more. Therefore, the security of APIs is not only urgent but mandatory for pentesting APIs at every stage of development and to catch vulnerabilities early. The primary purpose of this research is to provide guidelines to help apply existing tools for reconnaissance and authentication pentesting. To achieve this goal, we first introduce the basics of API and OWASP's Top 10 API security vulnerabilities. Secondly, we propose deployable scripts developed for Ubuntu Debian Systems to install pentesting tools automatically. These scripts allow future students to participate in API security courses and conduct API security pentesting. API security pentesting, regarding reconnaissance and authentication, is discussed based on the configured system. For reconnaissance, passive and active approaches are introduced with different tools for authentication, including password-based authentication brute-forcing, one-time password (OTP) brute-forcing, and JSON web token brute force.