The audit industry is under a digital transformation where various IT-tools are being frequently used by auditors at different experience levels. It is almost impossible to perform an audit with good results without using any IT-tools. Therefore, pressure is put on audit firms,both Big 4 and Non-Big 4 firms to stay ahead or at least up to date in terms of the digital development, implementation and usage of IT-tools to not fall behind its competitors. Educating the audit team members in the different information technology systems (IT) will be of great importance so that auditors can utilize new technology and enhance audit quality.This study contributes with practical knowledge by mapping out and describing in detail how and in which IT-tools auditors spend their time in during their commitments during a typical week. Secondly, the study provides insights on the current IT-knowledge among auditors, which is a factor that influences the use of IT-tools among auditors. Further, this also includes, getting an enhanced understanding of what type of IT-knowledge that is required today, for the audit team member at a specific level, ranging from associates to partners at Big 4 and Non-big 4 firms. Thirdly, the thesis will also discuss impacts of digitalisation and advanced technologies in auditing and give an update of to what degree advanced technologies has been implemented.This was possible to accomplish through an online questionnaire and interview sessions which implied that seven different types of software are used by auditors where Spreadsheet software is one of the most frequently used IT-tools. Auditors generally use software they are familiar with and a resistance towards new software exists. The study also highlights the discussion if the implementation and use of advanced technologies is as widespread as the auditing firms are picturing it. Additionally, there is still a general lack of IT-skills among auditors, and students seeing a future in the auditing profession would have to take responsibility over their own IT-knowledge increasement alongside with educators implementing more IT-courses for students studying Business administration.

The focus of this Master’s thesis project is automated penetration testing. A penetration test is a practice used by security professionals to assess the security of a system. This process consists of attacking the system in order to reveal flaws.  Automating the process of penetration testing brings some advantages, the main advantage being reduced costs in terms of time and human resources needed to perform the test. Although there exist a number of automated tools to perform the required procedures, many security professionals prefer manual testing. The main reason for this choice is that standard automated tools make use of techniques that might compromise the stability and integrity of the system under test. This is usually not acceptable since the majority of penetration tests are performed in an operating environment with high availability requirements. The goal of this thesis is to introduce a different approach to penetration testing automation that aims to achieve useful test results without the use of techniques that could damage the system under test. By investigating the procedures, challenges, and considerations that are part of the daily work of a professional penetration tester, a tool was designed and implemented to automate this new process of non-aggressive testing. The outcome of this thesis project reveals that this tool is able to provide the same results as standard automated penetration testing procedures. However, in order for the tool to completely avoid using unsafe techniques, (limited) initial access to the system under test is needed. / Det här examensarbete fokuserar i automatiserade penetrationstester.  Penetrationstester används av säkerhetsspecialister för att bedöma säkerheten i ett system. Processen av ett penetrationstest består av olika attacker mot ett system för att hitta säkerhetshål. Automatiserade penetrationstester har fördelar som faktumet att det kostar mindre i tid och i mänskliga resurser som krävs. Trots att det finns många olika automatiserade verktyg för penetrationstestning, väljer många säkerhetsspecialister att göra det manuellt. Den största anledningen till att det görs manuellt är för att automatiserade verktygen använder sig av tekniker som kan kompromissa systemets stabilitet samt integritet. Det tillåts ofta inte, eftersom majoriteten av penetrationstesterna utförs i produktionsmiljöer som kräver hög tillgänglighet. Målet för det här examensarbetet är att introducera ett nytt tillvägagångssätt för automatiserad penetrationstestning, som inriktar sig på att ta fram användbara resultat utan tekniker som kan störa system under drift. Genom att undersöka procedurerna, utmaningarna samt vad som en penetrationstestare tar hänsyn till kommer ett verktyg designas och implementeras för att automatisera flödet av ett icke-aggressivt test. Resultatet av examensarbetet visar på att verktyget utvecklat kan uppnå samma resultat som de standardiserade penetrations-procedurerna givet begränsad tillgång till systemet.

Svenska skolan har genomgått många förändringar, däribland inkluderingen av digitala hjälpmedel i undervisningen. Ökad användning av digitala verktyg ställer krav på lärarna, det vill säga att de måste öka sitt digitala kunnande i takt med utvecklingen. Hem- och konsumentkunskap (HKK) är inte bara ett praktiskt ämne, vilket kan göra det gynnsamt att implementera digitala hjälpmedel iundervisningen. Syftet med undersökningen var att redogöra för hur den digitala utvecklingen har påverkat den enskilde HKK läraren. En kvalitativ metod användes i form av sju intervjuer med yrkesverksamma lärare i ämnena HKK, matematik/NO, textilslöjd och engelska/SO under hösten 2021. Urvalet av lärare baseras på att det var brist på tillgängliga HKK-lärare och att de andra ämnena berör liknande kunskapskrav som HKK. Intervjuerna var semi-strukturerade och tog stöd av en intervjuguide. Data samlades in, bearbetades och analyserades utifrån en kvalitativ innehållsanalys. Resultatet visade att samtliga informanter var positiva till digitaliserad undervisning. Tid, planering och IT- kunskap var förutsättning för implementering i undervisningen. Digitalisering anses vara både tidssparande och tidsslukande. Tid för planering och inhämtande av kunskap omdigitala program är en förutsättning för digitalisering i undervisningen. Digital undervisning utövas i stor utsträckning. Det digitala hjälpmedlet kunde bli en distraktion för eleverna och de tappade lätt fokus. Differentierad undervisning med hjälp av digitala hjälpmedel kunde gynna vissa elever. / The Swedish school system has undergone many changes, including the inclusion of digital aids ineducation. Increased usage of digital tools places demands on teachers where they must increase their digital know-how in step with development. Home and consumer studies (HCS) is not just a practical subject, which can make it beneficial to implementation of digital aids in teaching. The objective of this examination was to account for how the digital development has affected the individual Home and consumer studies teacher. A qualitative method has been used in the form of seven interviews with professional teachers in the subject Home and consumer studies, Mathematics/Science and English/Social studies during the autumn of 2021. The selection of teachers is based on the lack of available HCS teachers and that the other subjects refer to similar points of the curriculum. The interviews have been supported by a semi-structured interview guide. Data has been collected, processed, and analyzed using a qualitative content analysis. The results showed that all participants were positive to digitalized teaching. Time, planning, and IT knowledge were prerequisites for implementation in teaching. Digitization is considered to be both time-saving and time-consuming. Time for planning and acquiring knowledge about digital programs is a prerequisite for digitization in teaching. Digital teaching is practiced to a large extent. The digital aid could become a distraction for the students, and they easily lost focus. Differentiated teaching using digital aids could benefit some students.

Caesarcipher is a commonly known encryption method although it is known for being unsure, even long before computers were invented. Even though it is unsure it can still be used for cryptography, JackTheRidder consists of two main algorithms where one of them is based on the Caesarcipher. With many rotations of Caesarciphers on different parts of texts, like many Vigenerecryptos of different sizes overlapping each other, makes the encryption secure. The other main algorithm of JackTheRidder is based on the Collatz Conejcture, which is a famous unsolved mathematical problem. This algorithm counts the amount of steps it takes before the chosen number reaches 1 and then moves the letter with those steps which results in the encryption. The amount of steps is a result from a positive integer going through Collatz Conjecture, which divides the integer if its even and uses (3𝑥+1)/2 if the integer is odd. The algorithm then moves to the next character to encrypt and adds one to the integer used. JackTheRidder is an encryption method created by the authors of this project and further will be analyzed in this essay. The focus of this essay is to analyze how Collatz Conjecture and Caesarcipher functions in encryption methods. JackTheRidder is going to be examined through literature study and experiments. There are three criterias that JackTheRidder is going to be analyzed from; security, robustness and efficiency. The results indicate that JackTheRidder needs to be optimized and be written in machine code for it to be able to get better implemented in society. JackTheRidder is proven to be better than AES in the chi2 test which is an indicator that it might be a viable option for replacement. Overall in the experiments, JackTheRidder held a high level which is a positive outcome but still it is not guaranteed to be secure enough to be implemented into the society at this stage of developement.

I detta arbete har det undersökts om vilka åtgärder som är möjliga och rimliga för en privatperson att vidta för att säkra de onlinetjänster som de använder sig av i vardagen. Fortsättningsvis undersökt hur säkerhetsmedvetna individer faktiskt är, när det kommer till dessa onlinetjänster. En litteraturstudie kom fram till att enklare åtgärder likt lösenordshanterare och tvåfaktorsautentisering är enkla och effektiva åtgärder för en privatperson i syfte att skydda deras onlinetjänster. Via en enkätstudie kunde slutsatsen dras att mindre än hälften av svaren visar på ett säkerhetsmedvetet beteende vilket skulle kunna innebära en öppning för olika typer av IT-incidenter. Samtidigt går det att se ett positivt samband mellan säkerhetsmedvetna val och den respondentens upplevda säkerhetsmedvetenhet och IT-kompetens, vilket indikerar på att utbildning och information har en positiv inverkan på säkerhetsmedvetenheten kring onlinetjänster och de åtgärder som kan vidtas för att skydda dessa.

Idag förväntas IT-konsulter kunna utföra en större variation av arbetsuppgifter och besitta kunskap inom fler tekniska områden än någonsin tidigare. Då komplexiteten inom IT industrin tydligt trappats upp, en komplexitet som konsulterna förväntas kunna hantera bra, har det blivit allt viktigare för varje konsult att arbeta effektivt och därmed bidra till IT-konsultföretagens totala effektivitet. Denna studie undersöker därför hur den interna effektiviteten inom IT-konsultföretag skulle kunna ökas och hur företagens ledare bör agera för att öka effektiviteten kortsiktigt som långsiktigt. Vår studie bygger på en fallstudie baserad på 17 intervjuer och två workshops genomförda på ett svenskt IT-konsultföretag lokaliserat i Stockholm, samt på tre externa intervjuer och en kontinuerlig och iterativ litteraturstudie. Den interna effektiviteten inom IT-konsultföretag skulle kunna ökas genom förbättring av de individuella aktiviteterna anslutna till deras organisationsrutiner. De individuella aktiviteterna som indikerar störst potential för ökad intern effektivitet är de lågt prioriterade aktiviteterna; individuella aktiviteter som konsulterna tenderar att prioritera lägre, vilket ofta resulterar i att aktiviteterna förskjuts. Dessa aktiviteter är genomförda mer ineffektivt än andra individuella aktiviteter är på grund av fyra gemensamma rotorsaker: (1) bristande strukturkapital, (2) bristfälligt stöd av organisationskulturen, (3) otillräckliga kommunikationspolicys, and (4) brist på incitament. Denna studie tillhandhåller därtill konkreta åtgärder för hur detta kan hanteras kortsiktigt som långsiktigt av gruppledarna respektive ledningsgruppen i IT-konsultföretag. / Today’s IT consultants are expected to carry out an increasing variety of tasks and possess knowledge within more technology areas than previously. As the complexity within the IT industry evidently is stepping up and the consultants are expected to manage this complexity well, it becomes more crucial than ever for each consultant to work efficiently and contribute to the IT consultancy firms’ overall efficiency. This research therefore investigates how the internal efficiency within IT consultancy firms could be increased as how the firms’ leaders should act in order to enhance the efficiency in the short and long run. Our research is based on a case study of 17 interviews and two workshops performed at a Swedish IT consultancy firm located in Stockholm, as well as three external interviews and a coherent and iterative literature review. The internal efficiency within IT consultancy firms could be increased by improving their individual activities attached to their organisational routines. The individual activities indicating the greatest potential to increase the internal efficiency are the low-prioritised activities - individual activities that consultants tend to prioritise lower, which often results in postponement of the activities. Why these activities are performed more inefficiently than other individual activities are due to four common root causes: (1) insufficient structural capital, (2) insufficient cultural support, (3) poor communication policies, and (4) lack of incentives. Concrete actions for how this could be operated in the short as well as the long run, are provided by this research. Its managerial implications are therefore directed towards the team managers as well as top management within IT consultancy firms.

Bakgrund: IT-branschen spelar en central roll för Sveriges ekonomiska tillväxt och räknas idag som enbasindustri. Trots att en inkludering av kvinnliga medarbetare är värdeskapande både ur ett socialt ochekonomiskt perspektiv är män överrepresenterade i IT-branschen idag. Rekryteringsprocessen är ennyckelprocess inom SHRM som kan utformas för att nå organisatoriska mål. Syfte: Att beskriva IT-bolags utformning av aktiviteter i rekryteringsprocessen för att nå en mer jämlikkönsfördelning på arbetsplatsen. Metod: Studien antar en induktiv ansats, dock med inslag av deduktion då en förförståelse omrekryteringsprocessens steg samt strategiskt HRM är framtagen. En fallstudie med nio semistruktureradeintervjuer har genomförts för att samla in relevanta empiriska data. En tematisk analys genomfördes föratt frambringa fem olika huvudteman som sedan förankrades i relevant teori. Den empiriska data ochteorin analyserades sedan tillsammans. Slutsats: Studien frambringar tre aspekter; medvetenhet, marknadsföring och opartiskhet som allapåverkar utformandet av rekryteringsaktiviteter för att skapa en mer jämlik könsfördelning. Det framkomäven fyra utmaningar som kan hindra utformandet av aktiviteterna. Utformandet och utmaningarnagynnas av att verka i en SHRM-kontext. / Background: The IT sector is considered a great contributor for Sweden’s economic growth and countsas one of the primary industries. Despite the fact that inclusion of women adds a higher economic andsocial value, men continues to be over-represented in the industry. The recruitment process plays a keyrole in the context of SHRM and should be aligned with organisational goals. Purpose: To describe the configuration of IT-businesses activities in the recruitment process to reach aneven gender distribution in the workplace. Method: The study adopts an inductive approach, however with deductive elements containing a preunderstanding of the steps included in the recruitment process and strategic HRM. A case study wasconducted with nine semi-structured interviews to collect relevant empirical data. A thematic analysiswas carried through to produce five main themes that was later anchored in relevant theory. Theempirical data and relevant theory were subsequently co-analysed. Conclusion: Our findings identify three main aspects; awareness, marketing and impartiality that cofunctions and affects the configuration of IT-businesses activities in the recruitment process while aimingfor an even gender distribution. Four challenges were additionally identified as hindering theconfiguration of the recruitment activities, Configuration and challenges benefits from being re-enacted inthe context of SHRM.

A challenge for healthcare organizations is that operational efficiency suffers from variation in production. This is because variation in healthcare is hard to predict and the methods and IT-support tools for handling variation are suboptimal. The concept of production control can be used to describe the coordination of activities so that healthcare can be delivered on time, of adequate quality and at a reasonable cost, and thus includes the use of IT-support tools to handle variation. The objective of this report is to suggest improvements for production control in hospital departments through the development of a prototype for a new IT-support tool. In order to achieve this, a case study was conducted at the pediatric oncology department at Karolinska University Hospital (KS). The case study includes observations and interviews to investigate production control at department Q84, as well as associated roles and IT-support tools. Four IT-support tools were identified at the department, two of which were used interchangeably. Due to lack of integration between these systems and the fact that one system contained data manually synchronized from the other, handling changes required double labor. An improvement suggestion is therefore presented, consisting of a prototype which demonstrates that production control can be improved by automating the maintenance of a system at the department while fulfilling the organization’s information security policy. The development of the prototype was aligned with the lean philosophy which KS strives to adopt. Through an investigation of the production system, a role for production control and associated IT-support tools at a hospital department can be identified and analyzed and through the prototyping of an IT-support tool for production control, improvements and optimizations can be made.

A challenge for healthcare organizations is that operational efficiency suffers from variation in production. This is because variation in healthcare is hard to predict and the methods and IT-support tools for handling variation are suboptimal. The concept of production control can be used to describe the coordination of activities so that healthcare can be delivered on time, of adequate quality and at a reasonable cost, and thus includes the use of IT-support tools to handle variation. The objective of this report is to suggest improvements for production control in hospital departments through the development of a prototype for a new IT-support tool. In order to achieve this, a case study was conducted at the pediatric oncology department at Karolinska University Hospital (KS). The case study includes observations and interviews to investigate production control at department Q84, as well as associated roles and IT-support tools. Four IT-support tools were identified at the department, two of which were used interchangeably. Due to lack of integration between these systems and the fact that one system contained data manually synchronized from the other, handling changes required double labor. An improvement suggestion is therefore presented, consisting of a prototype which demonstrates that production control can be improved by automating the maintenance of a system at the department while fulfilling the organization’s information security policy. The development of the prototype was aligned with the lean philosophy which KS strives to adopt. Through an investigation of the production system, a role for production control and associated IT-support tools at a hospital department can be identified and analyzed and through the prototyping of an IT-support tool for production control, improvements and optimizations can be made.

This report investigates the modelling power of the Cyber Security Modelling Language, CySeMoL by looking at three documented cyber attacks and attempting to model the respective systems in which they occurred. By doing this, strengths and weaknesses of the model are investigated and proposals for improvements to the CySeMoL model are explored. / Denna rapport undersöker modellingsförmågan hos Cyber Security Modelling Language, CySeMoL genom att titta på tre dokumenterade IT-angrepp och försöka modellera systemen som respektive attack skedde i. Genom att göra detta undersöks styrkor och svagheter i modellen och förslag på förbättringar till modellen utforskas.