The diploma thesis deals with the design of implementation of information security management system in IT company, deals with metrics for measuring the effectiveness of the system, according to the international standards ISO/IEC 2700x. The thesis solves invested resources in the establishment of the system. The thesis provides a summary of theoretical knowledge of information security management system, analyzes the current situation in the company and propose measures to increase security in the company.

The aim of this study is aproposal of ICT Security Management implementation in a specific Basic school. Introduction describes the school building, its equipment and existing Security Management. The practical part consists of a discussion about current shortcomings and proposed set of measures for solving the most important problems in terms of management of ICT security.

The goal of this project is to develop a analyzer of communication between a smart card and reader terminal. The analyzer should be able to diagnose and control correlations of standards.  The thesis include description of standards to be familiar with and a detail description of standard ISO/IEC 7816-3, that introduce monitored protocol. The thesis also involves development kit features and a design of application.

This thesis describes the design and implementation of ISMS to a particular high school. The aim is to provide our own recommendations and suggestions to improve the current situation. Introductory section explains the various basic concepts related to ICT security, the next section describes the facilities of the school and the current state of the school. In the practical part are individually discussed the proposed security measures.

Cyberrelaterad brottslighet drabbar företag i allt större omfattning och en grupp företag som är särskilt drabbade är små- och medelstora företag (SMF). En anledning till denna ökning anses vara svag informationssäkerhet hos företag tillhörande kategorin. En hög informationssäkerhetsmedvetenhet bland anställda på ett företag kan enligt forskning minska cyberrelaterad brottslighet. Vidare saknas nödvändig teori inom området informationssäkerhetsmedvetenhet för att förstå mänskliga intentioner och hur ett önskat beteende uppnås. Ett sätt att komma till rätta med riktlinjer och policy för informationssäkerhet är att upprätta ett ledningssystem med hjälp av ISO 27001-certifiering. Nödvändig forskning saknas kring hur ISO 27001-certifieringsprocessen påverkar informationssäkerhetsmedvetenhet i ett SMF och vilka förändringar som uppkommer till följd av en certifieringsprocess. Studien undersöker därför hur ISO 27001-certifieringar påverkar informationssäkerhetsmedvetenhet och vilka förändringar som uppkommer till följd av en certifieringsprocess. En semistrukturerad intervjustudie har utförts i ett ISO 27001-certifierande svenskt SMF. Baserat på insamlade data och teoretiskt ramverk har fem olika beståndsdelar av informationssäkerhetsmedvetenhet identifierats och resultat har analyserats i relation till dem. Resultaten visar att svenska SMF får en förhöjd informationssäkerhetsmedvetenhet till följd av en ISO 27001-certifiering. Vidare visar resultaten att svenska SMF får tydligare processer och riktlinjer för säkerhetsrelaterat arbete till följd av en ISO 27001-certifieringsprocess. / Cyber-related crime is affecting companies to an increasing extent and a group of companies that are particularly affected are Small and Medium-sized Enterprises (SME). One reason for this increase is weak information security in companies falling into the category. According to research, a high level of information security awareness among employees at a company can reduce successful cyber-related crime. Furthermore, necessary theory in the field of information security awareness is missing. One way to deal with guidelines and policies for information security is to establish an information security management system using ISO 27001 certification. Necessary research is lacking on how the ISO 27001 certification process affects information security awareness in an SME and what changes arise following the certification process. This study examines how an ISO 27001-certification affects information security awareness and which changes occur following the certification process. A semi-structured interview has been conducted in an ISO 27001-certifiying Swedish SME. Based on gathered data and our theoretical framework, five different components of information security awareness have been identified and results have been analyzed in relation to them. The results indicate that swedish SME gets a heightened level of information security awareness following an ISO 27001-certification. Furthermore, the results show that Swedish SMEs get more distinct processes and guidelines for security-related work following an ISO 27001-certification process.

According to International Electrotechnical Commission’s standard document IEC-60287 the current carrying capabilities of power cables can be mathematically modelled. Current rating of power cables can hence be done without having to perform expensive and timely experiments. This allows different techniques in power cable utilizing and placement to be compared to one another. In this master thesis two different techniques for placement of power cables are investigated using IEC-60287. A conventional technique where the electric power cable is placed in a cable trench is compared to the method where the power cable is placed in a protective plastic duct. Comparisons have been made in the areas: current carrying capacity, economy and technical simplifications. Based on the analysis in this report results show that the theoretical current carrying capacity (ampacity) of the power cable placed in a plastic duct is sufficient for usage under given circumstances and that the method allows greater flexibility regarding the interface between contractors. Conclusions from this master thesis should be used only based on circumstances very similar to the set-up described in this report. Current carrying capabilities of power cables diverges depending on cable model, surrounding media, protective plastics and/or metals and many more properties of the system. Each system demands an investigation of it’s own, but systems containing power cables buried in plastic ducts can with support from this report be closely described.

Information är ett väsentligt och stort organ inom organisationer och inom tillverkningsindustrin används det till all kommunikation som sker. För att säkerställa att informationen är säker krävs informationssäkerhet. Målet med informationssäkerhet anses vara uppfyllt när informationens integritet, tillgänglighet samt konfidentialitet kan garanteras. I dagens industri är informationssäkerhet ytterst viktigt på grund av att den fjärde revolutionen (Industri 4.0) kräver data i realtid. Ett problem med informationssäkerheten är att resurser främst läggs på tekniska lösningar men inte på att minska den mänskliga faktorns påverkan som står för cirka 85% av alla organisatoriska olyckor. En bransch som är i behov att moderniseras är småhustillverkare med inriktning trä (SIT). SIT-branschen behöver moderniseras för att följa med i den nya digitala generationen. Branschen i sitt nuläge kräver en ökad produktivitet för att fortsätta vara konkurrenskraftiga på marknaden men även för att öka sin lönsamhet. Det kan verkställas genom att öka förståelsen för hur SIT arbetar med informationssäkerhet och vilka förbättringar som kan implementeras för att uppnå målet. Metoden som används för att öka förståelsen över hur arbetet med informationssäkerhet sker inom SIT-branschen är en kvantitativ enkätstudie. Enkätfrågorna skapades utifrån teori om standarden ISO/IEC 27000 samt CIA-triadens komponenter (konfidentialitet, integritet samt tillgänglighet). Standarden bedömer om informationssäkerheten har en god nivå medan CIAtriadens komponenter påvisar om målet med informationssäkerhet är uppfyllt. Svarsfrekvensen som studien gav var 20,83%. En bedömningsmodell gjordes för att kategorisera resultatet i en skala från icke-uppfylld nivå till uppfylld nivå. Resultatet visar på att branschen är i behov av att förbättra sitt informationssäkerhetsarbete. Frågorna kring standarden ISO/IEC 27000 uppgav att branschen tenderar mot en icke uppfylld nivå och CIA-triadens komponenter hamnade på ett mellanläge för varken uppfylld eller icke-uppfylld nivå. Enkätstudien visade att den mänskliga faktorn har en påverkan på informationssäkerheten vilket överensstämmer med teorin angående att mer resurser läggs på tekniska lösningar. Slutsatsen blev att SIT-branschen har en bristfällig nivå på informationssäkerheten. Genom att implementera förbättringsförslagen ges förutsättningar för branschen att nå upp till en väldigt god informationssäkerhetsnivå.

The operation of the smart grid is expected to be heavily reliant on microprocessor-based control. Thus, there is a strong need for interoperability standards to address the heterogeneous nature of the data in the smart grid. In this research, we analyzed in detail the security threats of the Generic Object Oriented Substation Events (GOOSE) and Sampled Measured Values (SMV) protocol mappings of the IEC 61850 data modeling standard, which is the most widely industry-accepted standard for power system automation and control. We found that there is a strong need for security solutions that are capable of defending the grid against cyber-attacks, minimizing the damage in case a cyber-incident occurs, and restoring services within minimal time. To address these risks, we focused on correlating cyber security algorithms with physical characteristics of the power system by developing intelligent agents that use this knowledge as an important second line of defense in detecting malicious activity. This will complement the cyber security methods, including encryption and authentication. Firstly, we developed a physical-model-checking algorithm, which uses artificial neural networks to identify switching-related attacks on power systems based on load flow characteristics. Secondly, the feasibility of using neural network forecasters to detect spoofed sampled values was investigated. We showed that although such forecasters have high spoofed-data-detection accuracy, they are prone to the accumulation of forecasting error. In this research, we proposed an algorithm to detect the accumulation of the forecasting error based on lightweight statistical indicators. The effectiveness of the proposed algorithms was experimentally verified on the Smart Grid testbed at FIU. The test results showed that the proposed techniques have a minimal detection latency, in the range of microseconds. Also, in this research we developed a network-in-the-loop co-simulation platform that seamlessly integrates the components of the smart grid together, especially since they are governed by different regulations and owned by different entities. Power system simulation software, microcontrollers, and a real communication infrastructure were combined together to provide a cohesive smart grid platform. A data-centric communication scheme was selected to provide an interoperability layer between multi-vendor devices, software packages, and to bridge different protocols together.

This thesis summarizes the simulation and analysis performed for the MassCEC project described herein. The intent was to perform a “dry run” of the new IEC offshore wind turbine design standard, IEC 61400-3-1 and to illustrate the use of that standard in the Massachusetts Offshore Wind Energy Area. IEC 61400-3-1 is a design standard used to ensure wind turbine structural performance over the design life of the machine. Each installed wind turbine must be certified by a Certified Verification Agent using this standard before installation. The certification process typically uses a structural dynamics model to predict a turbine’s structural response in the presence of a range of operational conditions and meteorological oceanographic conditions, which are codified into Design Load Cases. The area in question is located approximately 24 km of south of Martha’s Vineyard with an assumed water depth of 40 m. The National Renewable Energy Laboratory’s FAST software (V8.12) was used to perform simulations of a large subset of the DLCs. Wind data files were generated using NREL’s TurbSim and IECWind. This thesis discusses the instructions of the standard, preparation for simulation of Design Load Cases, and analysis of results. Results from simulations show the application of the standard in detail as applied to a reference turbine. Limitations and ambiguities of the standard in the simulation of control failure cases are analyzed. The application of the standard to hurricane loading is also analyzed alongside an example case for a Category 5 hurricane. The standard is found to be fundamentally reasonable in application to a reference turbine in the Massachusetts Offshore Wind Energy Area.

Motor control assets are foundational elements in many industrial operations. In the mining industry, these assets primarily consist of motor control centers and drives, which are available with a comprehensive assortment of control and monitoring devices. Various intelligent electronic devices (IEDs) are now used to prevent machine damage and downtime. As motor control devices have advanced in technology, so too have the IEDs that protect them. These advances have resulted in new standards, such as IEC 61850, that have embedded intelligence and a standard set of communication schemes by which IEDs can share information in a peer-to-peer or one-to-many fashion. This dissertation investigated the steps involved in interfacing IEDs to a mining process control network via the use of the IEC 61850 standard. As a result of this study, several key technological advancements were made including the development of (i) vendor independent system to communicate with IEDs in a mining environment over IEC 61850, (ii) command and control methods for communication based assisted automation of IEDs for mining firms, (iii) effective solutions to incorporate electrical distribution data in the process control system, (iv) enhanced safety platforms through remote operation of IEDs, (v) standard visualization faceplate graphics for HMI operators with enhanced security, and (vi) new methods for time stamped dataflow to be correctly inserted into a process historian for 'true' Sequence of Events Records. / Ph. D.