No description available.

Mobile applications tend to access data beyond their intended functionality and share this data with third parties for various purposes including marketing, profiling and advertisement. This data also includes user’s personal information and access to this personal information without user’s consent put user’s privacy at risk. User’s Inability to easily find privacy friendly apps and befuddling permission requests paves the way for malicious apps to get access to user’s personal information. Keeping in mind the different level of privacy aware users, we have presented a privacy enforcement framework in this thesis. This framework not only helps user to find alternative privacy friendly apps but also encourage users to review their privacy settings on the smartphone. An app discovery tool is developed to search privacy friendly apps amongst the group with similar functionality. The search results are sorted by privacy friendly score which is calculated using simplified version of risk assessment method known as EBIOS. Threat posed to personal information by various apps are then highlighted and presented to user in an easy-to-understand way before installing the app. We have validated the results of our discovery tool by comparing them to the manual inspection of various functional groups i.e., group of applications with similar functionality. Two list of permissions, one created by subjective and manual analysis of abstract functionality of functional group called expert opinion and other created by our tool based on permissions requested by functional group are compared. Our tool has correctly identified the permissions which are similar to expert opinion. / Mobila applikationer tenderar att ta del av data utanför deras tilltänkta funktionalitet och delar den här datan med tredjehands parter för olika syften som marknadsföring, profilering och reklam. Datan inkluderar även personlig information och tillgång till den personliga informationen utan användarens medvetande sätter användarens integritet i risk. Användares oförmåga att enkelt hitta integritetsvänliga appar och förvirrande godkännande förfrågningar öppnar vägen för illvilliga appar att få tillgång till användarens personliga information. Med tanke på hur olika användare uppmärksammar integritetnivåer presenterar vi ett integritetsupprätthållande ramverk i den här uppsatsen. Ramverket hjälper inte bara användare att hitta integritetsvänliga appar utan uppmuntrar även användaren att granska integritetsinställningarna i sin telefon. Ett applikationsupptäckarverktyg utvecklades för att söka efter integritetsvänliga appar inom samma funktionsområde. Sökresultatet är sorterat efter en integritetsvänlighetspoäng beräknad med en förenklad version av riskbedömningsmetoden känd som EBIOS. Hot mot personlig information från olika appar uppmärksammas och presenteras på ett användarvänligt sätt innan appen installeras. Vi har validerat resultatet från vårt applikationsupptäckarverktyg genom att jämföra det med en manuell inspektion av appar inom samma funktionsområde, exempelvist grupper av applikationer med liknande funktion. Två listor togs fram, en framtagen genom subjektiv och manuell analys av normal funktionalitet kallad expertutlåtande och en framtagen av vårt applikationsupptäckarverktyg baserat på funktionsområde. Vårt verktyg har korrekt identifierat godkännande i likhet med expertutlåtandet.

Cloud computing is becoming increasingly popular among all types of companies due to its inherent benefits. However, because of its infrastructure, it might be difficult to manage access rights between users and resources. To address these difficulties, Amazon Web Services (AWS) provides Identity and Access Management (IAM) and features that support the use of different access control models, for example, Role-based Access Control (RBAC) and Attribute-based Access Control (ABAC). Access control models are used for authorisation within systems to decide who gets access to what. Therefore, to determine what constitutes an efficient (the average time it takes to perform a task in AWS IAM) and secure access control model, a thorough study of background material and related work was conducted. Through this study, it was found that RBAC lacked scalability whilst ABAC lacked administrative capabilities. It was also found that flexibility and scalability were two important factors when designing access control models. Furthermore, by conducting a survey and designing an access control model for AWS through various iterations, a new access control model called Entity-centric Attribute- & Role-based Access Control (EARBAC) was developed. In an experiment comparing it with the RBAC model, the EARBAC model was found to be both efficient and secure, in addition to its flexibility and scalability. Furthermore, EARBAC was also found to be 27% faster than RBAC in AWS IAM. These results suggest that the model is useful when developing cloud infrastructures in AWS.

No description available.

Vi växer alla upp med olika förutsättningar, differentierandeerfarenheter och i ett samhälle som är upprättatoch upprätthåller riktlinjer, regler och standarder som vimer eller mindre tvingas leva utefter. Med samhälleligastrukturer så hårt bundna till dessa ramar kan det iblandvara svårt att veta hur en ska förhålla sig när de ramarsom är skapta för att vara till fördel för somliga bevisasvara skadliga och förstörande för andra.Detta var något jag själv inte riktigt hade lagt märke tillförrän Black Lives Matter-rörelsen uppmärksammadesoch krävde rättvisa till följd av mordet på George Floydsommaren 2020. BLM-rörelsen spreds, demonstrationergenomfördes världen runt och sociala medier fylldes avsvarta fyrkanter och människor som uttryckte sig angåendeden rasism som pågått för länge och som fortfarandepågår.Mitt arbete har riktats mot att titta på den roll grafiskdesign spelar i den fortsatta etableringen av de ramar ochregler som gör det omöjligt för rasism att elimineras, i enansats att samtidigt visa hur det inte räcker att enbartsäga: "jag är inte rasist". / We all grow up in different conditions, with differentiatingexperiences in a society founded upon the samerules, guidelines, and standards that are still exercised todayand which we as people are more or less forced to liveby. With social structures so tightly wound around theseguidelines it can sometimes be difficult to know how onemight behave and relate when those same guidelines onone hand serve as an advantage for some while beingdetrimental and harmful to others.This was something I was not fully aware of until the BlackLives Matter movement called for justice following themurder of George Floyd during the summer of 2020. TheBLM-movement spread, protests ensued on a global scale,and social media exploded showcasing black squaresand people expressing themselves regarding both pastand ongoing racism.My work has focused on observing the role graphic designplays in the continued establishment of the guidelinesand rules making the elimination of racism impossible.In an attempt to also demonstrate it’s no longerenough to say: "I am not racist".

The prolific use of the internet and electronic mail within the legal profession presents novel challenges to the application of the attorney-client privilege; especially, in regards to protecting intended confidential communications relayed through e-mail. This thesis addresses the question of whether an attorney in Florida, through electronic mail use, can waive his client's right to the protections of the attorney-client privilege. After a review of current case law, law review articles, statutes, and texts, this thesis concluded that an attorney's communication through e-mail warrants a reasonable expectation of privacy, permitting the attorney to speak in reasonable confidence to clients through the web. However, attorneys, ethically, should consider the strong repercussions for using such a potentially transparent medium for communication. By examining the relationship between current law, the application of the attorney-client privilege, and a reasonable expectation of privacy, this study provides a comprehensive analysis for attorneys concerned with electronic mail usage. Lastly, this thesis provides attorneys with best practices for their electronic mail communications.

No description available.

No description available.

No description available.

Cette thèse propose une approche originale de test de vulnérabilité Web à partir de modèles etdirigée par des patterns de tests, nommée PMVT. Son objectif est d’améliorer la capacité de détectionde quatre types de vulnérabilité majeurs, Cross-Site Scripting, Injections SQL, Cross-Site RequestForgery, et Privilege Escalation. PMVT repose sur l’utilisation d’un modèle comportemental del’application Web, capturant ses aspects fonctionnels, et sur un ensemble de patterns de test devulnérabilité qui adressent un type de vulnérabilité de manière générique, quelque soit le type del’application Web sous test.Par l’adaptation de technologies MBT existantes, nous avons développé une chaîne outillée complèteautomatisant la détection des quatre types de vulnérabilité. Ce prototype a été exprimenté et évaluésur deux applications réelles, actuellement utiliseés par plusieurs dizaines de milliers d’utilisateurs.Les résultats d’expérimentation démontrent la pertinence et de l’efficience de PMVT, notamment enaméliorant de façon significative la capacité de détection de vulnérabilités vis à vis des scannersautomatiques d’applications Web existants. / This thesis proposes an original approach, dubbed PMVT for Pattern-driven and Model-basedVulnerability Testing, which aims to improve the capability for detecting four high-profile vulnerabilitytypes, Cross-Site Scripting, SQL Injections, CSRF and Privilege Escalations, and reduce falsepositives and false negatives verdicts. PMVT relies on the use of a behavioral model of theapplication, capturing its functional aspects, and a set of vulnerability test patterns that addressvulnerabilities in a generic way. By adapting existing MBT technologies, an integrated toolchain that supports PMVT automates thedetection of the four vulnerability types in Web applications. This prototype has been experimentedand evaluated on two real-life Web applications that are currently used by tens of thousandsusers. Experiments have highlighted the effectiveness and efficiency of PMVT and shown astrong improvement of vulnerability detection capabilities w.r.t. available automated Web applicationscanners for these kind of vulnerabilities.