The diploma thesis is focused on the issue of connective cars and the types of threats that can occur and how to protect against them. The general part described the general model of the car. In the next part of the work, templates were created in the Microsoft Threat Modeling Tool with threats and countermeasures to them.

No description available.

Submitted by Vinicius Amadeu Stuani Pereira (vi_stuani@hotmail.com) on 2018-11-23T17:06:34Z No. of bitstreams: 1 Pereira_VAS_Tese.pdf: 34672414 bytes, checksum: f357f584172b46b5d27f842642bd82f7 (MD5) / Approved for entry into archive by ALESSANDRA KUBA OSHIRO ASSUNÇÃO (alessandra@fct.unesp.br) on 2018-11-23T18:44:39Z (GMT) No. of bitstreams: 1 pereira_vas_dr_prud.pdf: 34672414 bytes, checksum: f357f584172b46b5d27f842642bd82f7 (MD5) / Made available in DSpace on 2018-11-23T18:44:39Z (GMT). No. of bitstreams: 1 pereira_vas_dr_prud.pdf: 34672414 bytes, checksum: f357f584172b46b5d27f842642bd82f7 (MD5) Previous issue date: 2018-09-13 / Coordenação de Aperfeiçoamento de Pessoal de Nível Superior (CAPES) / Fundação de Amparo à Pesquisa do Estado de São Paulo (FAPESP) / Dentre os métodos de posicionamento GNSS (Global Navigation Satellite System) utilizados pela aviação no suporte das fases de aproximação e pouso preciso de aeronaves, destacam-se o SBAS (Satellite-Based Augmentation System) e o GBAS (Ground-Based Augmentation System). O GBAS tem a capacidade de corrigir a maioria dos erros envolvidos na pseudodistância a partir do DGNSS (Differential GNSS), desde que a camada ionosférica apresente um comportamento não perturbado na região do aeroporto. Entretanto, dependendo do fluxo de ionização solar, da atividade geomagnética, do ciclo de manchas solares, do ângulo zenital do Sol e da localização geográfica, a ionosfera pode sofrer fortes perturbações, proporcionando uma ameaça à integridade do GBAS, uma vez que podem ser diferentes os efeitos ionosféricos em pequenas distâncias. Assim, investigações dos erros sistemáticos devido à camada ionosférica no GBAS tem sido objeto de estudos há alguns anos. Nesse sentido, modelos de risco ionosférico, que visam determinar a máxima decorrelação ionosférica espacial existente entre a estação GBAS e a aeronave que se aproxima num aeroporto, foram desenvolvidos ou avaliados, principalmente para o hemisfério norte, mais precisamente para o território norte-americano, onde se destaca o CONUS (Conterminous United States) Threat Model. Nessa área o comportamento da ionosfera é mais estável em comparação com o observado sobre o Brasil, localizado na região ionosférica equatorial e de baixas latitudes, que apresenta a ocorrência da Anomalia de Ionização Equatorial (AIE), bolhas ionosféricas, irregularidades ionosféricas, cintilação ionosférica e Anomalia Magnética do Atlântico Sul (AMAS). A implantação de um GBAS no Brasil, por meio do Departamento de Controle do Espaço Aéreo (DECEA), despertou o interesse de seu uso com segurança. Sendo assim, a pesquisa propôs investigar a aplicabilidade do modelo CONUS de risco ionosférico para GBAS no território brasileiro, utilizando o método dos pares de estações (station-pair method), além de estimar os parâmetros para os principais aeroportos internacionais do Brasil, considerando a variação sazonal, bem como investigar os benefícios quanto ao uso dos sinais GLONASS (Global’naya Navigatsionnaya Sputnikovaya Sistema), Galileo e da portadora L5 do GPS (Global Positioning System) no modelo. Para isso, foram utilizados dados GNSS de várias redes ativas entre os anos de 2000 e 2016, bem como dados do GBAS instalado no aeroporto internacional do Rio de Janeiro/RJ (Galeão). Para a determinação dos parâmetros do modelo de risco e do parâmetro de integridade σvig (vertical ionospheric gradient sigma), esse último utilizado para estimar os níveis de proteção horizontal e vertical da aeronave, foi implementado um sistema denominado MoR_Ion. Os parâmetros do modelo CONUS estimados para o Brasil, utilizando sinais GPS para a combinação de portadoras L1/L2, mostraram que é inviável o uso de um GBAS considerando todo o território nacional. Uma alternativa foi estimativa local e temporal para os aeroportos de interesse. Valores obtidos indicaram que o GBAS pode, provavelmente, ser utilizado nos aeroportos internacionais de São Paulo/SP (Cumbica), Rio de Janeiro/RJ (Galeão), Brasília/DF (Presidente Juscelino Kubitschek) e Recife/PE (Gilberto Freyre) com algumas restrições quanto à estação do ano, hora do dia e elevação dos satélites. Já para o aeroporto internacional de Porto Alegre/RS (Salgado Filho) é o único, entre os analisados, em que nenhuma restrição à instalação do GBAS no local foi identificada a partir do conjunto de dados processados. Resultados empregando os sinais GPS e Galileo, para a combinação L1/L5, apresentaram ser melhores que os da combinação L1/L2. Já em relação ao GLONASS, verificou-se que há uma semelhança com os resultados do GPS. A determinação do σvig em tempo real para cada satélite disponível se apresentou como uma alternativa interessante, uma vez que transmite para a aeronave a real condição ionosférica no momento da aproximação e pouso, ao contrário da atual configuração do GBAS de transmitir um valor fixo de σvig que, teoricamente, contempla todas as possíveis perturbações ionosféricas. Estimativas de níveis de proteção para aproximação no Galeão indicaram que há a possibilidade de se realizar um procedimento CAT-I, utilizando satélites GPS ou GLONASS (combinação L1/L2), desde que sejam aplicadas restrições local-temporais previamente estabelecidas. Verificou-se, também, que a utilização dos satélites GLONASS em concomitância com o GPS possibilita a obtenção de valores que atendem aos limiares para um pouso CAT-III, uma vez que uma maior quantidade de satélites e, consequentemente, uma melhor configuração geométrica, é disponibilizada. Um estudo de caso utilizando o time-step method para a região do aeroporto de São José dos Campos/SP, onde se encontram cinco estações em um raio de 10 km, indicou que gradientes desse método podem ser empregados na estimativa dos valores dos parâmetros. Entretanto, tal método tem pouca semelhança com a arquitetura de uma estação GBAS e uma aeronave que se aproxima e, adicionalmente, não soluciona a decorrelação temporal. Por fim, um método alternativo que pode indicar a realização ou não do pouso consiste no monitoramento das irregularidades ionosféricas em tempo real na região circundante de um determinado aeroporto. Experimento realizado em tempo real, mas utilizando dados GPS e GLONASS de março de 2014 (próximo ao pico do ciclo solar 24), mostrou fortes irregularidades para a região do Galeão, com a frente ionosférica se deslocando de sudoeste a nordeste. Assim, uma medida que pode ser empregada para estimar os níveis de proteção consiste em não utilizar os sinais dos satélites que atravessam tais irregularidades. / Among the methods of GNSS (Global Navigation Satellite System) positioning used by the aviation in the support of the phases of approach and precise landing of aircraft, stand out the SBAS (Satellite-Based Augmentation System) and the GBAS (Ground-Based Augmentation System). GBAS has the ability to correct most of the errors involved in pseudorange from DGNSS (Differential GNSS), provided that the ionospheric layer exhibits undisturbed behavior in the airport region. However, depending on the flow of solar ionization, geomagnetic activity, sunspot cycle, zenith angle of the sun and geographic location, the ionosphere can suffer severe disturbances, posing a threat to the integrity of the GBAS, since the ionospheric effects may be different at small distances. Thus, investigations of systematic errors due to the ionospheric layer in GBAS have been the subject of studies for some years. In this sense, ionospheric threat models, which seek to determine the maximum existing spatial ionospheric decorrelation between the GBAS station and the aircraft approaching an airport, have been developed or evaluated, especially for the northern hemisphere, more precisely to the US territory, which highlights the CONUS (Conterminous United States) Threat Model. In this area, the ionosphere behavior is more stable compared to that observed in Brazil, located in the equatorial and low latitude ionospheric region, which presents the occurrence of Equatorial Ionization Anomaly (EIA), ionospheric bubbles, ionospheric irregularities, ionospheric scintillation and South Atlantic Magnetic Anomaly (SAMA). The implementation of a GBAS in Brazil, through the Department of Airspace Control (DECEA), aroused the interest of its use with safety. Therefore, the research proposed to investigate the applicability of the CONUS Threat Model to GBAS in the Brazilian territory, using the station-pair method, besides estimating the parameters for the main international airports of Brazil, considering the seasonal variation, as well as investigating the benefits of using the GLONASS (Global’naya Navigatsionnaya Sputnikovaya System), Galileo and GPS (Global Positioning System) L5 carrier in the model. For this purpose, GNSS data from several active networks were used between 2000 and 2016, as well as data from GBAS installed at Rio de Janeiro International Airport (Galeão). For the determination of the parameters of the threat model and the σvig (vertical ionospheric gradient sigma) integrity parameter, the latter used to estimate the aircraft horizontal and vertical protection levels, a system called MoR_Ion was implemented. The parameters of the CONUS model estimated for Brazil, using GPS signals for the combination of L1/L2 carriers, showed that it is impracticable to use a GBAS considering the entire national territory. An alternative was a local and temporal estimate for the airports of interest. The values obtained indicate that the GBAS can probably be used in the international airports of São Paulo/SP (Cumbica), Rio de Janeiro/RJ (Galeão), Brasília/DF (President Juscelino Kubitschek) and Recife/PE (Gilberto Freyre) with some restrictions on the season, time of day and satellite elevation. At the international airport of Porto Alegre/RS (Salgado Filho) it is the only one, among the analyzed ones, in which no restriction to the installation of the GBAS in the place was identified from the data set processed. Results using the GPS and Galileo signals for the L1/L5 combination were better than the L1/L2 combination. Regarding GLONASS, it was found that there is a similarity with the GPS results. The determination of the real time σvig for each available satellite was presented as an interesting alternative, since it transmits to the aircraft the actual ionospheric condition at the time of approach and landing, unlike the current GBAS configuration of transmitting a fixed value of σvig which theoretically covers all possible ionospheric disturbances. Estimates of protection levels for approach in Galeão indicated that there is the possibility of performing a CAT-I procedure, using GPS or GLONASS satellites (L1/L2 combination), provided that previously established local-temporal restrictions are applied. It was also verified that the use of GLONASS satellites in concomitance with GPS allows obtaining values that meet the thresholds for a CAT-III landing, since a larger number of satellites and, consequently, a better geometric configuration, is made available. A case study using the time-step method for the airport region of São José dos Campos/SP, where five stations are located within a 10 km radius, indicated that gradients of this method can be used to estimate the parameter values. However, this method has little resemblance to the architecture of a GBAS station and an aircraft approaching and additionally does not solve the temporal decorrelation. Finally, an alternative method that may indicate whether or not the landing is carried out is to monitor ionospheric irregularities in real time in the surrounding region of a given airport. A real-time experiment using GPS and GLONASS data from March 2014 (near the peak of the solar cycle 24) showed strong irregularities for the Galeão region, with the ionospheric front moving from southwest to northeast. Thus, one way that can be used to estimate protection levels is to not use satellite signals that cross such irregularities. / FAPESP: 2015/20522-7

Advances in mobile and pervasive computing, social network technologies and the exponential growth in Internet applications and services will lead to the development of the Internet of Things (IoT). The IoT services will be a key enabling technology to the development of smart infrastructures that will revolutionize the way we do business, manage critical services, and how we secure, protect, and entertain ourselves. Large-scale IoT applications, such as critical infrastructures (e.g., smart grid, smart transportation, smart buildings, etc.) are distributed systems, characterized by interdependence, cooperation, competition, and adaptation. The integration of IoT premises with sensors, actuators, and control devices allows smart infrastructures to achieve reliable and efficient operations, and to significantly reduce operational costs. However, with the use of IoT, we are experiencing grand challenges to secure and protect such advanced information services due to the significant increase in the attack surface. The interconnections between a growing number of devices expose the vulnerability of IoT applications to attackers. Even devices which are intended to operate in isolation are sometimes connected to the Internet due to careless configuration or to satisfy special needs (e.g., they need to be remotely managed). The security challenge consists of identifying accurately IoT devices, promptly detect vulnerabilities and exploitations of IoT devices, and stop or mitigate the impact of cyberattacks. An Intrusion Detection System (IDS) is in charge of monitoring the behavior of protected systems and is looking for malicious activities or policy violations in order to produce reports to a management station or even perform proactive countermeasures against the detected threat. Anomaly behavior detection is a technique that aims at creating models for the normal behavior of the network and detects any significant deviation from normal operations. With the ability to detect new and novel attacks, the anomaly detection is a promising IDS technique that is actively pursued by researchers. Since each IoT application has its own specification, it is hard to develop a single IDS which works properly for all IoT layers. A better approach is to design customized intrusion detection engines for different layers and then aggregate the analysis results from these engines. On the other hand, it would be cumbersome and takes a lot of effort and knowledge to manually extract the specification of each system. So it will be appropriate to formulate our methodology based on machine learning techniques which can be applied to produce efficient detection engines for different IoT applications. In this dissertation we aim at formalizing a general methodology to perform anomaly behavior analysis for IoT. We first introduce our IoT architecture for smart infrastructures that consists of four layers: end nodes (devices), communications, services, and application. Then we show our multilayer IoT security framework and IoT architecture that consists of five planes: function specification or model plane, attack surface plane, impact plane, mitigation plane, and priority plane. We then present a methodology to develop a general threat model in order to recognize the vulnerabilities in each layer and the possible countermeasures that can be deployed to mitigate their exploitation. In this scope, we show how to develop and deploy an anomaly behavior analysis based intrusion detection system (ABA-IDS) to detect anomalies that might be triggered by attacks against devices, protocols, information or services in our IoT framework. We have evaluated our approach by launching several cyberattacks (e.g. Sensor Impersonation, Replay, and Flooding attacks) against our testbeds developed at the University of Arizona Center for Cloud and Autonomic Computing. The results show that our approach can be used to deploy effective security mechanisms to protect the normal operations of smart infrastructures integrated to the IoT. Moreover, our approach can detect known and unknown attacks against IoT with high detection rate and low false alarms.

The subject area of this project is IT security related to cars, specifically the security of devices connected through a cars OBD-II connector. The aim of the project is to see the security level of the AutoPi OBD-II unit and to analyse where potential vulnerabilities are likely to occur when in use. The device was investigated using threat modeling consisting of analysing the architecture, using the STRIDE model to see the potential attacks that could be implemented and risk assessments of the attacks using the DREAD model. After modelling the system, attempts of implementing attacks, with the basis in the threat modelling, were carried out. No major vulnerabilities were found in the AutoPi device but a MITM attack on the user was shown to be possible for an attacker to succeed with. Even though no major vulnerability was found IoT devices connected to cars might bring security concerns that needs to be looked into by companies and researchers. / Ämnesområdet för detta projekt är ITsäkerhet relaterad till bilar, mer specifikt säkerheten gällande enheter som kopplas in i en bils OBD-II-kontakt. Syftet med uppsatsen är att bedöma säkerhetsnivån på en OBD-II-enhet av modell AutoPi och att analysera var potentiella sårbarheter kan finnas i systemet. Enheten kommer att undersökas med hjälp av hotmodellering som består av att analysera arkitekturen, använda STRIDE-modellen för att upptäcka potentiella attackmetoder samt bedöma riskerna för attackerna med hjälp av DREAD-modellen. Efter det steget görs attackförsök utifrån resultaten från hotmodelleringen. Inga större sårbarheter hittades i AutoPi-enheten men en MITM-attack på användaren visades vara möjlig för en angripare att lyckas med. Ä ven fast inga större sårbarheter hittades kan IoT-enheter kopplade till bilar medföra säkerhetsbrister som företag och forskare måste se över.

This study revolves around the safety of IoT devices, more specifically how safe the robot vacuum cleaner Ironpie m6 is. The method is based on threat modeling the device, using the DREAD and STRIDE models. The threats with the highest estimated severity were then penetration tested to see which security measures are implemented to protect against them. Using client side manipulation one vulnerability was found in Trifo’s mobile application ”Trifo home” which could be used to harm customers property. / Den här studien kretsar kring IoT enheters säkerhet, mer specifikt hur säker robotdammsugaren Ironpie m6 är. Metoden är baserad på att hotmodellera enheten med hjälp av DREAD och STRIDE modellerna. Dem allvarligaste hoten blev penetrationstestade för att se vilka säkerhetsåtgärder som har blivit implementerade for att skydda produkten från dem. En sårbarhet upptäcktes i Trifos mobilapplikation ”Trifo Home” som kunde exploiteras via manipulation av klient sidan. Denna sårbarhet kunde användas för att skada kunders ägodelar.

The IoT offers enormous potentials thanks to its Widespread adoption by many industries, individuals, and governments, leading explosive growth and remarkable breakthroughs that have made it a technology with seemingly boundless applications. However, the far-reaching IoT applications cum its characteristic heterogeneity and ubiquity come with a huge price for more security vulnerabilities, making the deployed IoT systems increasingly susceptible to, and prime targets of many different physical and cyber-attacks including insider attacks, thereby growing the overall security risks to the systems. This research, which focuses on addressing insider attacks on IoT, studies the likelihood of malicious insiders' activities compromising some of the security triad of Confidentiality, Integrity and Availability (CIA) of a supposedly secure IoT system with implemented security mechanisms. To further establish the vulnerability of the IoT systems to the insider attack being investigated in our research, we first produced a research output that emphasized the need for multi-layer security of the overall system and proposed the implementation of security mechanisms on components at all layers of the IoT system to safeguard the system and ensure its CIA. Those conventional measures however do not safeguard against insider attacks, as found by our experimental investigation of a working IoT system prototype. The outcome of the investigation therefore necessitates our proposed solution to the problem, which leverages the integration of distributed edge computing with decentralized Ethereum blockchain technology to provide countermeasures that preserve the Integrity of the IoT system data and improve effectiveness of the system. We employed the power of Ethereum smart contracts to perform integrity checks on the system data logically and take risk management decisions. We considered the industry use case of Downstream Petroleum sector for application of our solution. The solution was evaluated using datasets from different experimental settings and showed up to 86% accuracy rate. / Government of the Federal Republic of Nigeria through the Petroleum Technology Development Fund (PTDF) Overseas Scholarship Scheme (OSS)

The number of Internet of Things (IoT) devices is growing rapidly which introduces plenty of new challenges concerning the security of these devices. This thesis aims to contribute to a more sustainable IoT environment by evaluating the security of a smart plug. The DREAD and STRIDE methods were used to assess the potential threats and the threats with the highest potential impact were penetration tested in order to test if there were any security preventions in place. The results from the penetration tests presented no major vulnerabilities which bring us to the conclusion that the Nedis Smart Plug has implemented enough security measures. / Antalet Internet of Things (IoT) -enheter växer snabbt vilket medför många nya utmaningar när det gäller säkerheten för dessa enheter. Denna avhandling syftar till att bidra till en mer hållbar IoT-miljö genom att utvärdera säkerheten för en smart plug. Metoderna DREAD och STRIDE användes för att bedöma de potentiella hoten och hoten med störst potentiell påverkan penetrerades för att testa om det fanns några säkerhetsförebyggande åtgärder. Resultaten från penetrationstesterna presenterade inga större sårbarheter som ledde oss till slutsatsen att Nedis Smart Plug har genomfört tillräckliga säkerhetsåtgärder.

The rapid growth and development of the Information and Communications Technology attract many industries including the automotive industry. Since the last four decades, the automotive engineering has been impacted by the Information Technology. Nowadays, modern vehicles are being designed with up to hundreds of electronic control units (ECUs) and be able to communicate with other vehicles, infrastructure, and other things via wireless networks and sensors. For such in-vehicle networks, serial bus systems like CAN bus, LIN bus, FlexRay, and MOST are standardized. Parallel to this, the automotive industry vendors designed and standardized automotive open systems architecture (AUTOSAR) software platform. AUTOSAR has two main standards - the classical platform and adaptive platform. The classical platform (CP) is designed for the current embedded ECUs, whereas the adaptive platform (AP) is being designed for the future intelligent ECUs. The intelligent AP ECU constitute many multi-processing processors and Ethernet to realize the future autonomous vehicles.On the other hand, automotive industries shall ensure “safety first” in their design and regard it as part of their market feature. Directly or indirectly, the safety of the modern connected vehicles is related to their cybersecurity. Today, cybersecurity professionals are conducting researches to bring remarkable solutions to the sophisticated cyberattacks. One approach of cybersecurity solution is to make a cyber threat modeling and attack simulations. Example, meta-attack-language (MAL) is a threat modeling and attack simulation language, which is designed to make domain-specific threat analysis.In this study, potential assets of an automotive vehicle with AP ECUs are identified. Then, threats of each identified asset are collected from different literature. With both inputs, a cyber threat model is written using MAL. Finally, validation of the model is made with a simulation language. Consequently, modern vehicle with AP ECUs is modeled and simulated.This study contributes four important things - list of potential assets that AP running vehicle constitutes, collected list of threats of the identified assets, validated cyber threat model, and simulation test cases for each potential attack paths in the model. / Den snabba tillväxten och utvecklingen av informations- och kommunikationstekniken lockar många‌ branscher, däribland bilindustrin. Sedan de senaste fyra decennierna har automotive engineering påverkats av informationstekniken. Numera är moderna fordon utformade med upp till hundratals elektroniska styrenheter (ECU) och kan kommunicera med andra fordon, infrastruktur och andra saker via trådlösa nätverk och sensorer. För sådana inbyggda nätverk är seriella bussystem som CAN-buss, LIN-buss, FlexRay och MOST standardiserade. Parallellt med detta har automotive-leverantörerna utformat och standardiserat automatsystem för öppna systemarkitekturer (AUTOSAR). AUTOSAR har två huvudstandarder - den klassiska plattformen och den adaptiva plattformen. Den klassiska plattformen (CP) är utformad för nuvarande inbyggda ECU, medan den adaptiva plattformen (AP) är utformad för framtida intelligenta ECU. Den intelligenta AP-enheten utgör många processorer och Ethernet för att förverkliga de framtida autonoma fordonen. Bilindustrin ska å andra sidan säkerställa "säkerhet först" i sin design och betrakta den som en del av deras marknadsfunktion. Direkt eller indirekt är säkerheten hos moderna anslutna fordon relaterad till sin cybersäkerhet. Idag genomför cybersecurity-proffs för att få anmärkningsvärda lösningar på de sofistikerade cyberattackarna. Ett tillvägagångssätt för cybersecurity-lösningen är att göra en modellering av cyberhot och attack simuleringar. Exempel, meta-attack-language (MAL) är ett hot modellerings-och attack simuleringsspråk, som är utformat för att göra domänspecifik hotanalys. I denna studie identifieras potentiella tillgångar i ett fordonsbil med AP-ECU. Därefter samlas hot av varje identifierad tillgång från olika litteratur. Med båda ingångarna skrivs en cyber-hotmodell med MAL. Slutligen görs validering av modellen med ett simuleringsspråk. Följaktligen modelleras och simuleras moderna fordon med AP-ECU. Denna studie bidrar till fyra viktiga saker - en lista över potentiella tillgångar som AP-körfordon utgör, samlad lista över hot av identifierade tillgångar, validerad cyberhot-modell och simuleringsprovfall för varje potentiell attackvägar i modellen.

Ziel der vorliegenden Arbeit ist es, die historische Konstruktion des Datenschutzproblems, des Datenschutzes als seiner (abstrakten) Lösung sowie die Architektur seiner rechtlichen Implementation aufzudecken und einer kritischen Revision aus informatischer Sicht zu unterziehen, um daraus Folgerungen für die Technikgestaltung zu ziehen. Die Arbeit legt offen, welches Verständnis vom Menschen und von der Gesellschaft, von Organisationen, von der Informationstechnik und von der Informationsverarbeitung, welche informatischen, informationswissenschaftlichen, soziologischen und rechtswissenschaftlichen Konzepte, Denkschulen und Theoriegebäude und welche wissenschaftlichen und vorwissenschaftlichen Annahmen und Prämissen der Analyse des Datenschutzproblems zugrunde liegen und wie sie darüber hinaus die spezifische Lösung des Datenschutzproblems – den Datenschutz – gespeist haben. Auf der Basis einer informatisch fundierten Kritik zieht die Arbeit den Schluss, dass der Datenschutz als Lösung des durch die Industrialisierung der gesellschaftlichen Informationsverarbeitung erzeugten Datenmachtproblems neu abgeleitet werden muss, und legt dafür ein dem Stand der wissenschaftlichen Debatte entsprechendes, abstraktes – und damit jeweils noch anwendungsbereichsspezifisch zu konkretisierendes – Datenschutz-Angreifermodell, ein analytisches Raster für eine darauf aufbauende Bedrohungsanalyse sowie einen prozeduralen Operationalisierungsansatz, der die Vorgehensweise und die jeweils zu analysierenden oder zu prüfenden inhaltlichen Fragen deutlich werden lässt, vor. Abschließend zieht die Arbeit Folgerungen für die Gestaltung datenschutzfreundlicher – und dabei nicht notwendig nur datenschutzrechtskonformer – informationstechnischer Systeme. / The aim of this thesis is to uncover the historical construction of the data protection problem, of data protection as its (abstract) solution, as well as the architecture of its legal implementation, in order to critically assess this construction and to draw conclusions for the design of ICT systems. The thesis reveals which concepts of humankind and society, organizations, information technology and information processing, which informatics, information science, sociological and jurisprudential concepts, schools of thought and theories, and which scientific and pre-scientific assumptions and premises underlie the analysis of the data protection problem, and how they have influenced the specific solution of this problem. Based on a critical assessment of this construction the thesis concludes that data protection must be re-derived as a solution for the information power problem, which is generated by the industrialization of social information processing, and presents an abstract, state-of-the-art data protection attacker model, an analytical framework for a data protection impact assessment as well as a procedural operationalization approach illustrating the sequence as well as the substantive issues to be examined and addressed in this process. The thesis then draws conclusions for the design of data protection friendly—and not necessarily just legally compliant—ICT systems.