Nesta tese investigam-se três pontos ligados a fragilidades topológicas de grafos e suas aplicações a redes complexas reais e, em especial, a redes de relacionamentos criminais. Na primeira etapa, apresenta-se in abstracto um método inédito e eficiente de fragmentação de redes complexas por módulos. O procedimento identifica em primeiro lugar comunidades topológicas por meio da qual a rede pode ser representada usando algoritmos heurísticos de extração de comunidades. Então, somente os nós que participam de ligaçõees inter-comunitaárias são removidos em ordem decrescente de sua centralidade de intermediação. Ilustra-se o método pela aplicação a uma variedade de redes reais nas áreas social, de infraestrutura, e biológica. Mostra-se que a abordagem por módulos supera ataques direcionados a vértices baseados somente no ordenamento de índices de centralidade, com ganhos de eficiência fortemente relacionados à modularidade da rede.No segundo momento, introduzem-se os conceitos de robustez e fragilidade de redes generalizadas para avaliar o quanto um determinado sistema se comporta frente a ataques incompletos. Ainda, avalia-se o desempenho (relação entre robustez e custo computacional) de diversos ataques sequenciais e simultâneos a redes modulares por meio de uma medida empírica que chamamos de performance. Mostra-se por meio de redes artificiais de referência e de redes reais que para sistemas altamente modulares a estratégia de fragmentação por módulos apresenta um desempenho até 10 vezes superior aos demais ataques. Na última etapa, explora-se com maior profundidade a natureza subjacente de redes reais de relacionamentos criminais. Apresenta-se uma rede única e sem precedentes construída pela Polícia Federal Brasileira consistindo de mais de 35.000 relacionamentos entre 24.000 indivíduos. Os dados foram coletados entre abril e agosto de 2013 e consistem em informações fornecidas diretamente pelos investigadores responsáveis de cada caso. O sistema apresenta características típicas de redes sociais, porém é bem mais “escuro"que o comportamento típico, com baixos níveis tanto de densidade de arestas quanto de eficiência de rede. Além do mais, o sistema é extremamente modular o que implica ser possível desmantelar toda a rede de crimes federais brasileiros com a remoção de aproximadamente 2% dos indivíduos escolhidos conforme a prescrição do método modular. Também, a rede é controlável no sentido da teoria matemática de controle, significando que com acesso a aproximadamente 20% dos nós é possível, em tese, levar qualquer variável dinâmica de um estado inicial a um estado final arbitrário em um tempo finito. Exibi-se tambám uma análise topológica e de fragilidades de uma segunda rede criminal relacionada a investigações da Polícia Federal. Trata-se de um fórum online destinado à prática de crimes cibernéticos na chamada camada profunda da internet (deep web). (Continuação ) Após a coleta dos dados foi possível construir uma rede de relacionamentos com quase 10.000 indivíduos. Comparou-se, entãoo, a estratégia usada de fato pela Polícia Federal durante a Operação Darknet com a previsão teórica de ataques topológicos à rede criminal e mostrou-se que ataques dirigidos por grau teriam fragmentado o sistema de maneira quase 15 vezes mais eficiente. Por outro lado, esta rede não é modular apesar de novamente apresentar uma arquitetura mais “escura" que o usual. Por termo, demonstra-se que os ataques por arestas estão diretamente relacionados ao aprisionamento enquanto que a ressocialização e/ou morte dos indivíduos é melhor interpretada como a remoção por vértices. Destarte, comprovou-se que de um ponto de vista topológico a ressocialização é de fato mais eficiente em reduzir a criminalidade do que o aprisionamento. Contudo, na rede de crimes federais estudada essa diferenca é muito pequena, de tal modo que ambas as políticas poderiam, em tese, ser aplicadas a fim de se combater eficientemente o sistema criminoso. / In this thesis we investigate three points connected to topological fragilities of graphs and their applications to real complex networks and, in particular, to networks of criminal relationships. In the first step, we present an unprecedented and efficient method of fragmentation of complex networks by modules. Firstly, the procedure identifies topological communities through which the network can be represented using heuristic communities extraction algorithms. After that, only the nodes that bridge communities are removed in descending order of their betweenness centrality . We illustrate the method by the applying it to a variety of real networks in the social, infrastructure, and biological fields. We show that the modular approach outperforms attacks traditional attacks based only on the ordering of centrality indexes, with efficiency gains strongly related to the modularity of the network. In the second moment, we introduce the concepts of generalized robustness and fragility of networks to evaluate how much a certain system behaves in the face of incomplete attacks. Also, we evaluate the relation between robustness and computational cost of several sequential and simultaneous attacks to modular networks by means of an empirical measure that we call performance. In this sense, we show through artificial and real networks that for highly modular systems the strategy of fragmentation by modules presents a performance up to 10 times superior to traditional attacks. In the last step, we explore in more depth the underlying nature of real networks of criminal relationships. We present a unique and unprecedented network built by the Brazilian Federal Police consisting of more than 35,000 relationships among 24,000 individuals. The data were collected between April and August 2013 and consist of information provided directly by the investigators responsible for each case. The system has typical characteristics of social networks, but is much "darker"than traditional social networks, with low levels of edge density and network efficiency. Moreover, the network is extremely modular which implies that it is possible to dismantle all the network of Brazilian federal crimes with the removal of approximately 2% of the individuals chosen according to the modular method. Also the network is controllable in the sense of the mathematical control theory, meaning that with access only to 20% of nodes it is possible, In theory, to take any dynamic variable from an initial state to an arbitrary final state in a finite time. We also show a topological analysis of a second criminal network related to Federal Police investigations. This is an online forum for cybercrime in the so-called deep web. After the data collection, it was possible to build a network of relationships with almost 10,000 individuals. We then compared the strategy actually used by the Federal Police during Operation Darknet with the theoretical prediction of topological attacks on the criminal network and showed that degree-based attacks would have fragmented the system almost 15 times more efficiently. On the other hand, this network is not modular despite presenting a "darker"architecture than usual. As a last result, this particular system is not controllable in practical terms. We finish the study by showing that edge attacks are directly related to the imprisonment whereas the resocialization and/or death of the individuals is better interpreted as the removal of vertices. Thus, we prove that from a topological point of view resocialization is in fact more efficient in reducing crime rates than imprisonment. However, in the network of federal crimes studied here this difference is very small, so that both policies could in theory be applied in order to combat effectively the criminal system.

Since that environmental and life quality must be equivalents, the aim of the present study was discuss social and environmental indicators, assuming quality of life as the realization of social and environmental conditions in a balanced manner, frequently influenced by environmental, socials, economics and cultural patterns, lifestyle and aspirations. The area of the study was Itabaiana, highlighted within the Sergipe due to its geographical location and economic, social and political expressiveness. Drawing a parallel with urban centers, the city is small but has been showed a growing urban structure, indicative of vulnerabilities. The study then presents the objective assessment of quality of life in the city of Itabaiana-SE, considering social and environmental vulnerabilities and potentials of urban, rural and its territories. Procedures to identify the social and environmental vulnerabilities of availability and access of infrastructure, equipment and urban services, analyze the social and environmental consequences arising from the techniques used in irrigation; present the cultural identity of the population by the perceptual evaluation about the quality of life; make a survey of programs and actions of public intervention in urban and rural, to describe conditions in the territorial definition of urban and rural areas, made the research possible. This thesis was divided into five chapters where the first concerns the theoretical and methodological considerations and the others are linked to social, environmental, socioenvironmental, political, cultural and economic that permeate the quality of life. These dimensions are associated with the diagnosis of social and environmental indicators such as infrastructure and collective welfare, Solid Waste, Health and Technical Education of the farmer and his family, education and citizenship, work and income. The indicators were developed through prior verification of the possibility of research studies on the site associated with the parameters already used in previous research in order to merge environmental, social, economic and cultural, because the scaling of the quality of life running through each these spheres should not be judged from the trial of only one given, parameter or indicator. Overall, the survey pointed to no concern of most individuals involved in research towards social and environmental issues, since the cultural identity of the population is marked on, specifically, the question of economic/commercial. Thus, from the analysis of the indicators found the existence of vulnerabilities and potential socioenvironmental, which influence the quality of life. Thus, programs regarding access to citizenship and require long-term development, because the necessary transformations the quality of life in need of redefinition of cultural values. / Entendendo que qualidade ambiental e qualidade de vida devem ser equivalentes, vimos aqui discutir alguns indicadores reais, pressupondo qualidade de vida como a realização das condições sociais e ambientais de forma equilibrada, constantemente influenciada por padrões ambientais, sociais, econômicos, culturais, estilos de vida e aspirações. Essa pesquisa tem como área de estudo o município de Itabaiana, destaque no interior de Sergipe em decorrência de sua localização geográfica e expressividade econômica, social e política. Fazendo um paralelo com núcleos urbanos, o município é de pequeno porte, mas vem apresentando estrutura urbana crescente, indicativas de vulnerabilidades. O estudo então apresenta como objetivo avaliação da qualidade de vida do município de Itabaiana-SE, considerando vulnerabilidades e potencialidades socioambientais dos espaços urbanos, rurais e seus territórios. Procedimentos como, identificar as vulnerabilidades socioambientais de disponibilidade e acesso da infra-estrutura, dos equipamentos e serviços urbanos; analisar as conseqüências sociais e ambientais decorrentes das técnicas utilizadas na irrigação; apresentar a identidade cultural da população pela avaliação perceptiva acerca da qualidade de vida; efetuar o levantamento de programas e ações públicas de intervenção nos espaços urbanos e rurais; descrever condições de territorialização na definição dos espaços urbanos e rurais, tornaram a pesquisa viável. Esta dissertação foi dividida em cinco capítulos onde um diz respeito às considerações teórico-metodológicas e quatro correspondem às dimensões social, ambiental, socioambiental, político-cultural e econômica que permeiam a qualidade de vida. Essas dimensões estão associadas ao diagnóstico de indicadores socioambientais tais como: Infraestrutura e bem-estar coletivo, Resíduos sólidos, Saúde e Instrução técnica do agricultor e seus familiares, Educação e cidadania, Trabalho e renda. Os indicadores foram elaborados por meio da verificação prévia de possibilidade de pesquisa no local associados a estudos de parâmetros já utilizados em pesquisas anteriores com o intuito de mesclar aspectos ambientais, sociais, econômicos e culturais, pois o dimensionamento da qualidade de vida perpassa por cada uma dessas esferas, não devendo ser avaliada a partir do julgamento isolado de um único dado, parâmetro ou indicador. De forma geral, a pesquisa apontou para a não preocupação da maioria dos indivíduos envolvidos na pesquisa para com as questões socioambientais, uma vez que a identidade cultural marcante da população está ligada, especificamente, a questão do desenvolvimento econômico/comercial. Logo, a partir da análise dos indicadores constatou-se a existência de vulnerabilidades e potencialidades socioambientais, as quais influenciam a qualidade de vida da população. Desse modo, programas de respeito e acesso a cidadania necessitam de desenvolvimento em longo prazo, pois as transformações indispensáveis a qualidade de vida carecem de redefinição dos valores culturais.

No campo da prevenção ao HIV, a maior parte dos esforços se dedica as pessoas soronegativas que nos programas e pesquisas aparecem como sinônimo de todos. A noção de Prevenção Positiva produzida no âmbito da resposta brasileira , por outro lado, considerou que as PVHA também necessitam de cuidados preventivos únicos. A presente dissertação se propõe a examinar a produção científica que descreve intervenções de prevenção positiva, bem como as suas possíveis contribuições na resposta à epidemia de HIV/AIDS, analisadas na perspectiva informada pelo quadro das vulnerabilidades e dos direitos humanos, que possibilitou a produção de uma noção singular de prevenção positiva ao longo da 3a década de epidemia. Para tanto, utilizamos como método de pesquisa a revisão de escopo (scoping review) que permitiu sintetizar o conhecimento sobre intervenções de prevenção positiva disponibilizadas nas bases de dados escolhidas (CINAHL, ERIC, Lilacs, MedLine, PsycInf, Scopus, Web of Science e Google Acadêmico). Dos 700 artigos recuperados, foram selecionados 15 artigos, a partir dos critérios de busca. Entre outros achados, os estudos confirmaram o entendimento de que, historicamente, a prevenção do HIV se constituiu no campo sócio-comportamental. Não à toa, as intervenções centraram-se quase inteiramente na prevenção da transmissão do HIV e controle da epidemia, não no bem-estar das pessoas vivendo com HIV. Discutimos que as intervenções disponíveis na literatura, apesar da esperada inovação cunhada como prevenção positiva, sustentam a mesma prioridade de proteger as pessoas HIV negativas de serem infectadas por seus parceiros HIV positivos e perdem a oportunidade de inovar programas existentes, a partir do momento que não levam em conta os contextos diferentes de vulnerabilidade social e ação programática, que excluem os marcadores de [8] desigualdade (como classe ou gênero) e os projetos de cada pessoa vivendo com HIV na sua vida cotidiana e sua vulnerabilidade pessoal. Defendemos a maior produtividade de uma concepção que supere esse modelo que leva à culpabilização das PVHA e à sobreposição de estigmas que enfrentam, para fortalecer uma noção de prevenção solidária e compartilhada realizada em intervenções de prevenção positiva balizadas pela atenção integral à saúde e pela defesa e promoção dos direitos humanos das pessoas afetadas pela AIDS / In the HIV prevention field, most part of the emissions are dedicated as seronegative people that appear in programs and researches as synonymous of all. The notion of Positive Prevention produced within the scope of the Brazilian response, conversely, considered that PLWHA also need single preventive care. This thesis proposes to examine the scientific production that describes positive prevention interventions as well as their possible contributions for the response to HIV/AIDS epidemic, analyzed from an informed perspective by the vulnerability and human rights framework, which made possible the production of single notion about the positive prevention throughout the 3rd epidemics decade. For this purpose, was used as a research method, a scoping review that allowed synthesizing knowledge about positive prevention interventions available in the chosen databases (CINAHL, ERIC, Lilacs, MedLine, PsycInf, Scopus, Web of Science and Google Scholar). Of the 700 recovered articles, were selected 15 articles based on the search criteria. Among other discoveries, the studies confirmed the understanding that, historically, HIV prevention has been in the socio-behavorial field. Not by accident, the interventions focused almost entirely on preventing HIV transmissions and controlling the epidemic, not on the well-being of people living with HIV. Was discussed that interventions available in the literature, despite the expected innovation named as positive prevention, support the same priority in protecting HIV negative people from being infected by their HIV positive partners and miss the opportunity to innovate existing programs, from the moment that they dont consider the distinct contexts of social vulnerability and programmatic action that exclude markers of inequality (such as class or gender) and the projects of each person living with HIV in their daily lives and personal vulnerability. We defend the higher productivity of a conception that [10] overcome this model that blames the PLWHA and the overlapping of stigmas they face in order to strengthen the notion of solidarity and shared prevention carried out in interventions of positive prevention defined by integral health care and the defense and promotion of the Human Rights of people affected by AIDS

Cette étude exploratoire a pour objectifs de cerner les modalités de réaction des personnes atteintes de cancer face à la reprise du travail et de repérer les ressources ou les facteurs de vulnérabilité face à cette reprise. Quatre-vingts sujets sont répartis en trois groupes : 33 sujets qui ne bénéficient d’aucun accompagnement spécifique, 44 sujets reçus à la consultation d’aide à la reprise du travail après un cancer du CHU de Rouen et 3 sujets qui ne souhaitent plus reprendre le travail. Les caractéristiques psychologiques, médicales et socioprofessionnelles des sujets non consultants et des sujets consultants sont comparées. Les données relatives aux sujets qui ont abandonné leur projet de reprise du travail sont analysées sur un plan qualitatif. Nous nous attendions à ce que les sujets consultants soient plus vulnérables que les sujets non consultants. Nos résultats soulignent que les sujets des deux groupes ne sont pas si différents. Les facteurs de vulnérabilité présentés par les sujets consultants n’ont pas eu d’incidence sur la reprise du travail. L’aide de la consultation a pu favoriser une forme de résilience et l’autonomie psychique chez ces sujets. Les situations des sujets qui ne souhaitent plus reprendre un travail ont amené des éléments de compréhension face à la sortie de l’emploi après le diagnostic de cancer. Ce travail confirme la singularité de chaque situation de cancer et souligne un besoin spécifique à cette population, celui d’un accompagnement individualisé. Celui-ci doit être envisagé tout au long du processus de reprise du travail pour prévenir des difficultés susceptibles d’apparaître bien au-delà de cette reprise. / This exploratory study aims to identify the modalities of reaction of people with cancer who face the resumption of work and identify the resources or the vulnerabilities facing return to work. Eighty persons divided into three groups: 33 persons who return to work without accompaniment, 44 persons who solicit the department of ‘return to work after a cancer’ (University Hospital of Rouen) and 3 persons who no longer wish to return to work. The psychological, medical, social and professional characteristics of non consultants and consultants are compared. A qualitative analysis (case studies) is performed for the results concerning the three persons that have abandoned their plans to return to work. We expected that consultants are more vulnerable than non consultants. Our results emphasize that both groups are not so different. The vulnerability factors presented by consultants did not have any impact on return to work. The help provided by the department had probably promoted a form of resilience and psychological autonomy for these patients. The situations of persons that have no intention to return to work have highlighted elements of understanding of the reasons which encourage them to quit their job after cancer diagnosis. This study confirms the uniqueness of each situation of cancer. Our results highlight a specific need for this population that of an individualized support. The possibility of being supported throughout the return to work process should be considered in order to prevent issues that may appear beyond this resumption.

Cette thèse a pour objet d'étudier la sécurité économique dans un contexte de mondialisation. Au sens large du terme la sécurité économique est l’absence de menaces contre le patrimoine économique. La protection de ce patrimoine est effectuée par de nombreuses mesures et politiques et des instruments juridiques. L’intelligence économique avec ses outils a permis le passage d’une sécurité strictement passive à une sécurité active. Les politiques liées à la protection du patrimoine économique s’opèrent par une coopération entre le public et le privé. La recherche met l’accent sur la notion de sécurité économique à l’épreuve de la mondialisation, permettant d’analyser de façon globale les menaces et les politiques de riposte dans un environnement de globalisation économique. / This thesis has for object to study the economic security in a context of globalization. In the broad sense term the economic security is the absence of threats against the economic heritage. The protection of this heritage is carried by many measures and policies and legal instruments. The competitive intelligence with its tools allowed the passage of a strictly passive security an active security. The policies related to economic heritage protection take place by cooperation between the public and the private sector. The search emphasizes the notion of economic security in the event of the globalization, allowing to analyse in a global way the threats and the policies of retort in an environment of economic globalization.

The issue approached in this study is the possible gaps in cybersecurity in the Closed-Circuit TV system (CCTV) currently being implemented in Jamaica. During 2018, the government of Jamaica together with systems developers from MSTech Solutions developed and started to implement a video surveillance system with the aim to cover the entire nation to reduce criminal activities and create a safer society. To address potential problems of cybersecurity in this system, the purpose of this study was to explore which cybersecurity domains and factors were the most important in the JamaicaEye project. In order to examine such a purpose, the cybersecurity of the system is put into contrast with the cybersecurity domains of the C2M2 model to unveil similarities and differences in cybersecurity strategy and application. To be able to collect in-depth data of the JamaicaEye project, a hybrid of a field-and a case- study took place in Ocho Rios, Jamaica, during approximately 9 weeks. Data collection was carried out through interviews with representatives from the Jamaican government and the systems developer, MSTech Solutions. After compiling and transcribing the collected data from the interview the color coding and comparison of the results with the cybersecurity capability maturity model, C2M2, started. The C2M2 model was chosen as the theoretical framework for this study. The results of mapping the theoretical data with the empirical data gave underlying material and a perspective on the most important cybersecurity factors in the JamaicaEye system. This study will be a foundation for future expansion of the project in Jamaica, but also similar projects in other nations that are in need for cybersecurity development, management and assessment. Mainly, this study will be useful for those in the industry of development, analysis and assessment, and cybersecurity of CCTV systems.

En investissant des dispositifs dédiés à la prise en charge des adolescents et jeunes adultes atteints de cancer en France (« AJA », 15-25 ans), cette thèse étudie les pratiques de personnalisation des soins. Les programmes personnalisés prévoient d’accompagner le processus d’autonomisation de ces jeunes malades, lors de cette période de la vie perçue comme située entre l’enfance et l’âge adulte. Comment cette considération structure-t-elle l’expérience que les jeunes font de la maladie et des soins ? Quelles formes particulières les injonctions d’autonomie prennent-elles ? L’enquête de terrain s’appuie sur quinze entretiens semi-directifs menés avec des professionnels dédiés aux « AJA » en France et en Angleterre, ainsi que sur une trentaine d’entretiens conduits avec des jeunes, leurs proches et leurs soignants au cours de deux observations participantes : l’une de cinq mois effectuée en tant qu’animateur dans la première unité française dédiée à cette population clinique à l’hôpital Saint-Louis, la seconde de deux mois en tant que socio-anthropologue au sein du programme « AJA » de Gustave Roussy. L’analyse du matériel recueilli démontre en premier lieu que la catégorie « AJA » est tributaire d’un processus de biomédicalisation. Elle met ensuite en évidence la présence de normes organisationnelles et psychosociales qui encadrent l’accompagnement de l’autonomie des « AJA ». En mobilisant le modèle de la reconnaissance, la thèse développe alors le concept d’idéologie de la personnalisation des soins pour proposer une interprétation renouvelée des situations observées, et interroger la production de vulnérabilités identitaires pour les sujets du soin. / This thesis examines the practices of care personalization through the study of units dedicated to the care of teenagers and young adults with cancer in France (“TYA”, 15-25 years). The personalized programs are designed to support the process of autonomy of these young patients, during this period of life perceived as being between childhood and adulthood. How can this consideration structure these young people’s experience of the disease and care ? Which forms do the injunctions to autonomy take ? The ethnographic survey is based on fifteen semi-structured interviews carried out by professionals dedicated to «TYA» in France and England, and on thirty interviews conducted with young people, their families and their caregivers during two participant observations : the first over five months, carried out as an activity-coordinator in the first French unit dedicated to this population at the Saint-Louis hospital, and the second over two months, as a socio-anthropologist within the Gustave Roussy «TYA» program. The analysis of the information collected demonstrates first of all that the «TYA» category is dependent on a biomedicalization process. It then highlights the existence of organizational and psychosocial norms which formalize support of the «TYA» autonomy. By mobilizing the recognition theory, the thesis finally develops the concept of ideology of the personalization of care to propose a reinterpretation of observed situations, and to question the production of identity vulnerabilities for the subjects of care.

The use of Internet-of-Things (IoT) makes it possible to inter-connect Information Technology (IT) and Operational Technology (OT) into a completely new system. This convergence is often known as Industrial IoT (IIoT). IIoT brings a lot of benefits to industrial assets, such as improved efficiency and productivity, reduced cost, and depletion of human error. However, the high inter-connectivity opens new possibilities for cyber incidents. These incidents can cause major damage like halting of production on the manufacturing line, or catastrophic havoc to companies, communities, and countries causing power outages, floods, and fuel shortages. Such incidents are important to be predicted, stopped, or alleviated at no cost. Moreover, these incidents are a great motive for researchers and practitioners to investigate known security problems and find potential moderation strategies.  In this thesis work, we try to identify what types of IIoT systems have been investigated in the literature. We seek out to find if software-related issues can yield security problems. Also, we make an effort to perceive what are the proposed methods to mitigate the security threats.We employ the systematic literature review (SLR) methodology to collect this information. The results are gathered from papers published in the last five years and they show an increased interest in research in this domain. We find out software vulnerabilities are a concern for IIoT systems, mainly firmware vulnerabilities and buffer overflows, and there are a lot of likely attacks that can cause damage, mostly injection and DDoS attacks. There are a lot of different solutions which offer the possibility to stop the identified problems and we summarize them. Furthermore, the research gap considering the update process in these systems and devices, as well as a problem with the unsupervised software supply chain is identified.

Injektionsattack är den mest kritiska säkerhetsapplikationen för webbapplikationer, och SQL-injektion (SQLi) -attack är den mest rapporterade injektionsattacken på webbapplikationer. I denna avhandling har vi identifierat angreppsteknikerna som används av angripare och vi ger också riktlinjer så att programmerarna kan skriva webbapplikationskoder på ett säkert sätt för att förhindra SQLi-attackerna.Metoden som tillämpas för forskningen är litteraturstudie och vi använde vägen bevis genom demonstration för att få den tydliga bilden. Det första steget var att ta reda på kodningsfelen, då utformade vi riktlinjer som kan hjälpa till att skydda webbapplikationer från SQLi-attacker. Denna avhandling kommer att hjälpa programmerarna att förstå de olika kodningsbristerna och hur dessa kodningsfel kan förhindras och för detta har vi använt bevis genom demonstration. Denna avhandling kommer också att bidra till den allmänna medvetenheten om SQLi-attacker, attacker och riktlinjer för programmerare som designar, utvecklar och testar webbapplikationer. / Injection attack is the most critical web application security risk, and SQL-injection (SQLi) attack is the most reported injection attack on web applications. In this thesis, we have identified the attacking techniques used by attackers and we are also providing guidelines so that the programmers can write web application code in a secure way, to prevent the SQLi attacks.The methodology applied for the research is literature study and we used the way proof by demonstration to get the clear picture. The first step was to find out the coding flaws, then we designed guidelines that can help to protect web applications from SQLi attacks. This thesis will help the programmers to understand the various coding flaws and how those coding flaws can be prevented and for this, we have used proof by demonstration. This thesis will also contribute to the general awareness of SQLi attacks, attack types and guidelines for the programmers who are designing, developing and testing web applications.

Vulnerable code may cause security breaches in software systems resulting in financial and reputation losses for the organizations in addition to loss of their customers’ confidential data. Delivering proper software security training to software developers is key to prevent such breaches. Conventional training methods do not take the code written by the developers over time into account, which makes these training sessions less effective. We propose a method for recommending computer–security training to help identify focused and narrow areas in which developers need training. The proposed method leverages the power of static analysis techniques, by using the flagged vulnerabilities in the source code as basis, to suggest the most appropriate training topics to different software developers. Moreover, it utilizes public vulnerability repositories as its knowledgebase to suggest community accepted solutions to different security problems. Such mitigation strategies are platform independent, giving further strength to the utility of the system. This research discussed the proposed architecture of the recommender system, case studies to validate the system architecture, tailored algorithms to improve the performance of the system, and human subject evaluation conducted to determine the usefulness of the system. Our evaluation suggests that the proposed system successfully retrieves relevant training articles from the public vulnerability repository. The human subjects found these articles to be suitable for training. The human subjects also found the proposed recommender system as effective as a commercial tool.