Spelling suggestions: "subject:"vulnerability aanalysis"" "subject:"vulnerability 2analysis""
1 |
Vulnerability Assessment and Risk Mitigation: The Case of Vulcano Island, ItalyGalderisi, Adriana, Bonadonna, Costanza, Delmonaco, Giuseppe, Ferrara, Floriana Federica, Menoni, Scira, Ceudech, Andrea, Biass, Sebastien, Frischknecht, Corine, Manzella, Irene, Minucci, Guido, Gregg, Chris 01 January 2013 (has links)
This paper reports on a comprehensive vulnerability analysis based on a research work developed within the EC ENSURE Project (7FP) dealing with the assessment of different volcanic phenomena and induced mass-movements on Vulcano Island (S Italy) as a key tool for proactive efforts for multi-risk mitigation. The work is mainly focused on tephra sedimentation and lahar hazards and related physical, systemic and mitigation capacities.
|
2 |
Vulnerability Assessment and Risk Mitigation: The Case of Vulcano Island, ItalyGalderisi, Adriana, Bonadonna, Costanza, Delmonaco, Giuseppe, Ferrara, Floriana Federica, Menoni, Scira, Ceudech, Andrea, Biass, Sebastien, Frischknecht, Corine, Manzella, Irene, Minucci, Guido, Gregg, Chris 01 January 2013 (has links)
This paper reports on a comprehensive vulnerability analysis based on a research work developed within the EC ENSURE Project (7FP) dealing with the assessment of different volcanic phenomena and induced mass-movements on Vulcano Island (S Italy) as a key tool for proactive efforts for multi-risk mitigation. The work is mainly focused on tephra sedimentation and lahar hazards and related physical, systemic and mitigation capacities.
|
3 |
J-WAVE: A Java Web Application for Vulnerability EducationKyer, Michael Alexander 28 May 2024 (has links)
Static application security testing (SAST) tools are commonly used by professionals to identify security vulnerabilities before deployment. While there are many such tools, they offer competing features and can be difficult and time-consuming to install and configure. To simplify the usage of these services for professors and students alike, this paper describes the Java web application for vulnerability education, or J-WAVE. J-WAVE combines 5 SAST tools into one web application: PMD, FindSecurityBugs, Semgrep, Yasca, and SonarQube.
Making these tools available in an educational context is a proactive application of tools typically used in a reactive manner. J-WAVE offers simplicity to users by handling each tool's setup internally, while offering access to the large, collective rule set contributed by the combined tool suite. These attributes allow students to easily scan their own projects to detect a variety of security issues prior to submission. Likewise, educators can scan their students' code to detect common vulnerabilities present. This process is made easier as J-WAVE can accept batch submissions containing thousands of files. The SAST tools in JWAVE are complementary, and using them together helps detect a wider range of problems.
However, different tools should be prioritized depending on what files are being scanned.
PMD and SonarQube reports should be prioritized within general applications. Whereas, Semgrep and Yasca reports should be prioritized for scans of web applications. This paper reports on experiences from applying J-WAVE's tool suite to student submissions in two courses: an advanced data structures course, and a web application development course. / Master of Science / Static application security testing (SAST) tools are commonly used by professionals to identify security vulnerabilities before deployment. While there are many such tools, they offer competing features and can be difficult and time-consuming to install and configure. To simplify the usage of these services for professors and students alike, this paper describes the Java web application for vulnerability education, or J-WAVE. J-WAVE combines 5 SAST tools into one web application: PMD, FindSecurityBugs, Semgrep, Yasca, and SonarQube.
Making these tools available in an educational context is a proactive application of tools typically used in a reactive manner. J-WAVE offers simplicity to users by handling each tool's setup internally, while offering access to the large, collective rule set contributed by the combined tool suite. These attributes allow students to easily scan their own projects to detect a variety of security issues prior to submission. Likewise, educators can scan their students' code to detect common vulnerabilities present. This process is made easier as J-WAVE can accept batch submissions containing thousands of files. The SAST tools in JWAVE are complementary, and using them together helps detect a wider range of problems.
However, different tools should be prioritized depending on what files are being scanned.
PMD and SonarQube reports should be prioritized within general applications. Whereas, Semgrep and Yasca reports should be prioritized for scans of web applications. This paper reports on experiences from applying J-WAVE's tool suite to student submissions in two courses: an advanced data structures course, and a web application development course.
|
4 |
A host-based security assessment architecture for effective leveraging of shared knowledgeRakshit, Abhishek January 1900 (has links)
Master of Science / Department of Computing and Information Sciences / Xinming (Simon) Ou / Security scanning performed on computer systems is an important step to identify and
assess potential vulnerabilities in an enterprise network, before they are exploited by malicious intruders. An effective vulnerability assessment architecture should assimilate knowledge from multiple security knowledge sources to discover all the security problems present
on a host. Legitimate concerns arise since host-based security scanners typically need to
run at administrative privileges, and takes input from external knowledge sources for the
analysis. Intentionally or otherwise, ill-formed input may compromise the scanner and the
whole system if the scanner is susceptible to, or carries one or more vulnerability itself.
It is not easy to incorporate new security analysis tools and/or various security knowlege-
bases in the conventional approach, since this would entail installing new agents on every
host in the enterprise network. This report presents an architecture where a host-based
security scanner's code base can be minimized to an extent where its correctness can be
verified by adequate vetting. At the same time, the architecture also allows for leveraging
third-party security knowledge more efficiently and makes it easier to incorporate new security tools. In our work, we implemented the scanning architecture in the context of an
enterprise-level security analyzer. The analyzer finds security vulnerabilities present on a
host according to the third-party security knowledge specified in Open Vulnerability Assessment Language(OVAL). We empirically show that the proposed architecture is potent
in its ability to comprehensively leverage third-party security knowledge, and is
flexible to
support various higher-level security analysis.
|
5 |
A Framework for Software Security Testing and EvaluationDutta, Rahul Kumar January 2015 (has links)
Security in automotive industry is a thought of concern these days. As more smart electronic devices are getting connected to each other, the dependency on these devices are urging us to connect them with moving objects such as cars, buses, trucks etc. As such, safety and security issues related to automotive objects are becoming more relevant in the realm of internet connected devices and objects. In this thesis, we emphasize on certain factors that introduces security vulnerabilities in the implementation phase of Software Development Life Cycle (SDLC). Input invalidation is one of them that we address in our work. We implement a security evaluation framework that allows us to improve security in automotive software by identifying and removing software security vulnerabilities that arise due to input invalidation reasons during SDLC. We propose to use this framework in the implementation and testing phase so that the critical deficiencies of software in security by design issues could be easily addressed and mitigated.
|
6 |
Consequences of False Data Injection on Power System State EstimationJanuary 2015 (has links)
abstract: The electric power system is one of the largest, most complicated, and most important cyber-physical systems in the world. The link between the cyber and physical level is the Supervisory Control and Data Acquisition (SCADA) systems and Energy Management Systems (EMS). Their functions include monitoring the real-time system operation through state estimation (SE), controlling the system to operate reliably, and optimizing the system operation efficiency. The SCADA acquires the noisy measurements, such as voltage angle and magnitude, line power flows, and line current magnitude, from the remote terminal units (RTUs). These raw data are firstly sent to the SE, which filters all the noisy data and derives the best estimate of the system state. Then the estimated states are used for other EMS functions, such as contingency analysis, optimal power flow, etc.
In the existing state estimation process, there is no defense mechanism for any malicious attacks. Once the communication channel between the SCADA and RTUs is hijacked by the attacker, the attacker can perform a man-in-middle attack and send data of its choice. The only step that can possibly detect the attack during the state estimation process is the bad data detector. Unfortunately, even the bad data detector is unable to detect a certain type of attack, known as the false data injection (FDI) attacks.
Diagnosing the physical consequences of such attacks, therefore, is very important to understand system stability. In this thesis, theoretical general attack models for AC and DC attacks are given and an optimization problem for the worst-case overload attack is formulated. Furthermore, physical consequences of FDI attacks, based on both DC and AC model, are addressed. Various scenarios with different attack targets and system configurations are simulated. The details of the research, results obtained and conclusions drawn are presented in this document. / Dissertation/Thesis / Masters Thesis Electrical Engineering 2015
|
7 |
Static Vulnerability Analysis of Docker ImagesHenriksson, Oscar, Falk, Michael January 2017 (has links)
Docker is a popular tool for virtualization that allows for fast and easy deployment of applications and has been growing increasingly popular among companies. Docker also include a large library of images from the repository Docker Hub which mainly is user created and uncontrolled. This leads to low frequency of updates which results in vulnerabilities in the images. In this thesis we are developing a tool for determining what vulnerabilities that exists inside Docker images with a Linux distribution. This is done by using our own tool for downloading and retrieving the necessary data from the images and then utilizing Outpost24's scanner for finding vulnerabilities in Linux packages. With the help of this tool we also publish statistics of vulnerabilities from the top downloaded images of Docker Hub. The result is a tool that can successfully scan a Docker image for vulnerabilities in certain Linux distributions. From a survey over the top 1000 Docker images it has also been shown that the amount of vulnerabilities have increased in comparison to earlier surveys of Docker images.
|
8 |
A quantitative measure of the security risk level of enterprise networksMunir, Rashid, Pagna Disso, Jules F., Awan, Irfan U., Mufti, Muhammad R. January 2013 (has links)
No / Along with the tremendous expansion of information technology and networking, the number of malicious attacks which cause disruption to business processes has concurrently increased. Despite such attacks, the aim for network administrators is to enable these systems to continue delivering the services they are intended for. Currently, many research efforts are directed towards securing network further whereas, little attention has been given to the quantification of network security which involves assessing the vulnerability of these systems to attacks. In this paper, a method is devised to quantify the security level of IT networks. This is achieved by electronically scanning the network using the vulnerability scanning tool (Nexpose) to identify the vulnerability level at each node classified according to the common vulnerability scoring system standards (critical, severe and moderate). Probabilistic approach is then applied to calculate an overall security risk level of sub networks and entire network. It is hoped that these metrics will be valuable for any network administrator to acquire an absolute risk assessment value of the network. The suggested methodology has been applied to a computer network of an existing UK organization with 16 nodes and a switch.
|
9 |
Comparative analysis of automated scanning and manual penetration testing for enhanced cybersecurityRane, Nikhil, Qureshi, Amna 16 August 2024 (has links)
Yes / Web platform security has become a significant concern in the current cyber world. Adversaries constantly advance their skills and technologies to bypass modern cyber defence techniques to lure website vulnerabilities. In the cyber world, finding and mitigating vulnerabilities on the website is essential to avoid any damage to the organization. Two key techniques - vulnerability assessment and penetration testing - play a crucial role in identifying and mitigating these weaknesses. While vulnerability assessment scans the platform, revealing potential flaws, penetration testing goes a step further, simulating real-world attack scenarios to assess their true exploitability and possible damage. This paper compares automated scanning and manual penetration testing to evaluate the effectiveness of these techniques in uncovering vulnerabilities. The experimental results confirm that manual penetration testing is more effective than automated testing in terms of accuracy. Additionally, practical studies highlight the importance of a penetration tester's skills and experience in identifying and exploiting security weaknesses. Automated tools may also generate false positive results.
|
10 |
Dimensão programática da vulnerabilidade ao HIV/Aids na fronteira no norte do Brasil com a Guiana Francesa / Programmatic dimension of vulnerability to HIV/Aids on the border in the north of Brazil with French GuianaTrindade, João Farias da 18 May 2017 (has links)
A infecção pelo vírus da imunodeficiência humana (HIV) e a aids caracterizam-se como problemas de saúde pública, com incidências e prevalências elevadas em populações chaves. No Brasil a principal via de transmissão em indivíduos com 13 anos ou mais de idade é a sexual, porém, há uma tendencia de aumento na proporção de casos em homens que fazem sexo com homens nos últimos dez anos. Há escassa literaura sobre a vulnerabilidade ao HIV nas populações que vivem em região de fronteira, particularmente nas do Brasil e, mais ainda, na fronteira do Brasil com a Guiana Francesa. O estudo teve como objetivo analisar a vulnerabilidade ao HIV/Aids na dimensão programática em um município de fronteira do Brasil com a Guiana Francesa. Trata-se de um estudo descritivo, estudo de caso, tendo sido entrevistados dez depoentes: os gerentes e profissionais de saúde de Unidades Básicas de Saúde, os coordenadores das ações em DST/HIV do município de Oiapoque, o gestor local do hospital estadual, do laboratório de fronteira, os coordenadores municipal e estadual do Programa de DST/Aids e um representante de organização não governamental local envolvida com a prevenção e assistência ao portador do HIV/Aids. Também foram analisados os planos estadual e municipal de saúde, as atas de reuniões da comissão transfronteiriça Brasil-Guiana Francesa, os acordos internacionais e financiamentos para a região de Oiapoque no contexto do HIV/Aids, no período de 2012-2015. Os instrumentos de coleta de dados foram roteiros de entrevistas semiestruturadas, com questões norteadoras aos participantes, e roteiro para análise documental. As entrevistas foram gravadas, mediante consentimento dos participantes, realizadas pelo pesquisador nos meses de março a abril de 2016. Os conteúdos transcritos das entrevistas e obtidos nos documentos foram estudados pela análise de conteúdo, orientada pelo conceito da vulnerabilidade, com ênfase à dimensão programática. Como resultados se destacaram seis categorias: Expressão do compromisso dos governos; Participação e controle social; Atuações dos trabalhadores na atenção em HIV; Articulações multissetoriais das ações; Acesso aos serviços e insumos e Composição da rede de serviços. Conclui-se que há vulnerabilidade programática na medida em que o compromisso dos governos estadual e municipal no combate ao HIV é limitado, evidenciado nos planos de saúde estadual e municipal e pela escassez de investimentos financeiros no combate a doença; a participação e o controle social no enfrentamento da epidemia não têm ocorrido de forma eficiente, pois somente uma organização não governamental mantida com recurso externo tem ação efetiva em Oiapoque nas ações de prevenção; que o envolvimento dos profissionais das unidades básicas não se efetiva, com concentração de atividades na figura do profissional enfermeiro; que a articulação multissetorial para o desenvolvimento de ações de combate ao HIV não tem se concretizado, pois o setor saúde tem atuando isoladamente; que preservativos e testes diagnósticos são oferecidos, mas o tratamento e o acompanhamento dos casos não são realizados no município, sendo estes realizados em Macapá ou em Saint Georges e, por fim, a rede de serviços na atenção ao HIV e à aids não está plenamente organizada. / Human immunodeficiency virus (HIV) infection and AIDS are characterized as public health problems, with high incidence and prevalence in key populations. In Brazil, the main route of transmission in individuals aged 13 years and over is sexual, but there is a tendency to increase the proportion of cases in men who have sex with other men in the last ten years. There is little literature on the vulnerability to HIV in populations living in the border region, particularly in Brazil, and even more on the Brazilian border with French Guiana. The study aimed to analyze the vulnerability to HIV/Aids in the programmatic dimension in a border municipality of Brazil with French Guiana. It is a descriptive study, a case study, and ten deponents were interviewed: managers and health professionals from Basic Health Units, coordinators of STD / HIV actions in the municipality of Oiapoque, the local manager of the state hospital, the border laboratory, the municipal and state coordinators of the STD / Aids program and a representative of a local non-governmental organization involved in HIV/Aids prevention and care. It has also been analyzed the state and municipal health plans, the minutes of meetings of the cross-border commission Brazil-French Guiana, the international agreements and funding for the region of Oiapoque in the context of HIV/Aids in the period 2012-2015. The data collection instruments were semi-structured interview scripts, with questions guided to the participants, and a script for documentary analysis. The interviews were recorded with the consent of the participants, carried out by the researcher from March to April, 2016. The transcribed contents of the interviews and obtained in the documents were studied by content analysis, guided by the concept of vulnerability, with emphasis on the programmatic dimension. As a result, six categories were highlighted: Expression of the commitment of governments; Participation and social control; Workers\' actions on HIV care; Multisector articulation of actions; Access to services and inputs and Composition of the service network. It was concluded there is programmatic vulnerability to the extent that the commitment of state and municipal governments in the action against HIV is limited, evidenced in the state and municipal health plans and by the scarcity of financial investments in actions against the disease; the participation and social control to face up the epidemic have not occurred efficiently, because only a non-governmental organization keeping with external resources has effective action in Oiapoque in the prevention actions; that the involvement of the professionals of the basic units isnt effective, with concentration of activities in the figure of the professional nurse; that the multi sector articulation for the development of actions to combat HIV hasnt materialized, because the health sector has been working in isolation; that condoms and diagnostic tests are offered, but the treatment and follow-up of the cases are not done in the municipality, these are being realized in Macapá or in Saint Georges and, finally, the service network in HIV and aids care isnt fully organized.
|
Page generated in 0.1226 seconds