<p>Software vulnerabilities in programs and malware deployments have been increasing almost every year since we started measuring them. Information about how to program securely, how malware shall be avoided and technological countermeasures for this are more available than ever. Still, the trend seems to favor the attacker. This thesis tries to visualize the effects of a selection of technological countermeasures that have been proposed by researchers. These countermeasures: non-executable memory, address randomization, system call interception and file integrity monitoring are described along with the attacks they are designed to defend against. The coverage of each countermeasure is then visualized with the help of attack trees. Attack trees are normally used for describing how systems can be attacked but here they instead serve the purpose of showing where in an attack a countermeasure takes effect. Using attack trees for this highlights a couple of important aspects of a security mechanism, such as how early in an attack it is effective and which variants of an attack it potentially defends against. This is done by the use of what we call defensive codes that describe how a defense mechanism counters a sub-goal in an attack. Unfortunately the whole process is not well formalized and depends on many uncertain factors.</p>

Software vulnerabilities in programs and malware deployments have been increasing almost every year since we started measuring them. Information about how to program securely, how malware shall be avoided and technological countermeasures for this are more available than ever. Still, the trend seems to favor the attacker. This thesis tries to visualize the effects of a selection of technological countermeasures that have been proposed by researchers. These countermeasures: non-executable memory, address randomization, system call interception and file integrity monitoring are described along with the attacks they are designed to defend against. The coverage of each countermeasure is then visualized with the help of attack trees. Attack trees are normally used for describing how systems can be attacked but here they instead serve the purpose of showing where in an attack a countermeasure takes effect. Using attack trees for this highlights a couple of important aspects of a security mechanism, such as how early in an attack it is effective and which variants of an attack it potentially defends against. This is done by the use of what we call defensive codes that describe how a defense mechanism counters a sub-goal in an attack. Unfortunately the whole process is not well formalized and depends on many uncertain factors.

Den akuta prehospitala vården börjar ofta med ett nödsamtal. Detta, mycket komplexa samtal, är vård som ska vara av god kvalitet, ges på lika villkor och den som har störst behov ska ges företräde. Syftet med förbättringsarbetet var att genom regelbunden återkommande, strukturerad återkoppling och reflektion öka säkerställandet av vitala parametrar och korrekt prioritering i nödsamtalen. Syftet med studien var identifiera framgångs- och riskfaktorer ur SOS-operatörens perspektiv på nödsamtalet med fokus på säkerställande av vitala parametrar, korrekt prioritering samt sammanhanget runt ett nödsamtal.   Genom att, under fyra månader, tillsammans med initialt 12 operatörer, individuellt reflektera över innehållet samtalet samt skriva ned reflektionerna medvetandegjordes operatören på innehållet i samtalet. Detta ledde till en ökning gällande säkerställande av vitala parametrar och korrekt prioritering. En innehållsanalys av reflektionerna visade att det var en framgångsfaktor att vara professionell och att brister i samtalsmetodiken var en stor riskfaktor. När fastställd process för samtalet följdes var det en framgångsfaktor likväl som det var en riskfaktor när den inte följdes.   Slutsatsen blev att regelbunden avlyssning och reflektion ökar säkerställandet av vitala parametrar och korrekt prioritering i nödsamtalen samt att det är en framgångsfaktor att följa fastställd process för samtalet men att tekniskt stöd för ändamålet saknas. / The purpose of the underlying improvement work was to increase the proportion of calls in which vital parameters are secured, and the case is given correct prioritization through regular interception and reflection. The purpose of the study was to identify success and risk factors from the perspective of the emergency call-taker on the emergency call with a focus on securing vital parameters, correct prioritization and the context of the emergency call.   In the improvement work, 12 emergency call-takers were asked, within a period of four months, to individually reflected on the contents in calls and write down reflections. This was contributing to an increase in secured vital parameters and correct prioritization. A content analysis of the reflections demonstrated that it was a success factor to be professional and limitations in the call methodology was a risk factor. When the set process for the call was followed it was a success factor and a risk factor when it was not followed.   The conclusion is that regular interception and reflection increase securing vital parameters and correct prioritization in emergency calls and that it is a success factor to follow the set process for the call, but that technical support for the purpose is missing.