Thesis (M.Comp.Sc.)--University of Wollongong, 2005. / Typescript. This thesis is subject to a 6 month embargo (12/12/05 to 12/06/06) and may only be viewed and copied with the permission of the author. For further information please Contact the Archivist. Includes bibliographical references: leaf 65-72.

Universiẗat, Diss.--Frankfurt a.M., 2007. / Includes bibliographical references (p. 279-293).

Thesis (doctoral)--Humboldt-Universität, Berlin, 2006. / Includes bibliographical references.

Universiẗat, Diss., 2005--Kassel. / Includes bibliographical references (p. 289-307).

Detta arbete har som syfte att kontrollera hur verksamheter har anpassat sig inför General Data Protection Regulation (GDPR, sv. Dataskyddsförordningen), både vad det gäller rutinarbete och förändringar som de har genomfört. Arbetet behandlar hur företagen har förändrat sina rutiner gällande säkerhetskopior av kritisk företagsdata och även rutiner kring rätten att bli bortglömd. Vid detta arbetes slut kommer GDPR har trätt i kraft (25:e maj 2018) och därmed bör samtliga verksamheter ha genomfört någon form av förändring inför den ändrade lagstiftningen som börjar gälla då. Då GDPR är en ny lagstiftning ( som dock varit aktuell de senaste 2 åren ) finns en del arbeten kring just GDPR och vilka verksamhetsförändringar man bör vidta. Dock har inget fokus skett på hur företag bör anpassa sina rutiner kring säkerhetskopior och hur företagen bör resonera kring rätten att bli glömd. Därmed blir detta arbete väldigt aktuellt då detta är något som många verksamheter bör ha förändrat, tänkt på och dokumenterat. Metoden som använts i denna studie är en kvalitativ form, där intervjuer har genomförts med representanter från olika verksamheter inom utvecklingsbranschen. Verksamheterna säljer sina programvaror och tjänster till kunder och de hanterar därmed ofta stora mängder personlig information som antingen passerar igenom systemen eller som lagras hos de. Organisationerna som intervjuas har jobbat med GDPR ett tag. I flera av fallen ett år tillbaka för att säkerställa att de deras åtgärder överensstämmer med GDPR. Fem intervjuer genomfördes i sin helhet. Därefter har en tematisk analys genomförts på resultatet från intervjuerna. I intervjuerna är fokus på om och vad för förändringar företagen har genomfört samt hur det ser ut i dagsläget. Efter analysen framträder tydligt att företagen har genomfört vissa förändringar i organisationen, men till större del har dessa förändringar enbart genomförts i form av kontroll av var information finns och dokumentation kring detta och de olika rutiner som finns vid företaget. / The purpose of this work is to check how companies have been adapted to the General Data Protection Regulation, both in terms of routine work and changes that they have implemented. The work addresses how companies have changed their routines regarding backups of critical business data and routines about the right to be forgotten. At the end of this work, the GDPR will come into force (25th of May 2018) and therefore all activities should have implemented some form of change in view of the changed legislation that will apply. Since GDPR is a new legislation (which has been up to date in the past 2 years), some work is being done about just GDPR and what business changes should be made. However, no focus has been on how companies should adapt their routines about backups and how businesses should reason about the right to be forgotten. This makes this work very relevant as this is something that many businesses should have changed, thought about and documented. The method used in this study is a qualitative form, in which interviews have been conducted with representatives from different activities in the development industry. The businesses sell their software and services to customers, and they often handle large amounts of personal information that either passes through the systems or is stored with them. The organizations interviewed have been working for GDPR for a while. In several of the cases a year back to ensure that their actions are in line with the GDPR. Five interviews were conducted in full. Then a thematic analysis has been conducted on the results ofthe interviews. The interviews focus on whether and what changes the companies have made and how it looks today. Following the analysis, it is clear that companies have made certain changes inthe organization, but to a large extent these changes have only been conducted in terms of checking where information is available and documentation about this and the different routines available at the company.

Utvecklingen av digital teknik tillsammans med nya affärsmodeller har nått nya nivåer under de senaste åren vilket har resulterat i att behandlingen av personuppgifter både ökat och förändrats. Problematiken med detta innefattar att den personliga integriteten i större utsträckning kränks. I syfte att harmonisera behandlingen av personuppgifter och att stärka skyddet av den personliga integriteten har EU infört en ny dataskyddsförordning. Förordningen träder i kraft den 25 maj 2018 och ska tillämpas i nationell lagstiftning vilket gör att den svenska personuppgiftslagen ersätts. Syftet med studien var att identifiera vilka åtgärder ett antal organisationer vidtagit för att följa dataskyddsförordningens regler samt vilka utmaningar som kan uppstå i omställningen. Studien är avgränsad till samtyckestexter och behandling av personuppgifter. Studien är kvalitativ och vi har med hjälp av intervjuer tagit del av ett antal organisationers syn på utmaningar och åtgärder gällande formuleringar av samtyckestexter och dess personuppgiftsbehandling. Slutsatsen i denna studie visar att samtliga organisationerna har problem att formulera samtyckestexter på ett informativt sätt vilket dataskyddsförordningen kräver. Organisationerna ser även utmaningar i behandlingen av personuppgifter. Dessa utmaningar består av komplexa IT-system innehållande mängder av personuppgifter som idag inte kan hanteras i enlighet med dataskyddsförordningen då relevant systemstöd saknas. / The rapid development of digital technology together with new business models has reached new levels in recent years, which has resulted in the processing of personal data both increasing and changing. The problem with this development involves the violation of personal integrity to a greater extent. In order to harmonize the processing of personal data and to strengthen the protection of personal privacy, the EU has introduced a new data protection regulation. The regulation will enter into force on May 25, 2018 and will apply in national legislation, which will replace the Swedish Personal Data Act. The purpose of the study was to identify what measures a number of organizations have taken to comply with the rules of data protection regulations and the challenges that may arise in the conversion. The study is limited to consent texts and processing of personal data. The study is qualitative and we have, through interviews, taken note of a number of organizations' views on challenges and measures regarding formulas of consent texts and their personal data processing. The conclusion in this study shows that all organizations have problems formulating consent texts in an informative way, which is required for adequate data protection. Organizations also see challenges in the processing of personal data. These challenges consist of complex IT systems containing amounts of personal data that today cannot be managed in accordance with the Data Protection Regulation, as relevant system support is lacking.

This thesis performs an investigation into issues concerning the broad area ofIdentity and Access Management, with a focus on open environments. Through literature research the issues of privacy, anonymity and access control are identified. The issue of privacy is an inherent problem due to the nature of the digital network environment. Information can be duplicated and modified regardless of the wishes and intentions ofthe owner of that information unless proper measures are taken to secure the environment. Once information is published or divulged on the network, there is very little way of controlling the subsequent usage of that information. To address this issue a model for privacy is presented that follows the user centric paradigm of meta-identity. The lack of anonymity, where security measures can be thwarted through the observation of the environment, is a concern for users and systems. By an attacker observing the communication channel and monitoring the interactions between users and systems over a long enough period of time, it is possible to infer knowledge about the users and systems. This knowledge is used to build an identity profile of potential victims to be used in subsequent attacks. To address the problem, mechanisms for providing an acceptable level of anonymity while maintaining adequate accountability (from a legal standpoint) are explored. In terms of access control, the inherent weakness of single factor authentication mechanisms is discussed. The typical mechanism is the user-name and password pair, which provides a single point of failure. By increasing the factors used in authentication, the amount of work required to compromise the system increases non-linearly. Within an open network, several aspects hinder wide scale adoption and use of multi-factor authentication schemes, such as token management and the impact on usability. The framework is developed from a Utopian point of view, with the aim of being applicable to many situations as opposed to a single specific domain. The framework incorporates multi-factor authentication over multiple paths using mobile phones and GSM networks, and explores the usefulness of such an approach. The models are in tum analysed, providing a discussion into the assumptions made and the problems faced by each model. / Adobe Acrobat Pro 9.5.1 / Adobe Acrobat 9.51 Paper Capture Plug-in

The purpose of this thesis work was to conduct a general research on existing security techniques and come up with a considerable algorithm for data security in cloud storage. Cloud storage is an infrastructure or is a model of computer data storage in which the digital data is stored in logical pools. It unifies object storage for both developers and enterprises, from live applications data to cloud archival. It help to save valuable space on PC computers or mobile devices and provides the easy storage and access of data anywhere in the world. However, just as the benefits of cloud computing abounds, so also are the risks involved. If data are not well secured or encrypted before deployment for storage in the cloud, in case of negligence on the side of the developers, then hackers can gain unauthorized access to the data. The behavior of existing security algorithms on data were studied, the encryption and decryption process of the each algorithm on data was studied and also their weaknesses against attacks. Apart from data encryption, security policies also plays an important roll in cloud storage which was also covered in this report. The research work was conducted through the use of online publications, literature review, books, academic publications and reputable research materials. The study showed that regardless of the challenges in cloud storage, there is still a suitable algorithm for protecting data against attack in the cloud.

Owing to the explosive growth of data driven by e-commerce, social media, and mobile apps, data outsourcing and integration have become two popular Internet services. These services involve one or more data owners (DOs), many requesting clients, and a service provider (SP). The DOs outsource/synchronize their data to the SP, and the SP will provide query services to the requesting clients on behalf of DOs. However, as a third-party server, the SP might alter (leave out or forge) the outsourced/integrated data and query results, intentionally or not. To address this trustworthy issue, the SP is expected to deliver their services in an authenticatable manner, so that the correctness of the service results can be verified by the clients. Unfortunately, existing work on query authentication cannot preserve the privacy of the data being queried. Furthermore, almost all previous studies assume only a single data source/owner, while data integration services usually combine data from multiple sources. In this dissertation, we take the first step to study the authentication of location-based queries with confidentiality and investigate authenticated online data integration services. Cost models, security analysis, and experimental results consistently show the effectiveness and robustness of our proposed schemes under various system settings and query workloads.

Den 25e maj i år 2018 träder den nya dataskyddsförordningen, även kallad ”General Data Protection Regulation” från EU i kraft. Det just nu rådande EU-direktivet som behandlar dataskydd är från år 1995, och mycket har förändrats sedan dess. Därför är det av hög grad aktuellt med en ny moderniserad förordning som passar bättre in i en växande digital värld. I dagsläget är det Sveriges personuppgiftslag, PuL som styr över hur personuppgifter skall behandlas. PuL kommer att ersättas av GDPR och detta kommer att medföra strängare lagar kring informationshantering av personliga uppgifter och även fler rättigheter till varje enskild individ. Ett exempel på det är att personer kommer att kunna ifrågasätta syftet med varför deras data hanteras och hur den skyddas. Det blir samtidigt en utmaning för företag att se över sina IT-system, så att informationen hanteras korrekt och lever upp till de nya regler som GDPR innefattar. I denna studie kommer detta problemområde att behandlas och då främst en djupdykning inom fitnessbranschen. För att kunna genomföra detta har fyra olika gym valts ut och undersökningen kommer att fokusera på hur de hanterar förändringar och utmaningar i sitt förberedande arbete för att uppnå kraven i GDPR. Det kommer även att vara inriktat på vilken typ av hälsodata som samlas in samt den tekniska hanteringen ur ett integritets- och säkerhetsperspektiv. / On 25 May in 2018, the new data protection regulation, also known as the "General Data Protection Regulation" of the EU, comes into force. The current EU directive dealing with data protection is from 1995, and much has changed since then. Therefore, it is highly relevant to a new modernized regulation that fits better into a growing digital world. At present, Sweden's Personal Data Act, PuL, governs how personal data are to be processed. PuL will be replaced by GDPR and this will impose stricter laws on information management of sensitive data and also more rights to each individual. An example of it is that people will be able to say that they want their data deleted and not have it stored. At the same time, it is a challenge for companies to review their IT systems, so that information is handled properly and meets the new requirements that GDPR includes. In this study this problem area will be addressed and then mainly a deep diving in the fitness industry. In order to accomplish this, four different gyms have been selected and the survey will focus on how they handle changes and challenges in their preparatory work to achieve the requirements of the GDPR. It will also focus on the type of health data collected and the technical management.