The current research investigates how the perceived emotional responses of a majority of Americans to 9/11 (i.e., collective anger and fear) affect individuals’ support for governmental policies, in particular, military intervention, anti-immigration policy, and restricting civil liberties. Study 1 found that perceived collective anger was associated with support for military intervention and anti-immigration policy, and that those effects of perceived collective anger on policy support were significantly driven by individuals’ own anger. Study 2 showed that experimentally manipulated collective anger (i.e., exposure to the majority’s anger relative to the minority’s anger) had marginal effects on support for anti-immigration policy and restricting civil liberties, and individuals’ own anger mediated the marginal effect of collective anger on support for restricting civil liberties. Participants exposed to either the majority’s or minority’s fear supported anti-immigration policy and restricting civil liberties as strongly as did those exposed to the majority’s anger. Implications and limitations of these findings were discussed.

The threat landscape is changing with the increased popularity of cloud native systems. Adversaries are adopting new ways to attack systems. Therefore, security specialists have to adopt new approaches to their security practices. This thesis explores a purple team approach to attack automation in a cloud native environment. There are two thesis goals. The first goal is to investigate cyber threats encountered in the cloud native environments. The second goal is build a attack automation tool to improve a purple team evaluation of the cloud native environments. As a result, we create a more comprehensive resource of cloud native threats that we refer to as the Cloud Native Threat Matrix. Based on this matrix, we build a tool for attack automation. The tool follows the assume breach approach, providing a defense-in-depth security testing. As a final step, we propose an improvement to the purple team evaluation of the cloud native environments, that combines created Cloud Native Threat Matrix with an automated attack techniques execution and active collaboration as a fundamental concept of purple team evaluations. A Cloud Native Threat Matrix solves the problem of scattered threat data, providing a coherent and easy-to-use platform. In addition, the automation provides a possibility for rerunning security evaluations and making sure that security weaknesses are not re-introduced during major changes. A purple team approach allows improving system defense and response capabilities. / Angriparna förändrar sina attacker för dessa system. Därför måste även säkerhetsspecialister ta till nya metoder i sitt säkerhetsutövande. Den här avhandlingen utforskar en ”purple team”-strategi för automatiserade attacker i en molnbaserad miljö. Avhandlingen har två mål. Det första är att utforska de cyberhot som molnbaserade miljöer möts av. Det andra är att skapa ett ramverk som kan användas för ”purple team”-övningar med stöd av de automatiserade attackerna, som i sin tur är baserade på den hotmatrisen för molnbaserade miljöer. Resultatet av detta är att vi har skapat en hotmatris - en mer omfattande resurs av molnbaserade hot. Baserat på den här matrisen har vi byggt ett verktyg för automatiserade attacker. Verktyget bygger på antagandet att intrång redan har skett och bidrar med djupförsvarsbaserad säkerhetstestning av en molnbaserad miljö. Slutligen så föreslår vi även en förbättring till hur utvärderingen av ”purple teams” i en molnbaserad miljö kan utföras. Denna utvärdering kombinerar vår molnbaserade matris med en automatiserad attack exekvering samt aktivt samarbete som ett fundementalt koncept i utvärdering av ”purple teaming”. Löser en molnbaserad matris problemet med oorganiserad data angående hot genom att tillhandahålla en sammanhängande och lättanvänd plattform. Automatiseringen tillåter en möjlighet att utföra säkerhetsutvärderingarna regressivt och säkerställer att kända svagether inte blir återintroducerade under större systemförändringar. Ett ”purple team” tillvägagångsätt möjliggör förbättring av systemförsvar och incidenthantering.

The microservice architecture is a popular architectural pattern in the industry to implement large systems as they can reduce the code bases of each service and increase the maintainability for each of the individual services by dividing the application into smaller components based on business logic. The services can be implemented in different programming languages and communicates over a network. As a consequence, it might lead to a greater attack surface for an adversary of the system. In order to ease the implementation of microservice architectures, a set of design patterns exists. Two patterns addressing the security of the architecture are the API Gateway pattern and the sidecar pattern. More research is needed in order to identify the security threats microservice architecture encounters and how the design pattern handles those. This master thesis uses threat modeling with attack graphs along with attack simulations in order to investigate the threats in microservice architectures and how they compare between the design patterns. To construct the attack graphs and perform the attack simulations SecuriCAD along with CoreLang was used on a microservice architecture with each of the design patterns. The report concludes that the sidecar pattern is faced with less risk than the API Gateway pattern overall and presents a set of suggestions regarding how the security can be improved in microservice architectures. / Mikrotjänstarkitekturer har blivit ett populärt arkitekturmönster inom industrin för att implementera större system eftersom det kan reducera kodbaserna och underlätta underhållningen av varje enskild tjänst genom av att dela upp applikationen i mindre komponenter baserat på varje tjänsts domänlogik. Dessa tjänster kan vara implementerade i olika programmeringsspråk och kommunicerar med varandra över ett nätverk. Som följd skulle dock detta kunna leda till en större attackyta för en angripare av systemet. För att underlätta implementationen av mikrotjänster finns en mängd designmönster, två designmönster som hanterar säkerheten av mikrotjänstarkiterurer är API Gateway mönstret och sidecar mönstret. Mer forskning skulle dock behövas för att ta reda på vilka hot som mikrotjänstarkitekturer ställs inför samt hur väl de två design mönstren bemöter dessa. Den här masteruppsatsen använder hotmodellering med attack grafer samt attack simuleringar för att undersöka vilka hot som finns i mikrotjänstarkitekturer och hur dessa skiljer sig åt mellan de två design mönstren. För att framställa attack graferna och genomföra attack simuleringarna användes programmet SecuriCAD tillsammans med CoreLang på en mikrotjänstarkitektur med vardera design mönster. Rapporten kommer fram till att sidecarmönstrer har lägre risk i jämförelse med API Gateway mönstret överlag och presenterar en mängd förslag angående hur säkerheten kan förbättras i mikrotjänstarkitekturer.

Cisco 2014 Annual Security Report clearly outlines the evolution of the threat landscape and the increase of the number of attacks. The UK government in 2012 recognised the cyber threat as Tier-1 threat since about 50 government departments have been either subjected to an attack or a direct threat from an attack. The cyberspace has become the platform of choice for businesses, schools, universities, colleges, hospitals and other sectors for business activities. One of the major problems identified by the Department of Homeland Security is the lack of clear security metrics. The recent cyber security breach of the US retail giant TARGET is a typical example that demonstrates the weaknesses of qualitative security, also considered by some security experts as fuzzy security. High, medium or low as measures of security levels do not give a quantitative representation of the network security level of a company. In this thesis, a method is developed to quantify the security risk level of known and unknown attacks in an enterprise network in an effort to solve this problem. The identified vulnerabilities in a case study of a UK based company are classified according to their severity risk levels using common vulnerability scoring system (CVSS) and open web application security project (OWASP). Probability theory is applied against known attacks to create the security metrics and, detection and prevention method is suggested for company network against unknown attacks. Our security metrics are clear and repeatable that can be verified scientifically

В условиях цифровой трансформации и внедрения новых технологий, разные слои общества, поколения, профессиональные группы все чаще сталкиваются с информационно-психологическим воздействием различного рода угроз. С одной стороны, стоит необходимость активизации процессов цифровизации, которые позволяют сократить сроки выполнения работы, повысить производительность труда и сократить рутинность многих операций. С другой стороны, проявился и ряд проблем, связанных с технической неготовностью персонала к внедрению новых тенденций, повышением напряженности в обществе из-за угрозы сокращения рабочих мест, страхом и внутренней неуверенностью сотрудников. На этом фоне встал вопрос касаемо поддержания психологической безопасности для сохранения оптимальной жизнедеятельности и успешного выполнения профессиональной деятельности персонала. / In the context of digital transformation and the introduction of new technologies, different segments of society, generations, professional groups are increasingly faced with the information and psychological impact of various kinds of threats. On the one hand, there is a need to intensify digitalization processes, which can reduce the time for completing work, increase labor productivity and reduce the routine of many operations. On the other hand, a number of problems appeared related to the technical unpreparedness of the staff to introduce new trends, increased tension in society due to the threat of job cuts, fear and internal uncertainty of employees. Against this background, the question arose regarding the maintenance of psychological safety in order to maintain optimal life activity and the successful implementation of the professional activities of the staff.

Enterprises have focused on mechanisms to track insiders who may intentionally exceed and misuse their authorized access. However, there is an opportunity to understand why a trusted individual would want to exploit the trust and seek information with the intent of a malicious outcome. The detection of insider rogue or nefarious activities with information to which a user is already authorized is extremely difficult. Such insider threats require more deliberation than just considering it to be a problem that can be mitigated only by software or hardware enhancements. This research expects to help gain an early understanding of antecedents to such information behavior and provide an opportunity to develop approaches to address relevant character traits which could lead to a higher propensity of information misuse. This research proposes a theoretical framework and a conceptual research model to understand the antecedent factors to opportunistic information-seeking behavior of individuals. The study follows the three-essay format. Essay 1 explores the scholarly literature published about insider behavior to understand information behavior and proposes the theoretical framework for the study. PRISMA methodology was used for the thematic literature review. Essay 2 is a quantitative study of 424 university students surveyed using an online instrument for their responses to various scenarios in the context of academic dishonesty. Academic dishonesty is proposed as a proxy for information misuse. Essay 3 is a qualitative study engaging senior executives from various industries to understand their perspectives on the behavioral characteristics of individuals as they try to protect their corporate information from being misused and protect their reputation and liability from malicious use of their information.

Abstrakt The violence within the state's institutional board is extensive and affects both staff and young people. The State Board of Institutions has attracted a lot of attention in the media and several reports and articles have described the problem. The State Board of Institutions is an authority that provides compulsory care for adult addicts and young people. The problems within the state's institutional board will not be solved by themselves. The violence seems to be escalating and something must be done. An important part of the work is decision-making. Every situation requires decision making and even when no decision is made it is decision making. The purpose of the essay is to examine the emotional decision-making within the state's institutional board. Qualitative interviews have been chosen as the method. These consisted of two focus groups with follow-up interviews. The previous research consists of research on the state's institutional board, a research on social workers and one on decision-making. The theory consists of Hochschild's emotional work and theoretical concepts from it. Important conclusions in the work are that emotional decision-making is highly individual and is based on one's own reason. Important factors for the treatment educators' emotional decision-making are the immediate supervisor, young people, colleagues, knowledge of and trust in methods. There are points of contact with the theory, mainly when it comes to the profession and professional role.

After the hit of the COVID-19 pandemic, the hotel industry's efforts need to focus on recovering travelers' confidence by introducing new safe and clean programs or seals. However, there is a lack of guidelines regarding which hotel safety/cleaning programs and what communication strategies are more effective when approaching guests. This study aims to address this gap by using a 2 (COVID-19 Message Type: Fear Appeals vs. Hope Appeals) × 2 (Hotel Safety/Cleaning Program Type: Internal vs. Third-Party) between-subject experiment design. Specifically, it applies the protection motivation theory in investigating the effects of different messages (hope vs. fear) along with different types of hotel safety/cleaning programs (internal vs. third-party) on guests' booking intentions. The moderating role of risk propensity was also explored. The data were collected in a public university located south of the U.S. Different ANOVA and MANOVA tests were conducted. The results suggest that hope appeal messages and hotel internal cleaning programs arouse higher booking intentions. When presenting COVID-19 related information provided by hotels, hope appeals represent a better communication strategy. In addition, the coping and threat appraisals showed to be correlated with hotel guests' booking intentions. Moreover, response efficacy was the strongest predictor with a positive correlation, whereas perceived severity was the second strongest predictor with a negative correlation. Last, risk propensity was found a significant moderator between guests' response efficacy and booking intentions. Participants under the risk-taker category reported higher booking intentions even when their self-efficacy perceptions were low.

Motivated by recent claims from youth that older generations are jeopardizing their future, the purpose of this thesis is to study potential explanations for the variation of intergenerational blame attribution among Swedish youth. Ordinary least squares regression analysis is conducted on survey data, especially focused on young participants, to test several hypotheses about how perceived economic threats and one’s value orientation can impact young people’s motivation to blame elderly generations for economic difficulties. The thesis does not find statistical support that one’s birth cohort - used as a proxy for childhood socialization during different economic conditions - moderates the effect of perceived threat on intergenerational blame attribution. However, when a person’s value orientation is explicitly measured in a regression model, the findings indicate that characteristics acquired earlier in life can alter a person’s reaction to presently perceived threats. The result shows that authoritarians are more prone to attribute blame towards older generations as a matter of habit, but also that libertarians are susceptible to changing their attitudes to liken authoritarians given a tangible threat. Furthermore, the study provides empirical evidence suggesting that libertarians and authoritarians react to perceived economic threats differently. These findings are evaluated in relation to measuring perceived threat in a survey context and the linear interaction effect assumption in multiplicative linear models.

付記する学位プログラム名: 霊長類学・ワイルドライフサイエンス・リーディング大学院 / 京都大学 / 新制・課程博士 / 博士(理学) / 甲第24828号 / 理博第4977号 / 新制||理||1710(附属図書館) / 京都大学大学院理学研究科生物科学専攻 / (主査)准教授 山本, 真也, 教授 平田, 聡, 教授 村山, 美穂 / 学位規則第4条第1項該当 / Doctor of Science / Kyoto University / DGAM