This thesis is a comparative study of the national security strategies of Sweden, Russia and the Czech Republic. The analysis investigates the contextual analysis made by each country and the identified security threats. To compare and find out the similarities and differences two theoretical approaches are used: realism and liberalism. To compare and identify the threats a five factor model is used, originating of general military threat assessment. / <p>Erasmus</p>

Cybersecurity threats have surged in the past decades. Experts agree that conventional security measures will soon not be enough to stop the propagation of more sophisticated and harmful cyberattacks. Recently, there has been a growing interest in mastering the complexity of cybersecurity by adopting methods borrowed from Artificial Intelligence (AI) in order to support automation. Moreover, entire security frameworks, such as DETECT (Decision Triggering Event Composer and Tracker), are designed aimed to the automatic and early detection of threats against systems, by using model analysis and recognising sequences of events and other tropes, inherent to attack patterns. In this project, I concentrate on cybersecurity threat assessment by the translation of Attack Trees (AT) into probabilistic detection models based on Bayesian Networks (BN). I also show how these models can be integrated and dynamically updated as a detection engine in the existing DETECT framework for automated threat detection, hence enabling both offline and online threat assessment. Integration in DETECT is important to allow real-time model execution and evaluation for quantitative threat assessment. Finally, I apply my methodology to some real-world case studies, evaluate models with sample data, perform data sensitivity analyses, then present and discuss the results.

Accidental and targeted data breaches threaten sustainable business practices and personal privacy, exposing all types of businesses to increased data loss and financial impacts. This single case study was conducted in a medium-sized enterprise located in Brevard County, Florida, to explore the successful data protection strategies employed by the information system and information technology business leaders. Actor-network theory was the conceptual framework for the study with a graphical syntax to model data protection strategies. Data were collected from semistructured interviews of 3 business leaders, archival documents, and field notes. Data were analyzed using thematic, analytic, and software analysis, and methodological triangulation. Three themes materialized from the data analyses: people--inferring security personnel, network engineers, system engineers, and qualified personnel to know how to monitor data; processes--inferring the activities required to protect data from data loss; and technology--inferring scientific knowledge used by people to protect data from data loss. The findings are indicative of successful application of data protection strategies and may be modeled to assess vulnerabilities from technical and nontechnical threats impacting risk and loss of sensitive data. The implications of this study for positive social change include the potential to alter attitudes toward data protection, creating a better environment for people to live and work; reduce recovery costs resulting from Internet crimes, improving social well-being; and enhance methods for the protection of sensitive, proprietary, and personally identifiable information, which advances the privacy rights for society.

<p>Vehicles have been around in our society for over a century, until recently they have been standalone systems. With increased amounts of initiatives to inter-network vehicles to avoid accidents and reduce environmental impact the view of a vehicle as a standalone system needs to be reconsidered. Networking and cooperation between vehicles requires that all systems and the information therein are trustworthy. Faulty or malicious vehicle systems are thus not limited to only affecting a single vehicle but also the entire network. The detection of anomalous behavior in a vehicle computer system is therefore of importance. To improve the vehicle systems we strive to achieve security awareness within the vehicle computer system. As a first step we will identify threats toward the vehicle computer system and what has been done to address them.</p><p>We perform a threat analysis consisting of fault trees and misuse cases to identify the threats. The fault trees provide away to connect the threats found with vehicle stakeholders' goals. The connection between stakeholder goals and threat highlights the need for threat mitigation.</p><p>Several research initiatives are discussed to find out what has been done to address the identified threats and to find the state of the research for security in vehicle computer system.</p><p>Lastly, an error model for the Controller Area Network (CAN) is proposed to model the consequences of threats applied to the CAN bus.</p>

Vehicles have been around in our society for over a century, until recently they have been standalone systems. With increased amounts of initiatives to inter-network vehicles to avoid accidents and reduce environmental impact the view of a vehicle as a standalone system needs to be reconsidered. Networking and cooperation between vehicles requires that all systems and the information therein are trustworthy. Faulty or malicious vehicle systems are thus not limited to only affecting a single vehicle but also the entire network. The detection of anomalous behavior in a vehicle computer system is therefore of importance. To improve the vehicle systems we strive to achieve security awareness within the vehicle computer system. As a first step we will identify threats toward the vehicle computer system and what has been done to address them. We perform a threat analysis consisting of fault trees and misuse cases to identify the threats. The fault trees provide away to connect the threats found with vehicle stakeholders' goals. The connection between stakeholder goals and threat highlights the need for threat mitigation. Several research initiatives are discussed to find out what has been done to address the identified threats and to find the state of the research for security in vehicle computer system. Lastly, an error model for the Controller Area Network (CAN) is proposed to model the consequences of threats applied to the CAN bus.

Le Cloud Computing (CC) ouvre de nouvelles possibilités pour des services plus flexibles et efficaces pour les clients de services en nuage (CSC). Cependant, la migration vers le cloud suscite aussi une série de problèmes, notamment le fait que, ce qui autrefois était un domaine privé pour les CSC, est désormais géré par un tiers, et donc soumis à ses politiques de sécurité. Par conséquent, la disponibilité, la confidentialité et l'intégrité des CSC doivent être assurées. Malgré l'existence de mécanismes de protection, tels que le cryptage, la surveillance de ces propriétés devient nécessaire. De plus, de nouvelles menaces apparaissent chaque jour, ce qui exige de nouvelles techniques de détection plus efficaces.Les travaux présentés dans ce document vont au-delà du simple l’état de l'art, en traitant la menace interne malveillante, une des menaces les moins étudiées du CC. Ceci s'explique principalement par les obstacles organisationnels et juridiques de l'industrie, et donc au manque de jeux de données appropriés pour la détecter. Nous abordons cette question en présentant deux contributions principales.Premièrement, nous proposons la dérivation d’une méthodologie extensible pour modéliser le comportement d’un utilisateur dans une entreprise. Cette abstraction d'un employé inclut des facteurs intra-psychologiques ainsi que des informations contextuelles, et s'inspire d'une approche basée sur les rôles. Les comportements suivent une procédure probabiliste, où les motivations malveillantes devraient se produire selon une probabilité donnée dans la durée.La contribution principale de ce travail consiste à concevoir et à mettre en œuvre un cadre de détection basé sur les anomalies pour la menace susmentionnée. Cette implémentation s’enrichit en comparant deux points différents de capture de données : une vue basée sur le profil du réseau local de la entreprise, et une point de vue du cloud qui analyse les données des services avec lesquels les clients interagissent. Cela permet au processus d'apprentissage des anomalies de bénéficier de deux perspectives: (1) l'étude du trafic réel et du trafic simulé en ce qui concerne l'interaction du service de cloud computing, de manière de caractériser les anomalies; et (2) l'analyse du service cloud afin d'ajouter des statistiques prenant en compte la caractérisation globale du comportement.La conception de ce cadre a permis de détecter de manière empirique un ensemble plus large d’anomalies de l’interaction d'une entreprise donnée avec le cloud. Cela est possible en raison de la nature reproductible et extensible du modèle. En outre, le modèle de détection proposé profite d'une technique d'apprentissage automatique en mode cluster, en suivant un algorithme adaptatif non supervisé capable de caractériser les comportements en évolution des utilisateurs envers les actifs du cloud. La solution s'attaque efficacement à la détection des anomalies en affichant des niveaux élevés de performances de clustering, tout en conservant un FPR (Low Positive Rate) faible, garantissant ainsi les performances de détection pour les scénarios de menace lorsque celle-ci provient de la entreprise elle-même / Cloud Computing (CC) opens new possibilities for more flexible and efficient services for Cloud Service Clients (CSCs). However, one of the main issues while migrating to the cloud is that what once was a private domain for CSCs, now is handled by a third-party, hence subject to their security policies. Therefore, CSCs' confidentiality, integrity, and availability (CIA) should be ensured. In spite of the existence of protection mechanisms, such as encryption, the monitoring of the CIA properties becomes necessary. Additionally, new threats emerge every day, requiring more efficient detection techniques. The work presented in this document goes beyond the state of the art by treating the malicious insider threat, one of the least studied threats in CC. This is mainly due to the organizational and legal barriers from the industry, and therefore the lack of appropriate datasets for detecting it. We tackle this matter by addressing two challenges.First, the derivation of an extensible methodology for modeling the behavior of a user in a company. This abstraction of an employee includes intra psychological factors, contextual information and is based on a role-based approach. The behaviors follow a probabilistic procedure, where the malevolent motivations are considered to occur with a given probability in time.The main contribution, a design and implementation of an anomaly-based detection framework for the aforementioned threat. This implementation enriches itself by comparing two different observation points: a profile-based view from the local network of the company, and a cloud-end view that analyses data from the services with whom the clients interact. This allows the learning process of anomalies to benefit from two perspectives: (1) the study of both real and simulated traffic with respect to the cloud service's interaction, in favor of the characterization of anomalies; and (2) the analysis of the cloud service in order to aggregate data statistics that support the overall behavior characterization.The design of this framework empirically shows to detect a broader set of anomalies of the company's interaction with the cloud. This is possible due to the replicable and extensible nature of the mentioned insider model. Also, the proposed detection model takes advantage of the autonomic nature of a clustering machine learning technique, following an unsupervised, adaptive algorithm capable of characterizing the evolving behaviors of the users towards cloud assets. The solution efficiently tackles the detection of anomalies by showing high levels of clustering performance, while keeping a low False Positive Rate (FPR), ensuring the detection performance for threat scenarios where the threat comes from inside the enterprise

Threat Intelligence (TI) is a field that has been gaining momentum as an answer to theexponential growth in cyber-attacks and crimes experienced in recent years. The aim of TI is toincrease defender’s understanding of the threat landscape by collecting intelligence on howattackers operate. Simply explained, defenders use TI to identify their adversaries andcomprehend their attacking methods and techniques. With this knowledge, defenders cananticipate attackers’ moves and be one step ahead by reinforcing their infrastructure. Although research papers and surveys have explored the applications of TI and its benefits,there is still a lack of literature to address on how to establish a Threat Intelligence Program(TIP). This lack of guidance means that organisations wishing to start a TIP are on their own inthis challenging task. Thus, their TIP end generating too much or irrelevant data, and in manycases has led security professionals to ignore the intelligence provided by their TIP. This research aims to address this gap by developing an artefact that can guide organisations intheir quest of starting their own TIP. This research followed Design Science Research (DSR)methodology to design and develop a framework which can help organisations defining theirTI requirements and appropriately operationalising intelligence work to support differentInformation Security processes. Additionally, this thesis also contributes to the research fieldof Information Security by presenting a list of evaluation parameters that can be used to measurethe success of the establishment of a TIP. Three main parameters were identified: Quality ofIntelligence, which measures the value of the output produced by the TIP; Intelligence Usage,which evaluates how the intelligence is consumed and applied; and Legal, aspects concernedwith legal requirements.

No description available.

Due to erupting conflict within the European region, State officials and newspaper outlets have spoken about the ever-decreasing safety of the Swedish nation in several aspects with the digital threat being one of the forthcoming concerns. To be able to act in a proportional manner and safeguard our digitalized society we first need to gauge the digital threat landscape and uncover how much the situation has changed with the coming of this conflict. We created a wide set of questions based on the published works of academia and grey literature that are related to Cybersecurity and the digital threat landscape. We used this information to interview IT personnel that work in cybersecurity to get a perspective on how the situation looks like for the people at the forefront of this propagated threat. The interviews uncovered that the situation had indeed changed and for the worse. A more digitalized society and advancing technology combined with the existence of skillful hackers result in more frequent and sophisticated attacks. The IT personnel tasked with safeguarding their networks are very aware of this and provide some insight on how they perceive the digital threat landscape in this investigation.

In this thesis, I will argue that the role different types of perceived threat play is fundamental for how people can become more hostile or violent. Scholars have previously studied how threat perceptions can lead to outgroup hostilities and violent attitudes. Sometimes they have distinguished between realistic threats, those pertaining to wellbeing, safety and economic resources, and symbolic threats, related to culture, identity and values. Yet, despite previous research, systematic experimental evidence is scarce. Therefore, this thesis has attempted to answer the question of how realistic and symbolic threat perceptions affect outgroup hostilities through a novel survey-experimental design (n = 97) making use of Amazon’s MTurk for recruitment. It found that those exposed to a realistically framed threat exhibit more pragmatist attitudes, whereas those exposed to a symbolically framed threat leaned towards more vicious responses, although these latter results lacked statistical significance. This thesis found no difference in violent attitudes for these two types of perceived threat. These findings are important as they teach us how people can become more hostile, and how we can be aware of how actors, such as politicians, can use threat framing to achieve certain objectives.