Floods are natural phenomena which are a threat to human settlements. Flooding can result in costly repairs to buildings, loss of business and, in some cases, loss of life. The forecasts for climate change show a further increased risk of flooding in future years. Accordingly, the flooding of residential property has been observed as on the rise in the UK. It is difficult to prevent floods from occurring, but the effects of flooding can be managed in an attempt to reduce risks and costs of repair. This can be achieved through ensuring a good understanding of the problem, and thereby establishing good management systems which are capable of dealing with all aspects of the flood. The use of an intelligent system for assessment and remediation of buildings subjected to flooding damage can facilitate the management of this problem. Such a system can provide guidance for the assessment of vulnerability and the repair of flood damaged residential buildings; this could save time and money through the use of the advantages and benefits offered by knowledge base systems. A prototype knowledge base system has been developed in this research. The system comprises three subsystems: degree of vulnerability assessment subsystem; remediation options subsystem; and foundation damage assessment subsystem. The vulnerability assessment subsystem is used to calculate the degree of vulnerability, which will then be used by the remediation options subsystem to select remediation options strategy. The vulnerability assessment subsystem can subsequently be used to calculate the degree to which the building is vulnerable to damage by flooding even if it is not flooded. Remediation options subsystem recommended two strategy options: either ordinary remediation options in the case of vulnerability being low or, alternatively, resilience remediation options in the case of vulnerability being high. The foundation damage assessment subsystem is working alone and is used to assess the damage caused by flooding to the building s foundation, and to thereby recommend a repair option based on the damage caused and foundation type. The system has been developed based on the knowledge acquired from different sources and methods, including survey questionnaires, documents, interviews, and workshops. The system is then evaluated by experts and professionals in the industry. The developed system makes a contribution in the management and standardisation of residential building flooded damage and repair.

A thesis submitted to the Faculty of Science, University of the Witwatersrand, Johannesburg, in fulfilment of the requirements for the degree of Doctor of Philosophy. Johannesburg, February 2015. / Due to its geographical location, poor economic situation and geological features that are characterised by mostly mountainous terrain, Lesotho is vulnerable to hazardous events associated with climate, such as drought, floods, heavy snow, and severe frost. This research explores factors underlying spatial vulnerability of places to natural hazards in south-western Lesotho. Prior vulnerability assessments in Lesotho have investigated vulnerability in terms of identifying populations that are most food insecure and vulnerable to hunger. By broadening the scope of vulnerability to include biophysical and socioeconomic characteristics, the study emphasises the concept of place vulnerability as a foundation for understanding Lesotho’s vulnerability to natural hazards. Spatial orientation of vulnerability within a geographical area provides an easy way for planners and decision makers to identify areas that may require additional resources in order to prepare for disasters. To date, no quantitatively based vulnerability assessment has been undertaken in Lesotho, so this study is one of the first to assess place vulnerability to natural hazards in Lesotho using GIS and it emphasise the role of geography of a place.

Climate change and anticipated impacts of sea level rise such as increased coastal erosion, inundation, flooding due to storm surges and salt water intrusion to freshwater resources will affect all the countries but mostly small island countries of oceans and low-lying lands along coastlines. Turkey having 8333 km of coastline including physically, ecologically and socio-economically important low-lying deltas should also prepare for the impacts of sea level rise as well as other impacts of climate change while participating in mitigation efforts. Thus, a coastal vulnerability assessment of Turkey to sea level rise is needed both as a part of coastal zone management policies for sustainable development and as a guideline for resource allocation for preparation of adaptation options for upcoming problems due to sea level rise. In this study, a coastal vulnerability matrix and a corresponding coastal vulnerability index &ndash / CVI (SLR) of a region to sea level rise using indicators of impacts of sea level rise which use commonly available data are developed. The results of the matrix and the index enable decision makers to compare and rank different regions according to their vulnerabilities to sea level rise, to prioritize impacts of sea level rise on the region according to the vulnerability of the region to each impact and to determine the most vulnerable parameters for planning of adaptation measures to sea level rise. The developed coastal vulnerability assessment model is used to determine the vulnerability of G&ouml / ksu Delta (Specially Protected Area), Mersin that has unique geological, ecological and socio-economical properties which are protected and recognized by both national and international communities.

Information Technology (IT) is a cornerstone of our modern society and essential for governments' management of public services, economic growth and national security. Consequently, it is of importance that IT systems are kept in a dependable and secure state. Unfortunately, as modern IT systems typically are composed of numerous interconnected components, including personnel and processes that use or support it (often referred to as an enterprise architecture), this is not a simple endeavor. To make matters worse, there are malicious actors who seek to exploit vulnerabilities in the enterprise architecture to conduct unauthorized activity within it. Various models have been proposed by academia and industry to identify and mitigate vulnerabilities in enterprise architectures, however, so far none has provided a sufficiently comprehensive scope. The contribution of this thesis is a modeling framework and calculation engine that can be used as support by enterprise decision makers in regard to cyber security matters, e.g., chief information security officers. In summary, the contribution can be used to model and analyze the vulnerability of enterprise architectures, and provide mitigation suggestions based on the resulting estimates. The contribution has been tested in real-world cases and has been validated on both a component level and system level; the results of these studies show that it is adequate in terms of supporting enterprise decision making. This thesis is a composite thesis of eight papers. Paper 1 describes a method and dataset that can be used to validate the contribution described in this thesis and models similar to it. Paper 2 presents what statistical distributions that are best fit for modeling the time required to compromise computer systems. Paper 3 describes estimates on the effort required to discover novel web application vulnerabilities. Paper 4 describes estimates on the possibility of circumventing web application firewalls. Paper 5 describes a study of the time required by an attacker to obtain critical vulnerabilities and exploits for compiled software. Paper 6 presents the effectiveness of seven commonly used automated network vulnerability scanners. Paper 7 describes the ability of the signature-based intrusion detection system Snort at detecting attacks that are more novel, or older than its rule set. Finally, paper 8 describes a tool that can be used to estimate the vulnerability of enterprise architectures; this tool is founded upon the results presented in papers 1-7. / Informationsteknik (IT) är en grundsten i vårt moderna samhälle och grundläggande för staters hantering av samhällstjänster, ekonomisk tillväxt och nationell säkerhet. Det är därför av vikt att IT-system hålls i ett tillförlitligt och säkert tillstånd. Då moderna IT-system vanligen består av en mångfald av olika integrerade komponenter, inklusive människor och processer som nyttjar eller stödjer systemet (ofta benämnd organisationsövergripande arkitektur, eller enterprise architecture), är detta tyvärr ingen enkel uppgift. För att förvärra det hela så finns det även illvilliga aktörer som ämnar utnyttja sårbarheter i den organisationsövergripande arkitekturen för att utföra obehörig aktivitet inom den. Olika modeller har föreslagits av den akademiska världen och näringslivet för att identifiera samt behandla sårbarheter i organisationsövergripande arkitekturer, men det finns ännu ingen modell som är tillräckligt omfattande. Bidraget presenterat i denna avhandling är ett modelleringsramverk och en beräkningsmotor som kan användas som stöd av organisatoriska beslutsfattare med avseende på säkerhetsärenden. Sammanfattningsvis kan bidraget användas för att modellera och analysera sårbarheten av organisationsövergripande arkitekturer, samt ge förbättringsförslag baserat på dess uppskattningar. Bidraget har testats i fallstudier och validerats på både komponentnivå och systemnivå; resultaten från dessa studier visar att det är lämpligt för att stödja organisatoriskt beslutsfattande. Avhandlingen är en sammanläggningsavhandling med åtta artiklar. Artikel 1 beskriver en metod och ett dataset som kan användas för att validera avhandlingens bidrag och andra modeller likt detta. Artikel 2 presenterar vilka statistiska fördelningar som är bäst lämpade för att beskriva tiden som krävs för att kompromettera en dator. Artikel 3 beskriver uppskattningar av tiden som krävs för att upptäcka nya sårbarheter i webbapplikationer. Artikel 4 beskriver uppskattningar för möjligheten att kringgå webbapplikationsbrandväggar. Artikel 5 beskriver en studie av den tid som krävs för att en angripare skall kunna anskaffa kritiska sårbarheter och program för att utnyttja dessa för kompilerad programvara. Artikel 6 presenterar effektiviteten av sju vanligt nyttjade verktyg som används för att automatiskt identifiera sårbarheter i nätverk. Artikel 7 beskriver förmågan av det signatur-baserade intrångsdetekteringssystemet Snort att upptäcka attacker som är nyare, eller äldre, än dess regeluppsättning. Slutligen beskriver artikel 8 ett verktyg som kan användas för att uppskatta sårbarheten av organisationsövergripande arkitekturer; grunden för detta verktyg är de resultat som presenteras i artikel 1-7. / <p>QC 20140203</p>

Les méthodes actuelles utilisées pour l'identification des infrastructures critiques, souvent envisagées dans leurs seules dimensions techniques, montrent certaines limites. Notre thèse postule qu'il est nécessaire de tenir compte du contexte territorial dans lequel ces infrastructures s'inscrivent, dans la mesure où les caractéristiques d'un territoire contribuent à leur criticité. En retour, les infrastructures critiques sont susceptibles d'aggraver la vulnérabilité de ces territoires. Nous développons deux hypothèses de recherche: 1. La "criticité territoriale" exprime le fait que les infrastructures critiques ne sont pas critiques en elles-mêmes, mais par rapport à un contexte socio-économique, politique et géographique. Nous proposons ainsi un ensemble de critères, associés à une approche multiscalaire des systèmes d'infrastructures, permettant l'identification des infrastructures critiques. Une étude de cas portant sur les infrastructures critiques d'énergie de l'Union Européenne valide cette approche. 2. La "criticité politique" souligne la dimension géopolitique des infrastructures critiques : celles-ci reflètent les seuils d'acceptabilité des autorités territoriales, au regard des conséquences potentielles de l'interruption de services essentiels. Cette hypothèse est développée et testée dans le cadre de notre participation au processus de concertation entre l'Union Européenne et ses pays membres pour la mise en place de la Directive 2008/114/EC sur l'identification et la protection des infrastructures critiques européennes. Les conclusions soulignent la pertinence d'une approche géographique et territoriale pour l'identification des infrastructures critiques. / The existing methods for identifying critical infrastructures, mainly based on risk analysis, were found to be insufficient. Our PhD states that the existing territorial vulnerability factors contribute to the criticality of the infrastructures; in return, critical infrastructures enhance this vulnerability. As a consequence, the identification process should be based, not only on technical aspects, but also on a geographical approach. Two main research hypothesis are developed: 1. The "territorial criticality" expresses the fact that an infrastructure is not critical in itself, but its criticality is related to the socio-economic, political and geographical context. We propose a set of criteria and related indicators associated to a multilevel model. A case study shows how these criteria can be applied in the case of the European energy critical infrastructures. 2. The "political criticality" means that the designation of an infrastructure as critical reflects the level of consequences decision-makers are ready to accept. These acceptability thresholds are related to the potential consequences the disruption of such infrastructure could trigger. If the potential consequences go beyond a given threshold, then the infrastructure is considered as critical. We developed and tested this hypothesis in the context of our participation to the preparatory work carried out by the European Commission Joint Research Center to support the European Commission and its member states on the definition of criteria for identifying European Critical Infrastructures (ECI). Conclusions highlight the benefits of a geographical approach to identify critical infrastructures.

During the 21st century, climatic change and non-climatic stressors are likely to impact forests leading to large-scale forest and biodiversity loss, and diminished ecological benefits. Assessing the vulnerability of forests and addressing the sources of vulnerability is an important risk management strategy. The overall goal of this research work is to develop methodological approaches at different scales and apply them to assess the vulnerability of forests in India for developing strategies for forest adaptation. Indicator-based methodological approaches have been developed for vulnerability assessment at local, landscape and national scales under current climate scenario, and at national scale under future climate scenario. Under current climate scenario, the concept of inherent vulnerability of forests has emerged by treating vulnerability as a characteristic internal property of a forest ecosystem independent of exposure. This approach to assess vulnerability is consistent with the framework presented in the latest report of Intergovernmental Panel on Climate Change (IPCC AR5 2014). Assessment of vulnerability under future climate scenario is presented only at national scale due to challenges associated with model-based climate projections and impact assessment at finer scales. The framework to assess inherent vulnerability of forests at local scale involves selection of vulnerability indicators and pair wise comparison method (PCM) to assign the indicator weights. The methodology is applied in the field to a 300-ha moist deciduous case study forest (Aduvalli Protected Forest, Chikmagalur district) in the Western Ghats area, where a vulnerability index value of 0.248 is estimated. Results of the study indicate that two indicators - ‘preponderance of invasive species’ and ‘forest dependence of community’ - are the major drivers of inherent vulnerability at present. The methodology developed to assess the inherent vulnerability at landscape scale involves use of vulnerability indicators, the pair wise comparison method, and geographic information system (GIS) tools. Using the methodology, assessment of inherent vulnerability of Western Ghats Karnataka (WGK) landscape forests is carried out. Four vulnerability indicators namely, biological richness, disturbance index, canopy cover and slope having weights 0.552, 0.266, 0.123 and 0.059, respectively are used. The study shows that forests at one-third of the grid points in the landscape have high and very high inherent vulnerability, and natural forests are inherently less vulnerable than plantation forests. The methodology used for assessment of forest inherent vulnerability at the national scale was same as used at landscape scale. 40% of forest grid points in India are assessed with high and very high inherent vulnerability. Except in pockets, the forests in the three biodiversity hotspots in India i.e., the Western Ghats in peninsular India, northeastern India, and the northern Himalayan region are assessed to have low to medium inherent vulnerability. Vulnerability of forests under future climate scenario at national scale is estimated by combining the results of assessment of climate change impact and inherent vulnerability. In the present study, ensemble climatology from five CMIP5 (Coupled Model Intercomparison Project phase 5) climate models for RCP (Representative Concentration Pathways) 4.5 and 8.5 in short (2030s) and long term (2080s) is used as input to IBIS (Integrated Biosphere Simulator) dynamic vegetation model. Forest grid points projected to experience vegetation-shift to a new plant functional type (PFT) under future climate are categorized under ‘extremely high’ vulnerability category. Such forest grid points in India are 22 and 23% in the short term under RCP4.5 and 8.5 respectively, and these percentages increase to 31 and 37% in the long term. IBIS simulated vegetation projections are also compared with LPJ (Lund-Potsdam-Jena) simulated projections. Both the vegetation models agree that forests at about one-third of the grid points could be impacted by future climate but the spatial distribution of impacted grid points differs between the models. Vulnerability assessment is a powerful tool for building long-term resilience in the forest sector in the context of projected climate change. From this study, three forest scenarios emerge in India for developing adaptation strategies namely: (a) less disturbed primary forests; (b) degraded and fragmented primary forests; and (c) secondary (plantation) forests. Minimizing anthropogenic disturbance and conserving biodiversity are critical to reduce forest vulnerability of less disturbed primary forests. For disturbed forests and plantations, adaptive management aimed at forest restoration is necessary to build resilience. Mainstreaming forest adaptation in India through Forest Working Plans and realignment of the forestry programs is necessary to manage the risk to forests under climate change.

Då datorer i alla dess former har kommit att bära betydande mängder relevant information för diverse forensiska utredningar så krävs en ingående kunskap gällande hur denna data lämpligast infångas. En typ av klient som nyligen har gjort sitt kommersiella intåg på marknaden är den internetbaserade tunna klienten. Det existerar i dagsläget begränsat med underlag gällande huruvida en sådan klient bär information som är relevant för en IT-forensisk utredning. Inom denna uppsats har därför en internetbaserad tunn klient av typen Chromebook varit mål för undersökning. Syftet har varit att kartlägga vilka sårbarheter som existerar, samt om möjligt huruvida dessa kan brukas som underlag vid en forensisk utredning. För detta ändamål har klientens lagrings- samt kommunikationsmönster analyserats. För genomförandet av detta brukades experimentella metodiker i form av penetrationstest samt IT-forensisk undersökning. Det har även kartlagts huruvida programvaror avsedda för operativsystemet Linux kan exekveras på klienten. Ändamålet med detta var att fastställa om klientens volatila minne kan utvinnas med hjälp av verktyg för just Linux. Rapportens resultat påvisar att det inom en klient av denna typ finns forensiskt värdefull information att inhämta. Det påvisas även att Chrome OS från en användares perspektiv kan anses som säkert. / Computers in various forms have come to carry a significant amount of relevant information for various forensic investigations. Therefore, detailed knowledge is required regarding how this data is best acquired. One type of client that has recently made its entry onto the commercial market is the Web Thin Client. As it is today, only a limited amount of relevant information can be found regarding in what capacity such a client contains data that is relevant to an IT-forensic investigation. For this reason, a Web thin client of the model Google Chromebook has been evaluated in this paper. The purpose of this examination has been to identify the vulnerabilities that currently exist, and if possible whether these can be used as a basis for a forensic investigation. To achieve this, the client's storage and communication patterns have been analyzed by implementation of experimental methodologies. The methods used for the purpose are penetration testing and an IT forensic investigation. Tests have also been performed to evaluate whether software for the Linux operating system can be executed on the client. The purpose of this was to determine whether the client's volatile memory can be extracted using tools created for Linux. The results presented in this paper demonstrate the fact that within a client of this type, valuable forensic information can be located. It is also established that Chrome OS from a user's perspective can be considered as safe.

The thesis deals with the assessment of security vulnerabilities. The aim of this work is to create a new method of vulnerability assessment, which will better prioritize critical vulnerabilities and reflect parameters that are not used in currently used methods. Firstly, it describes the common methods used to assess vulnerabilities and the parameters used in each method. The first described method is the Common Vulnerability Scoring System for which are described all three types of scores. The second analysed method is OWASP Risk Rating Methodology. The second part is devoted to the design of the own method, which aims to assess vulnerabilities that it is easier to identify those with high priority. The method is based on three groups of parameters. The first group describes the technical assessment of the vulnerability, the second is based on the requirements to ensure the confidentiality, integrity and availability of the asset and the third group of parameters evaluates the implemented security measures. All three groups of parameters are important for prioritization. Parameters describing the vulnerability are divided into permanent and up-to-date, where the most important up-to-date parameter are Threat Intelligence and easy of exploitation. The parameters of the impact on confidentiality, integrity and availability are linked to the priority of the asset, and to the evaluation of security measures, which increase the protection of confidentiality, integrity and availability. The priority of the asset and the quality of the countermeasures are assessed based on questionnaires, which are submitted to the owners of the examined assets as part of the vulnerability assessment. In the third part of the thesis, the method is compared with the currently widely used the Common Vulnerability Scoring System. The strengths of the proposed method are shown in several examples. The effectiveness of prioritization is based primarily on the priority of the asset and the security measures in place. The method was practically tested in a laboratory environment, where vulnerabilities were made on several different assets. These vulnerabilities were assessed using the proposed method, the priority of the asset and the quality of the measures were considered, and everything was included in the priority of vulnerability. This testing confirmed that the method more effectively prioritizes vulnerabilities that are easily exploitable, recently exploited by an attacker, and found on assets with minimal protection and higher priority.

The topic of climate adaptation has gained momentum in the last decade as a response to the increasing rate at which global climate is changing. There are two leading discourses to climate adaptation, Climate Change Adaptation (CCA) perspectives, which focuses on adapting to specific climate hazards and scenarios, and Vulnerability Centred Adaptation (VCA), which focuses on the socio-economic and environmental factors that compound climate impacts. However, despite global inclusivity efforts to adaptation, the CCA approach is predominant in developing economies. This empirical study attempts to close this gap by using the VCA approach to a climate risk, impact, and vulnerability assessment of the Malmö Lund Region, Sweden, and to showcase the relevance of including a VCA approach within developing economies. The primary data comes from using a semi-structured interview method of twelve international women who have moved to the region in the last decade. Simultaneously, semi-structured interviews were also conducted with a secondary sample group which consisted of six urban professionals who either worked with environmental issues, planning, or social vulnerability. The latter climate and vulnerability conversations were used to situate the IW’s perspective in the discussion. The results demonstrated that: 1. Climate risk depended on the duration, intensity of temperature, wind, light levels, and precipitation, or climate barriers, and the women’s ability to protect themselves. 2. The barriers negatively impacted them socially, physically, and emotionally, but also allowed them to experience new climate-related experiences and activities. 3. Finally, their adaptive capacity depended on the socio-economic and cultural circumstances which enhanced their vulnerability, while their adaptive capacity relied on their ability to apply micro-adaptations, reach out to community support, and use their previous climate experience. The findings confirm the need for an intersectional and bottom-up approach to climate adaptation, as it showcased how climate did impact the women and influenced their adaptation process in region despite it not being a primary cause of concern for these women. Secondly, it raises awareness of the non-climate predispositions of these women to climate vulnerability. Thirdly, the findings also show that variations in climate assessments do not only depend on long-term climate data in relation to climate hazards and risks, but also the women’s past climate experience, their current life circumstances, and the time spent in the host country. Finally, this research calls for urban climate adaptation strategies to account for a vulnerability perspective within their initial risk, vulnerability, and impact assessment and use these valuable insights to inform the planning stages of climate adaptation process for urban citizen.

No description available.