Software Security Vulnerabilities in Mobile Peer-to-peer Environment

Increase of computational power and emergence of new computer technologies led to popularity of local communications between personal trusted devices. By-turn, it led to emergence of security problems related to user data utilized in such communications. One of the main aspects of the data security assurance is security of software operating on mobile devices. The aim of this work was to analyze security threats to PeerHood, software intended for performing personal communications between mobile devices regardless of underlying network technologies. To reach this goal, risk-based software security testing was performed. The results of the testing showed that the project has several security vulnerabilities. So PeerHood cannot be considered as a secure software. The analysis made in the work is the first step towards the further implementation of PeerHood security mechanisms, as well as taking into account security in the development process of this project.

Promoting peace and security in Africa : is the European Union up to the challenge?

The ninth annual Suomenlinna seminar, organised by the Department of Strategic and Defence Studies, Finnish National Defence College, was held in May 2006. It brought together a representative group of specialists in security studies for two days of presentations and discussion about the most pressing issues of today – the challenges facing European Union’s crisis management in Africa.

Enhancing human security through crisis management : opportunities and challenges for learning

Inhimilliseen turvallisuuteen kriisinhallinnan kautta – oppimisen mahdollisuuksia ja haasteita Kylmän sodan jälkeen aseelliset konfliktit ovat yleensä alkaneet niin sanotuissa hauraissa valtioissa ja köyhissä maissa, ne ovat olleet valtioiden sisäisiä ja niihin on osallistunut ei-valtiollisia aseellisia ryhmittymiä. Usein ne johtavat konfliktikierteeseen, jossa sota ja vakaammat olot vaihtelevat. Koska kuolleisuus konflikteissa voi jäädä alle kansainvälisen määritelmän (1000 kuollutta vuodessa), kutsun tällaisia konflikteja ”uusiksi konflikteiksi”. Kansainvälinen yhteisö on pyrkinyt kehittämään kriisinhallinnan ja rauhanrakentamisen malleja, jotta pysyvä rauhantila saataisiin aikaiseksi. Inhimillinen turvallisuus perustuu näkemykseen, jossa kunnioitetaan jokaisen yksilön ihmisoikeuksia ja jolla on vaikutusta myös kriisinhallinnan ja rauhanrakentamisen toteuttamiseen. Tutkimukseen kuuluu kaksi empiiristä osaa: Delfoi tulevaisuuspaneeliprosessin sekä kriisinhallintahenkilöstön haastattelut. Viisitoista eri alojen kriisinhallinta-asiantuntijaa osallistui paneeliin, joka toteutettiin vuonna 2008. Paneelin tulosten mukaan tulevat konfliktit usein ovat uusien konfliktien kaltaisia. Lisäksi kriisinhallintahenkilöstöltä edellytetään vuorovaikutus- ja kommunikaatiokykyä ja luonnollisesti myös varsinaisia ammatillisia valmiuksia. Tulevaisuuspaneeli korosti vuorovaikutus- ja kommunikaatiotaitoja erityisesti siviilikriisinhallintahenkilöstön kompetensseissa, mutta samat taidot painottuivat sotilaallisen kriisinhallinnan henkilöstön kompetensseissakin. Kriisinhallinnassa tarvitaan myös selvää työnjakoa eri toimijoiden kesken. Kosovossa työskennelleen henkilöstön haastatteluaineisto koostui yhteensä 27 teemahaastattelusta. Haastateltavista 9 oli ammattiupseeria, 10 reservistä rekrytoitua rauhanturvaajaa ja 8 siviilikriisinhallinnassa työskennellyttä henkilöä. Haastattelut toteutettiin helmi- ja kesäkuun välisenä aikana vuonna 2008. Haastattelutuloksissa korostui vuorovaikutus- ja kommunikaatiotaitojen merkitys, sillä monissa käytännön tilanteissa haastateltavat olivat ratkoneet ongelmia yhteistyössä muun kriisinhallintahenkilöstön tai paikallisten asukkaiden kanssa. Kriisinhallinnassa toteutui oppimisprosesseja, jotka usein olivat luonteeltaan myönteisiä ja informaalisia. Tällaisten onnistumisten vaikutus yksilön minäkuvaan oli myönteinen. Tällaisia prosesseja voidaan kuvata ”itseä koskeviksi oivalluksiksi”. Kriisinhallintatehtävissä oppimisella on erityinen merkitys, jos halutaan kehittää toimintoja inhimillisen turvallisuuden edistämiseksi. Siksi on tärkeää, että kriisinhallintakoulutusta ja kriisinhallintatyössä oppimista kehitetään ottamaan huomioon oppimisen eri tasot ja ulottuvuudet sekä niiden merkitys. Informaaliset oppimisen muodot olisi otettava paremmin huomioon kriisinhallintakoulutusta ja kriisinhallintatehtävissä oppimista kehitettäessä. Palautejärjestelmää olisi kehitettävä eri tavoin. Koko kriisinhallintaoperaation on saatava tarvittaessa myös kriittistä palautetta onnistumisista ja epäonnistumisista. Monet kriisinhallinnassa työskennelleet kaipaavat kunnollista palautetta työrupeamastaan. Liian rutiininomaiseksi koettu palaute ei edistä yksilön oppimista. Spontaanisti monet haastatellut pitivät tärkeänä, että kriisinhallinnassa työskennelleillä olisi mahdollisuus debriefing- tyyppiseen kotiinpaluukeskusteluun. Pelkkä tällainen mahdollisuus ilmeisesti voisi olla monelle myönteinen uutinen, vaikka tilaisuutta ei hyödynnettäisikään. Paluu kriisinhallintatehtävistä Suomeen on monelle haasteellisempaa kuin näissä tehtävissä työskentelyn aloittaminen ulkomailla. Tutkimuksen tulokset kannustavat tutkimaan kriisinhallintaa oppimisen näkökulmasta. On myös olennaista, että kriisinhallinnan palautejärjestelmiä kehitetään mahdollisimman hyvin edistämään sekä yksilöllistä että organisatorista oppimista kriisinhallinnassa. Kriisinhallintaoperaatio on oppimisympäristö. Kriisinhallintahenkilöstön kommunikaatio- ja vuorovaikutustaitojen kehittäminen on olennaista tavoiteltaessa kestävää rauhanprosessia, jossa konfliktialueen asukkaatkin ovat mukana.

Exploring the role and transformative potential of human rights in development practice and food security : case study from Malawi

Avhandlingen är en analys av den roll som mänskliga rättigheter spelar i utvecklingssamarbete i allmänhet och tre matsäkerhetsprojekt i Malawi i synnerhet. Författaren undersöker huruvida mänskliga rättigheter kan bidra till samhälleliga förändringsprocesser. Undersökningen har en diskursiv syn på mänskliga rättigheter; rättigheter ses som sociala konstruktioner skapade av människor, konstruktioner som förändras i takt med att aktörerna ger dem ny mening. Människorättsbaserade utvecklingsstrategier riktar uppmärksamheten mot olika aktörers skyldigheter samt vikten av att mänskliga rättigheter inte kränks genom utvecklingspolitiska beslut. En analys som utgår från mänskliga rättigheter kan leda till att nya frågor lyfts fram: vem har skyldigheter, vem har rättigheter, och varför förverkligas inte dessa? Fokus flyttas till hur politiska, ekonomiska och juridiska strukturer kan förändras så att de främjar mänskliga rättigheter. Författaren använder empiriskt material från Malawi för att visa vilken roll mänskliga rättigheter och så kallade människorättsprinciper spelar inom tre projekt: (1) ett mathjälpsprojekt; (2) ett rättighetsbaserat projekt med fokus på att stärka strategier för livsuppehälle; (3) ett juridiskt projekt inom ramen för vilket man skapat ett lagförslag om rätten till föda. Analysen visar att det rättighetsbaserade projektet strävade efter den mest djupgående samhälleliga förändringen. Människorättsprinciperna ansvarighet och deltagande handlade inte endast om verksamheten inom projektet utan man strävade även efter att stärka dessa principer mellan medborgare och myndigheter. Rättigheter, som ett sätt att tala, tänka och handla, inte som abstrakta juridiska normer, påverkade de lokala aktörernas sätt att kräva bl.a. tjänster av lokala myndigheter. Teoretiskt kan man säga att det rättighetsbaserade projektet representerar ett aktörsperspektiv på mänskliga rättigheter där aktörernas egna uppfattningar om vad de är berättigade till samt krav på myndigheters ansvar formade vilken mening rättigheterna kom att få.

Proactive and Preventive Student Welfare Activities in Finnish Preschool and Elementary School: Handling of Transition to Formal Schooling and a National Anti-Bullying Program as Examples

Prerequisites and effects of proactive and preventive psycho-social student welfare activities in Finnish preschool and elementary school were of interest in the present thesis. So far, Finnish student welfare work has mainly focused on interventions and individuals, and the voluminous possibilities to enhance well-being of all students as a part of everyday school work have not been fully exploited. Consequently, in this thesis three goals were set: (1) To present concrete examples of proactive and preventive psycho-social student welfare activities in Finnish basic education; (2) To investigate measurable positive effects of proactive and preventive activities; and (3) To investigate implementation of proactive and preventive activities in ecological contexts. Two prominent phenomena in preschool and elementary school years—transition to formal schooling and school bullying—were chosen as examples of critical situations that are appropriate targets for proactive and preventive psycho-social student welfare activities. Until lately, the procedures concerning both school transitions and school bullying have been rather problem-focused and reactive in nature. Theoretically, we lean on the bioecological model of development by Bronfenbrenner and Morris with concentric micro-, meso-, exo- and macrosystems. Data were drawn from two large-scale research projects, the longitudinal First Steps Study: Interactive Learning in the Child–Parent– Teacher Triangle, and the Evaluation Study of the National Antibullying Program KiVa. In Study I, we found that the academic skills of children from preschool–elementary school pairs that implemented several supportive activities during the preschool year developed more quickly from preschool to Grade 1 compared with the skills of children from pairs that used fewer practices. In Study II, we focused on possible effects of proactive and preventive actions on teachers and found that participation in the KiVa antibullying program influenced teachers‘ self-evaluated competence to tackle bullying. In Studies III and IV, we investigated factors that affect implementation rate of these proactive and preventive actions. In Study III, we found that principal‘s commitment and support for antibullying work has a clear-cut positive effect on implementation adherence of student lessons of the KiVa antibullying program. The more teachers experience support for and commitment to anti-bullying work from their principal, the more they report having covered KiVa student lessons and topics. In Study IV, we wanted to find out why some schools implement several useful and inexpensive transition practices, whereas other schools use only a few of them. We were interested in broadening the scope and looking at local-level (exosystem) qualities, and, in fact, the local-level activities and guidelines, along with teacherreported importance of the transition practices, were the only factors significantly associated with the implementation rate of transition practices between elementary schools and partner preschools. Teacher- and school-level factors available in this study turned out to be mostly not significant. To summarize, the results confirm that school-based promotion and prevention activities may have beneficial effects not only on students but also on teachers. Second, various top-down processes, such as engagement at the level of elementary school principals or local administration may enhance implementation of these beneficial activities. The main message is that when aiming to support the lives of children the primary focus should be on adults. In future, promotion of psychosocial well-being and the intrinsic value of inter- and intrapersonal skills need to be strengthened in the Finnish educational systems. Future research efforts in student welfare and school psychology, as well as focused training for psychologists in educational contexts, should be encouraged in the departments of psychology and education in Finnish universities. Moreover, a specific research centre for school health and well-being should be established.

Developing customer need based services in personal security service industry

The purpose of this thesis is to examine how services can be developed and how the voice of the customer can be incorporated to the strategic planning of services. Furthermore, the objective is to investigate the methods of customer need analysis and service bundling. The data is collected from secondary and primary sources by reviewing the existing academic literature and by conducting in-depth interviews and surveys. The main findings of this research indicate that the service development in personal security service industry should be conducted through a formalized process and the process should begin with setting the strategic objectives. Moreover, the voice of the customer should be incorporated into all stages of the development process, especially into the front-end of the process. Furthermore, the information on customer needs should be gathered in a manner tailored for the purposes of service development.

Asiakastarpeiden kartoitus kuljetusten häiriöiden analysoinnin ja hallinnan kehittämiseksi

Tämä diplomityö on tehty osana Logproof-tutkimushanketta, joka keskittyy häiriöttömyyden hallintaan logistisissa monitoimijaverkostoissa. Työn tavoitteena on selvittää logistiikkaintensiivisten yritysten tarpeita kuljetusten häiriöiden analysoinnin ja hallinnan kehittämiseksi ja siten ennakoivan riskienhallinnan edistämiseksi. Asiakastarvetietoa on kerätty hyödyntäen puolistrukturoituja haastatteluja ja tietoa on analysoitu käyttäen hyväksi sisällönanalyysiä sekä tulkintataulukkoa. Kiinnostus kuljetusten häiriöitä ja niiden analysointia kohtaan on kasvamassa ja yrityksissä tiedostetaan hallintajärjestelmien ja analysoinnin tarve tulevaisuudessa. Kirjallisuuskatsauksen ja asiakastarpeiden kartoituksen avulla työssä on selvitetty yritysten nykytilaa kuljetusten häiriöiden hallinnan ja analysoinnin osalta ja tarkasteltu mahdollisia tulevaisuuden kehityssuuntia analysoimalla asiakkaiden näkyviä ja piileviä tarpeita. Työssä on edellisten lisäksi tarkasteltu, kuinka havaitut asiakastarpeet ovat sovitettavissa yhteen case-yrityksen, Oy Lars Krogius Ab:n, ARS (Analytic Rou-ting Solution) -palvelun ominaispiirteiden kanssa. Työ tarjoaa tarvetietoa palvelun tulevaisuuden kehitykselle.

From reactive to proactive banking : connecting with customers with context-aware mobile technology

Mobile technology has been employed in banking for already two decades. However, its significance this far has been modest. It is expected that the industry will change a lot in the future. Elements of this change include tightening of competition, considering customer’s individual and changing needs, becoming involved in customer’s life and being where customers are. The goal of this study is to explore these fields with regard to Finnish banking as well as investigate selected consumers’ views towards this kind of new service approach. It can be divided into three questions: • What kinds of mobile services does the Finnish banking industry currently offer for consumers and what expectations do experts and consumers have towards them? o What is consumers’ attitude towards a context-aware service approach in the banking industry and what are the suggested tools for it? o What factors define clients’ adoption intentions towards the new context-aware service approach? Which factors do they consider most important? In order to create the framework for the study, both Finnish and foreign scientific and professional literature considering evolution of the industry and innovation adoption has been used. The empirical part of the study consists of 11 interviews, including 6 expert interviews and 5 consumer interviews. The results show that the selected consumers reacted very positively to the suggested new service approach that considers them as a person and aims at simplifying their banking. The consumers appreciated especially solutions that simplified their everyday banking. Also proactive actions from a bank was considered important especially in everyday banking, as long as the customer was able to define the amount and way of contacts he received. According to the findings banks should aim at supporting their customers more than they do now. However, they also need to pay attention to not irritate their customers by excessive contacts. Banks should also open-mindedly introduce new technologies to their customers. Key words

Entrepreneurial orientation in small and medium-sized enterprises during economic crisis

The economic importance of small and medium-sized enterprises (SMEs) and entrepreneurship has increased significantly in recent decades and entrepreneurial activity and SMEs are deemed vital to economic progress. Therefore, it is justifiable to study how small firms and entrepreneurs can enhance their performance and emergence in the turbulent economic environment. The concept of entrepreneurial orientation (EO) has recently attracted considerable attention in the field of entrepreneurship research. EO generally refers to a firm’s propensity to be innovative, to be proactive and to take risks. A majority of EO studies so far have found that adopting EO associated entrepreneurial behaviors will help firms to create or sustain a high level of performance. This dissertation explores the main drivers and performance implications of EO for SMEs in time of economic crisis. Hence the first objective of this dissertation is to examine the performance implications of EO and to test the role of EO on how firms are treated by the crisis at operative level. The second objective is to expand the prevailing understanding of determinants of EO by exploring the relationship between owner's work related values, attitudes, demographic characteristics, firm’s financial resources and EO. EO was found to be a significant and positive factor behind a firm’s long run growth. Hence it can be said that EO has positive implications for firm performance. But on the other hand, during a time of economic crisis the different dimensions of EO had both positive and negative effects on performance of SMEs. The performance implications varied across different stages of the crisis and were also dependent on what measure was used for measuring the performance. The main drivers of EO in SMEs were the personal work related values of the entrepreneur and his/her prior experience as an entrepreneur. The intrinsic work values related to interest, responsibility, challenge, self-development or intellectual stimulation and values related to status, power, achievement and recognition had a positive effect on the level of EO. On the other hand, extrinsic values related to high income, material possessions, benefits such as generous holidays, job security, and comfort through good working conditions decreased the level of EO

A cyber security architecture for military networks using a cognitive network approach

Cyber security is one of the main topics that are discussed around the world today. The threat is real, and it is unlikely to diminish. People, business, governments, and even armed forces are networked in a way or another. Thus, the cyber threat is also facing military networking. On the other hand, the concept of Network Centric Warfare sets high requirements for military tactical data communications and security. A challenging networking environment and cyber threats force us to consider new approaches to build security on the military communication systems. The purpose of this thesis is to develop a cyber security architecture for military networks, and to evaluate the designed architecture. The architecture is described as a technical functionality. As a new approach, the thesis introduces Cognitive Networks (CN) which are a theoretical concept to build more intelligent, dynamic and even secure communication networks. The cognitive networks are capable of observe the networking environment, make decisions for optimal performance and adapt its system parameter according to the decisions. As a result, the thesis presents a five-layer cyber security architecture that consists of security elements controlled by a cognitive process. The proposed architecture includes the infrastructure, services and application layers that are managed and controlled by the cognitive and management layers. The architecture defines the tasks of the security elements at a functional level without introducing any new protocols or algorithms. For evaluating two separated method were used. The first method is based on the SABSA framework that uses a layered approach to analyze overall security of an organization. The second method was a scenario based method in which a risk severity level is calculated. The evaluation results show that the proposed architecture fulfills the security requirements at least at a high level. However, the evaluation of the proposed architecture proved to be very challenging. Thus, the evaluation results must be considered very critically. The thesis proves the cognitive networks are a promising approach, and they provide lots of benefits when designing a cyber security architecture for the tactical military networks. However, many implementation problems exist, and several details must be considered and studied during the future work.

Enhancing Security of Linux OS against Administrators

Inside cyber security threats by system administrators are some of the main concerns of organizations about the security of systems. Since operating systems are controlled and managed by fully trusted administrators, they can negligently or intentionally break the information security and privacy of users and threaten the system integrity. In this thesis, we propose some solutions for enhancing the security of Linux OS by restricting administrators’ access to superuser’s privileges while they can still manage the system. We designed and implemented an interface for administrators in Linux OS called Linux Admins’ User Interface (LAUI) for managing the system in secure ways. LAUI along with other security programs in Linux like sudo protect confidentiality and integrity of users’ data and provide a more secure system against administrators’ mismanagement. In our model, we limit administrators to perform managing tasks in secure manners and also make administrators accountable for their acts. In this thesis we present some scenarios for compromising users’ data and breaking system integrity by system administrators in Linux OS. Then we evaluate how our solutions and methods can secure the system against these administrators’ mismanagement.