Measuring software security from the design of software

The vast majority of our contemporary society owns a mobile phone, which has resulted in a dramatic rise in the amount of networked computers in recent years. Security issues in the computers have followed the same trend and nearly everyone is now affected by such issues. How could the situation be improved? For software engineers, an obvious answer is to build computer software with security in mind. A problem with building software with security is how to define secure software or how to measure security. This thesis divides the problem into three research questions. First, how can we measure the security of software? Second, what types of tools are available for measuring security? And finally, what do these tools reveal about the security of software? Measuring tools of these kind are commonly called metrics. This thesis is focused on the perspective of software engineers in the software design phase. Focus on the design phase means that code level semantics or programming language specifics are not discussed in this work. Organizational policy, management issues or software development process are also out of the scope. The first two research problems were studied using a literature review while the third was studied using a case study research. The target of the case study was a Java based email server called Apache James, which had details from its changelog and security issues available and the source code was accessible. The research revealed that there is a consensus in the terminology on software security. Security verification activities are commonly divided into evaluation and assurance. The focus of this work was in assurance, which means to verify one’s own work. There are 34 metrics available for security measurements, of which five are evaluation metrics and 29 are assurance metrics. We found, however, that the general quality of these metrics was not good. Only three metrics in the design category passed the inspection criteria and could be used in the case study. The metrics claim to give quantitative information on the security of the software, but in practice they were limited to evaluating different versions of the same software. Apart from being relative, the metrics were unable to detect security issues or point out problems in the design. Furthermore, interpreting the metrics’ results was difficult. In conclusion, the general state of the software security metrics leaves a lot to be desired. The metrics studied had both theoretical and practical issues, and are not suitable for daily engineering workflows. The metrics studied provided a basis for further research, since they pointed out areas where the security metrics were necessary to improve whether verification of security from the design was desired.

Aikaerotteisesti fluoresenssia mittaavan reaaliaikaisen PCR-laitteen kehitys

Kvantitatiivinen reaaliaikainen polymeraasiketjureaktio (engl. polymerase chain reaction, PCR) on osoittautunut käyttäjäystävällisimmäksi menetelmäksi nukleiinihapposekvenssien kvantitoimisessa. Tätä menetelmää voidaan herkistää pienempien DNA-pitoisuuksien havaitsemiseen käyttämällä hyväksi aikaerotteista fluorometriaa (engl. time-resolved fluorometry, TRF) ja luminoivia lantanidileimoja, joiden fluoresenssin pitkän eliniän ansiosta emission mittaus voidaan suorittaa vasta hetki virittävän valopulssin jälkeen, jolloin lyhytikäinen taustasäteily ehtii sammua. Tuloksena saadaan korkea signaali-taustasuhde. Tämän diplomityön tarkoituksena oli rakentaa TRF:än pystyvä reaaliaikainen PCR-laite, sillä tällaista laitetta ei ole markkinoilla tarjolla. Laite rakennettiin kehittämällä lämpökierrätin ja yhdistämällä se valmiiseen TRF:än kykenevään mittapäähän. Mittapään ja lämpökierrättimen hallitsemiseksi kehitettiin myös tietokoneohjelma. Valon tuottamiseksi ja mittaamiseksi haluttiin käyttää edullisia komponentteja, joten työssä käytettiin valmiin mittapään optiikkaa, jossa viritys tapahtuu hohtodiodilla (engl. light-emitting diode, LED) ja lantanidileiman emission mittaus fotodiodilla (engl. photodiode, PD) tai valomonistinputkella (engl. photomultiplier tube, PMT). Myös mittapään suorituskykyä tutkittiin. Työtä varten kehitettiin lämpökierrätin, joka koostui Peltier-elementillä lämmitettävästä PCR-putkitelineestä ja lämpökannesta. Mittalaitteen suorituskyvyn tutkimiseen käytettiin kelaattikomplementaatioon perustuvaa PCR-tuotteen havaitsemismenetelmää. Kelaattikomplementaatio perustuu kahteen erilliseen oligonukleotidimolekyyliin, joista toiseen on sidottu lantanidi-ioni ja toiseen valoa absorboiva ligandirakenne, jotka yhdessä muodostavat fluoresoivan kokonaisuuden. Kehitetyn lämpökierrättimen todettiin olevan tarpeeksi tarkka sekä tehokas ja sen lämmitys- ja jäähdytysnopeuden maksimeiksi saatiin 2,6 °C/sekunti. Detektorina käytetyn PD:n ei todettu olevan tarpeeksi herkkä emission havainnoimiseksi ja se korvattiin laitteessa PMT:llä. Käytetyllä PCR-määrityksellä kynnyssykleiksi (engl. threshold cycle, Ct) sekä kehitetylle että referenssilaitteelle saatiin 28,4 käyttämällä samaa 100 000 kopion DNA:n aloitusmäärää. Työssä osoitettiin, että on mahdollista kehittää edullisia komponentteja käyttävä, TRF:än pystyvä, reaaliaikainen PCR-laite, joka kykenee vastaavaan Ct-arvoon kuin vertailulaite. PD:n herkkyys ei kuitenkaan riittänyt. Tulokset olivat lupaavia, sillä LED- ja PD-teknologiat kehittyvät ja markkinoille on tullut myös muita komponentteja, joiden avulla on tulevaisuudessa mahdollista kehittää vielä herkempi laite.

Measuring Shared Value: How to Unlock Value by Linking Social and Business Results

Competitividad y valor compartido

Measuring curriculum integration in the junior grades: the design of an instrument

This study \Alas initiated in response to the Junior Division Review (1985) publ ished by the Ministry of Education for the Province of Ontario. Curriculum integration is an element used within the educational paradigm designed by the Ontario Ministry of Education. It is a term frequent1y verbal ized b>' educators in this province, but because of 1 imi ted resource support regarding this methodology, it was open to broad interpretation resulting in an extreme v ar i at i on i nit simp 1 eme n tat i on • I n de ed, the Min i s try intimated that it was not occurring to any significant degree across the province. The objective of this thes is was· to define integration in the junior classroom and de-:.ign a meas.ur·ement in-:.tr-ument which would in turn high 1 i gh t indicators of curriculum integration. The :.tudy made a prel iminary, field-based survey of educa tiona 1 professionals in order to generate a relevant description of integrated curr-iculum programm i ng as def i ned in the j un i or classroom. The description was a compilation of views expressed by a random selection of teachers, consultants, supervisory officers and principals. The survey revea 1 ed a much more comprehens i ve vi et·<,l of the attributes of integrated programming than tradition would dictate and resulted in a functional definition tha t was broader than past prac t ices. Based on the information generated by this survey, an instrument ou t 1 in i ng program cr iter i a of was devised. an integrated junior cla~·sroom Th i s measuremen t i nstrumen t , designed for all levels of educators, was named uThe Han~.son I nstrumen t for the Measuremen t of Program Integrat ion in the Jun i or Cl assroom". It refl ected five categories intrinsic to the me thodol ogy of integration: Teacher Behaviour, Student Behaviour, Classroom Layout, Cl as~·r oom Environment and Progr amm i ng. Each category and the items therein were successfully tested in val idi ty and rel iabi 1 i ty checKs. Interestingly, the individual class was found to be the major variable programming in in the measuremen t the j un i or d i vis i on • of The integrated instrument demonstrated potential not onl)' a~· an initial measure of the degree of integrated curriculum, but as a guide to strategies to implement such a methodology.

Personal soundtracks on public transit : personal listening devices and socio-spatial negotiations of students' bus journeys

One way of exploring the power of sound in the experience and constitution of space is through the phenomenon of personal listening devices (PLDs) in public environments. In this thesis, I draw from in-depth interviews with eleven Brock University students in S1. Catharines, Ontario, to show how PLDs (such as MP3 players like the iPod) are used to create personalized soundscapes and mediate their public transit journeys. I discuss how my interview participants experience the space-time of public transit, and show how PLDs are used to mediate these experiences in acoustic and non-acoustic ways. PLD use demonstrates that acoustic and environmental experiences are co-constitutive, which highlights a kinaesthetic quality of the transit-space. My empirical findings show that PLDs transform space, particularly by overlapping public and private appropriations of the bus. I use these empirical findings to discuss the PLD phenomenon in the theoretical context of spatiality, and more specifically, acoustic space. J develop the ontological notion of acoustic space, stating that space shares many of the properties of sound, and argue that sound is a rich epistemological tool for understanding and explaining our everyday experiences.

Enabling and Measuring Complexity in Evolving Designs using Generative Representations for Artificial Architecture

As the complexity of evolutionary design problems grow, so too must the quality of solutions scale to that complexity. In this research, we develop a genetic programming system with individuals encoded as tree-based generative representations to address scalability. This system is capable of multi-objective evaluation using a ranked sum scoring strategy. We examine Hornby's features and measures of modularity, reuse and hierarchy in evolutionary design problems. Experiments are carried out, using the system to generate three-dimensional forms, and analyses of feature characteristics such as modularity, reuse and hierarchy were performed. This work expands on that of Hornby's, by examining a new and more difficult problem domain. The results from these experiments show that individuals encoded with those three features performed best overall. It is also seen, that the measures of complexity conform to the results of Hornby. Moving forward with only this best performing encoding, the system was applied to the generation of three-dimensional external building architecture. One objective considered was passive solar performance, in which the system was challenged with generating forms that optimize exposure to the Sun. The results from these and other experiments satisfied the requirements. The system was shown to scale well to the architectural problems studied.

Metaphorical Interpretation: Measuring and Facilitating Growth.

Abstract A total of 378 grade 9 students participated in this study to address the problem that although metaphorical literacy and thought are expected and necessary for success in junior and senior high school and beyond, metaphorical concepts and thought are not required to be explicitly taught to these students. The students were from 20 different classes from 4 levels: English language learners (ELL), school to work (SSTW), applied, and academic. All were from 7 secondary schools within a board in southern Ontario. Nine classes made up the control group and 11 classes made up the treatment group. All classes were given 3 pretests and the posttest. The treatment group was given Socratic lessons and direct instruction on metaphorical thought and expressions during 1 semester and in conjunction with their other classroom material. The pretest scores (TOLD, Peabody, preproverbs concrete, and preproverbs abstract) did not reveal any effect of gender, but the academic students had higher scores than the applied students. The SSTW student results are more variable: (a) for the TOLD test, SSTW scores were between those of the academic and applied students; (b) for Peabody scores, SSTW students’ scores are the same as academic and are greater than applied; (c) for preproverbs concrete and preproverbs abstract, the SSTW scores are not different from the applied scores. The postproverbs concrete and postproverbs abstract scores for the treatment groups also showed no effect of gender but revealed that all students who received the treatment did better on their post scores. The positive changes of the treatment group illustrate a measured movement from literal understanding to abstract understanding using direct Socratic instruction and proverbs as a medium.

Printed Blank by which John Brown Cullen solemnly declares that he is experienced in the art of measuring and culling timber

Printed blank by which John Brown Cullen solemnly declares that he is experienced in the art of measuring and culling timber. He states that he is entering into the service of Burton and Bro. of Barrie He will make out the specification of the timber in berths 192 and 198 and submit his findings to Burton and Brother, Oct. 22, 1877.

Map measuring 28 cm. x 24 cm. showing the Walter H. Dickson land

Map measuring 28 cm. x 24 cm. showing the Walter H. Dickson land along the road from Blenheim, n.d.

Measuring Economic Insecurity

We provide a systematic treatment of the notion of economic insecurity, assuming that an individual’s sentiment of insecurity depends on the current wealth level and its variations experienced in the past. We think of wealth as a comprehensive variable encompassing anything that may help in coping with adverse occurrences. The current wealth level could also be interpreted as incorporating the individual’s evaluation of future prospects. Variations in wealth experienced in the recent past are given higher weight than experiences that occurred in the more distant past. Two classes of measures are characterized with sets of plausible and intuitive axioms.

Évaluation des intérêts sexuels auprès d’agresseurs sexuels d’enfants par la vidéo-oculographie et la présentation de stimuli générés par ordinateur

Il est proposé que la pléthysmographie pénienne puisse faire l’objet d’améliorations par la combinaison de la pléthysmographie pénienne et de la vidéo-oculographie lors de la présentation de stimuli générés par ordinateur (SGO). L’application de cette combinaison n’a fait l’objet d’aucune étude auprès d’agresseurs sexuels d’enfants. Cette thèse comporte trois articles empiriques qui visent respectivement à soutenir le développement d’un instrument d’évaluation basé sur l’utilisation combinée des réponses oculaires et érectiles lors de la présentation de SGO afin d’évaluer les intérêts sexuels d'agresseurs sexuels d’enfants. Pour ce faire, des hommes ayant eu (n = 26) ou non (n = 36) des comportements sexuels envers des enfants sont recrutés afin de constituer des groupes de comparaison. Le premier article représente une exploration préliminaire des données issues de caractéristiques sociodémographiques, sexuelles et criminologiques ainsi que des réponses oculaires et péniennes lors de présentations de SGO et de bandes sonores conventionnelles. Il permet d’orienter les décisions entourant la poursuite de la recherche. Le second article porte sur la comparaison des profils des réponses péniennes issues de présentations de SGO et de bandes sonores conventionnelles ainsi que sur leur capacité respective à classifier les individus selon la présence d’antécédents de comportements sexuels sur des enfants. Il permet d’établir la validité discriminante de l’utilisation de SGO et d’établir des normes d’utilisation clinique. Le troisième article vise à circonscrire une dynamique oculaire associée à l’intérêt sexuel envers l’âge d’un objet et à soutenir la contribution de la combinaison des réponses oculaires et péniennes lors de la présentation de SGO. En somme, les résultats issus de cette thèse soutiennent l’utilisation clinique de la pléthysmographie pénienne lors de la présentation de SGO. Ils permettent d’identifier la présence d’une signature oculaire spécifique aux agresseurs sexuels lors de la présentation de SGO. Ils démontrent la contribution de la combinaison des réponses oculaires et péniennes par rapport à une mesure reposant uniquement sur les réponses péniennes. Ces résultats ouvrent la voie à l’utilisation clinique de la vidéo-oculographie et de SGO et offrent non seulement des possibilités intéressantes dans le domaine de la délinquance sexuelle, mais également de la sexualité en général.