SMEs Attitudes to “Information Assurance” and Consequences for the Digital Single Market

It is now generally accepted that cyber crime represents a big threat to organisations, and that they need to take appropriate action to protect their valuable information assets. However, current research shows that, although small businesses understand that they are potentially vulnerable, many are still not taking sufficient action to counteract the threat. Last year, the authors sought, through a more generalised but categorised attitudinal study, to explore the reasons why smaller SMEs in particular were reluctant to engage with accepted principles for protecting their data. The results showed that SMEs understood many of the issues. They were prepared to spend more but were particularly suspicious about spending on information assurance. The authors’ current research again focuses on SME attitudes but this time the survey asks only questions directly relating to information assurance and the standards available, in an attempt to try to understand exactly what is causing them to shy away from getting the badge or certificate that would demonstrate to customers and business partners that they take cyber security seriously. As with last year’s study, the results and analysis provide useful pointers towards the broader business environment changes that might cause SMEs to be more interested in working towards an appropriate cyber security standard.

Attack simulation based software protection assessment method

Software protection is an essential aspect of information security to withstand malicious activities on software, and preserving software assets. However, software developers still lacks a methodology for the assessment of the deployed protections. To solve these issues, we present a novel attack simulation based software protection assessment method to assess and compare various protection solutions. Our solution relies on Petri Nets to specify and visualize attack models, and we developed a Monte Carlo based approach to simulate attacking processes and to deal with uncertainty. Then, based on this simulation and estimation, a novel protection comparison model is proposed to compare different protection solutions. Lastly, our attack simulation based software protection assessment method is presented. We illustrate our method by means of a software protection assessment process to demonstrate that our approach can provide a suitable software protection assessment for developers and software companies.

Severus Snape : The Complexity and Unconventional Heroism of Severus Snape in the Harry Potter Books

Being an evildoer and being evil is not always the same thing; author J.K Rowling’s character Professor Severus Snape from the Harry Potter series is balancing on that very line. Although being unfair and mean to the protagonist Harry Potter all through the series, Professor Snape is revealed as a hero in the seventh book Harry Potter and the Deathly Hallows (2007). This essay focuses on some of the complex psychological reasons as to why Snape acts the way he does towards Harry and why many readers consider him to be just as great a hero as the protagonist. It argues that his difficult upbringing is the cause of his complexity and the series of books are analyzed from a structuralist perspective, using A.J Greimas’ actantial model and Frank Kermode’s theories about endings and plot twists. Snape’s hate for Harry’s father, caused by years of bullying, is examined as well as his love for Harry’s mother. This essay also discusses in what ways Snape’s change of allegiance, brought on by his eternal love for Harry’s mother, is a great aid in defeating the Dark Lord.

A violência escolar e a sua relação com diferentes psicopatologias

Desde há alguns anos a esta parte, muito se tem discutido a temática do Bullying nas atuais sociedades modernas e industrializadas. Com o avanço da técnica e do conhecimento científico, só recentemente se lhe dá a devida atenção, dado os danos que pode causar a médio e longo prazo em todos os intervenientes nesse fenómeno de exteriorização da violência. Embora se tenham desenhado múltiplas estratégias para a sua explicação e combate, continua a ser um tema muito atual, pois embora pesem os modelos de intervenção de certa forma já padronizados, há sempre a necessidade de os adaptar ao contexto de cada caso. Desta forma este tema continua e continuará a ser alvo de estudo e aprofundamento. Neste trabalho, analisaremos toda a temática do Bullying, desde a sua conceptualização, passando pela sua etiologia, fatores de risco, intervenientes, bem como o seu diagnóstico, combate e prevenção. Partindo da premissa de que este tema envolve uma série de variáveis que vão para além dos problemas comportamentais e/ou da indisciplina, tais como variáveis culturais, sociofamiliares, escolares, pessoais/psicológicas e psicopatológicas, é nesta ultima variável que iremos focar mais especificamente o nosso trabalho, nomeadamente no estabelecimento de uma correlação entre o Bullying e a Perturbação de Défice de Atenção e Hiperatividade. Nos alunos mais jovens, o défice de atenção com hiperatividade, a depressão bem como a ansiedade, são problemas paralelos ao Bullying. Dado o facto de as crianças com estas caraterísticas serem mais vulneráveis à violência, pois têm dificuldades de integração no seio escolar e/ou no grupo de pares, podemos afirmar desde já e com bastante veemência que estas pertencem a um grupo com um enorme fator de risco para se envolver em comportamentos relacionados com o Bulliyng em toda a sua abrangência.

Twitter e ciberativismo: o movimento social da hashtag #ForaMicarla em Natal-RN

The spatial and temporal fluidity conditioned by the technologies of social interaction online have been allowing that collective actions of protest and activism arise every day in cyberspace - the cyber-activism. If before these actions were located in geographical boundaries, today's demands and mobilizations extrapolate the location, connect to the global, and at the same time, return to the regional through digital virtuality. Within this context of the relationship between digital technology and global flow of sociability, emerges in October 2010 the social movement of the hashtag "#ForaMicarla", which means the dissatisfaction of cibernauts from Natal of Twitter with the current management of the municipality of Natal-RN, Micarla de Sousa (Green Party). We can find in the center of this movement and others who appeared in the world at the same time a technological condition of Twitter, with the hashtag "#". Given this scenario, this research seeks to analyze how the relationship of the agents of movement hashtag "ForaMicarla", based on the principle that it was formed in the Twitter network and is maintained on the platform on a daily basis, it can create a new kind of political culture. Thus, this study discusses theoretically the importance of Twitter and movements that emerge on the platform and through it to understand the social and political demands of the contemporary world and this public sphere, which now seems to include cyberspace

Pervasive eHealth services a security and privacy risk awareness survey

The human factor is often recognised as a major aspect of cyber-security research. Risk and situational perception are identified as key factors in the decision making process, often playing a lead role in the adoption of security mechanisms. However, risk awareness and perception have been poorly investigated in the field of eHealth wearables. Whilst end-users often have limited understanding of privacy and security of wearables, assessing the perceived risks and consequences will help shape the usability of future security mechanisms. This paper present a survey of the the risks and situational awareness in eHealth services. An analysis of the lack of security and privacy measures in connected health devices is described with recommendations to circumvent critical situations.

La réception du hip-hop chez des rappeurs afro-québécois dans la ville de Québec : appropriation intersectionnelle de problématiques multidimensionnelles

Cette thèse analyse les rappeurs afro-québécois des communautés de Limoilou (Limoilou Starz) et leurs amis de Montcalm comme des acteurs qui s’approprient des éléments identitaires, de lutte sociale et de survie économique, issus des problématiques globales et américaines du hip-hop, au service de leurs défis particuliers. Les divers mérites des luttes menées au moyen de leur art sont acquis par des formes spécifiques de capital. Ainsi les moyens utilisés par les rappeurs sont principalement les paroles de chansons, les prises de parole publique, dans les médias et sur scène, les campagnes d’affichage, l’utilisation des réseaux numériques, l’entreprise économique autonome (photographie, vidéographie, gestion des artistes, vente de vêtements). Ces moyens spécifiques se rattachent à d’autres principes et actions non explicités et sociohistoriquement ancrés. À partir d’une enquête ethnographique menée auprès de 31 participants dans la ville de Québec, j’utilise le concept de « réception différenciée » (Hall, 1980; Morley, 1980) pour décrire le processus de résistance des différents pratiquants et entrepreneurs de la musique aux dominations provenant de groupes divers. Trois principaux groupes de domination sont examinés : les agents d’institutions étatiques (comme les policiers du Service de Police de la Ville de Québec), les agents d’entreprises privées (comme les patrons de grandes boites de nuit et les propriétaires de labels musicaux indépendants) et les groupes et individus du milieu hip-hop, à travers leurs stratégies d’intimidation. La théorie « émergente » ou emergent-fit (Guillemette, 2006; Guillemette et Luckerhoff, 2009) permet d’entrevoir la musique hip-hop en amont comme une structure multidimensionnelle (sociale, identitaire, politique et économique) et intersectionnelle (intersection de plusieurs catégories interreliées, relatives au lieu de résidence, à la race et aux capacités économiques), et en aval comme un champ musical (Bourdieu, 1976 et 1989; Rimmer, 2010) renégocié. Cette structure a pris forme et s’est transformée grâce aux dispositions mentales et physiques (habitus) des acteurs étudiés. Les résultats de cette recherche montrent que certains rappeurs et leurs autres collègues artistes hip-hop— ainsi que quelques entrepreneurs— résistent à plusieurs sortes de domination. D’autres encore acceptent ces dominations sous forme d’idéologies, même en le reconnaissant explicitement. Par contre, une infime partie des acteurs étudiés les rejettent complètement. Ainsi, l’appropriation multidimensionnelle et intersectionnelle des sens dominants à travers le hip-hop mène à plusieurs formes de lecture de la domination et de la résistance.

A survey of intrusion detection system technologies

This paper provides an overview of IDS types and how they work as well as configuration considerations and issues that affect them. Advanced methods of increasing the performance of an IDS are explored such as specification based IDS for protecting Supervisory Control And Data Acquisition (SCADA) and Cloud networks. Also by providing a review of varied studies ranging from issues in configuration and specific problems to custom techniques and cutting edge studies a reference can be provided to others interested in learning about and developing IDS solutions. Intrusion Detection is an area of much required study to provide solutions to satisfy evolving services and networks and systems that support them. This paper aims to be a reference for IDS technologies other researchers and developers interested in the field of intrusion detection.

Introduction to Security Onion

Security Onion is a Network Security Manager (NSM) platform that provides multiple Intrusion Detection Systems (IDS) including Host IDS (HIDS) and Network IDS (NIDS). Many types of data can be acquired using Security Onion for analysis. This includes data related to: Host, Network, Session, Asset, Alert and Protocols. Security Onion can be implemented as a standalone deployment with server and sensor included or with a master server and multiple sensors allowing for the system to be scaled as required. Many interfaces and tools are available for management of the system and analysis of data such as Sguil, Snorby, Squert and Enterprise Log Search and Archive (ELSA). These interfaces can be used for analysis of alerts and captured events and then can be further exported for analysis in Network Forensic Analysis Tools (NFAT) such as NetworkMiner, CapME or Xplico. The Security Onion platform also provides various methods of management such as Secure SHell (SSH) for management of server and sensors and Web client remote access. All of this with the ability to replay and analyse example malicious traffic makes the Security Onion a suitable low cost alternative for Network Security Management. In this paper, we have a feature and functionality review for the Security Onion in terms of: types of data, configuration, interface, tools and system management.

Prevenir a Brincar

Projeto de Graduação apresentado à Universidade Fernando Pessoa como parte dos requisitos para obtenção do grau de licenciada em Criminologia

Molestie nel web 2.0: la risposta del diritto civile ai danni ciberbullying

1. VIOLENZA FRA EGUALI: DAL BULLYNG TRADIZIONALE AL CIBERBULLYNG. 1.1 Concezione e caratteristiche del ciberbullying. 1.2.- Concorrenza di fenomeni di bullying tradizionali e cyberbullying. 1.3 Cifre allarmanti del cyberbullyng. 2. CYBERBULLISMO E RESPONSABILITÀ PENALE DEL DELINQUENTE GIOVANILE. 2.1.- Cyberbullismo: Regolazione prevista dal Codice penale spagnolo. 2.2. Responsabilità penale dei minori secondo l'età e le misure adottate (LORPM). 3. REGIMI LEGALI CHE REGOLANO LA RESPONSABILITÀ CIVILE PER DANNI DERIVANTI DAL CYBERBULLISMO. 3.1. Il terzo sistema di responsabilità civile che introduce la LORPM. 3.2 Il ciberbullyng e la responsabilità civile nella giurisdizione penale dei minori sotto l`articolo 61,3 LORPM. 1.

Analysis of Automotive Cybersecurity - Attack surfaces and users’ privacy concerns

Modern automobiles are no longer just mechanical tools. The electronics and computing services they are shipping with are making them not less than a computer. They are massive kinetic devices with sophisticated computing power. Most of the modern vehicles are made with the added connectivity in mind which may be vulnerable to outside attack. Researchers have shown that it is possible to infiltrate into a vehicle’s internal system remotely and control the physical entities such as steering and brakes. It is quite possible to experience such attacks on a moving vehicle and unable to use the controls. These massive connected computers can be life threatening as they are related to everyday lifestyle. First part of this research studied the attack surfaces in the automotive cybersecurity domain. It also illustrated the attack methods and capabilities of the damages. Online survey has been deployed as data collection tool to learn about the consumers’ usage of such vulnerable automotive services. The second part of the research portrayed the consumers’ privacy in automotive world. It has been found that almost hundred percent of modern vehicles has the capabilities to send vehicle diagnostic data as well as user generated data to their manufacturers, and almost thirty five percent automotive companies are collecting them already. Internet privacy has been studies before in many related domain but no privacy scale were matched for automotive consumers. It created the research gap and motivation for this thesis. A study has been performed to use well established consumers privacy scale – IUIPC to match with the automotive consumers’ privacy situation. Hypotheses were developed based on the IUIPC model for internet consumers’ privacy and they were studied by the finding from the data collection methods. Based on the key findings of the research, all the hypotheses were accepted and hence it is found that automotive consumers’ privacy did follow the IUIPC model under certain conditions. It is also found that a majority of automotive consumers use the services and devices that are vulnerable and prone to cyber-attacks. It is also established that there is a market for automotive cybersecurity services and consumers are willing to pay certain fees to avail that.

Credibilidad y confianza del comité de convivencia laboral de la Administración Municipal de Itagüí (2014 – 2015)

El acoso laboral es una problemática que aqueja a la población laboral mundial y es uno de los principales riesgos psicosociales en el trabajo, pues no sólo afecta la productividad de los trabajadores, sino que también tiene un fuerte impacto en su salud mental. En Colombia se promulgó la Ley 1010 de 2006 con el fin de combatir este flagelo, sin embargo, se cuestiona la eficacia de esta ley y las resoluciones emanadas del Ministerio del Trabajo que crean los Comités de Convivencia Laboral. El acoso laboral, continúa siendo una de las principales problemáticas que viven los empleados en Colombia, situación que no es ajena en la Administración Municipal de Itagüí. La pregunta que orientó la presente investigación fue: ¿Genera credibilidad y confianza el Comité de Convivencia Laboral entre los funcionarios de la Administración Municipal de Itagüí frente a la solución de las problemáticas relacionadas con el acoso laboral? Los resultados obtenidos a partir de una encuesta realizada a 254 funcionarios y una entrevista con los miembros del Comité de Convivencia Laboral (CCL), permite concluir que el CCL de la Administración Municipal de Itagüí, presenta fallas en la gestión que viene realizando y que existe un clima de desconfianza y falta de credibilidad hacia el comité, lo que se traduce en que la Ley 1010 de 2006 pierda eficacia instrumental en la prevención del acoso laboral en la administración municipal de Itagüí.

Applied web traffic analysis for numerical encoding of SQL Injection attack features.

SQL Injection Attack (SQLIA) remains a technique used by a computer network intruder to pilfer an organisation’s confidential data. This is done by an intruder re-crafting web form’s input and query strings used in web requests with malicious intent to compromise the security of an organisation’s confidential data stored at the back-end database. The database is the most valuable data source, and thus, intruders are unrelenting in constantly evolving new techniques to bypass the signature’s solutions currently provided in Web Application Firewalls (WAF) to mitigate SQLIA. There is therefore a need for an automated scalable methodology in the pre-processing of SQLIA features fit for a supervised learning model. However, obtaining a ready-made scalable dataset that is feature engineered with numerical attributes dataset items to train Artificial Neural Network (ANN) and Machine Leaning (ML) models is a known issue in applying artificial intelligence to effectively address ever evolving novel SQLIA signatures. This proposed approach applies numerical attributes encoding ontology to encode features (both legitimate web requests and SQLIA) to numerical data items as to extract scalable dataset for input to a supervised learning model in moving towards a ML SQLIA detection and prevention model. In numerical attributes encoding of features, the proposed model explores a hybrid of static and dynamic pattern matching by implementing a Non-Deterministic Finite Automaton (NFA). This combined with proxy and SQL parser Application Programming Interface (API) to intercept and parse web requests in transition to the back-end database. In developing a solution to address SQLIA, this model allows processed web requests at the proxy deemed to contain injected query string to be excluded from reaching the target back-end database. This paper is intended for evaluating the performance metrics of a dataset obtained by numerical encoding of features ontology in Microsoft Azure Machine Learning (MAML) studio using Two-Class Support Vector Machines (TCSVM) binary classifier. This methodology then forms the subject of the empirical evaluation.