Measuring software security from the design of software

The vast majority of our contemporary society owns a mobile phone, which has resulted in a dramatic rise in the amount of networked computers in recent years. Security issues in the computers have followed the same trend and nearly everyone is now affected by such issues. How could the situation be improved? For software engineers, an obvious answer is to build computer software with security in mind. A problem with building software with security is how to define secure software or how to measure security. This thesis divides the problem into three research questions. First, how can we measure the security of software? Second, what types of tools are available for measuring security? And finally, what do these tools reveal about the security of software? Measuring tools of these kind are commonly called metrics. This thesis is focused on the perspective of software engineers in the software design phase. Focus on the design phase means that code level semantics or programming language specifics are not discussed in this work. Organizational policy, management issues or software development process are also out of the scope. The first two research problems were studied using a literature review while the third was studied using a case study research. The target of the case study was a Java based email server called Apache James, which had details from its changelog and security issues available and the source code was accessible. The research revealed that there is a consensus in the terminology on software security. Security verification activities are commonly divided into evaluation and assurance. The focus of this work was in assurance, which means to verify one’s own work. There are 34 metrics available for security measurements, of which five are evaluation metrics and 29 are assurance metrics. We found, however, that the general quality of these metrics was not good. Only three metrics in the design category passed the inspection criteria and could be used in the case study. The metrics claim to give quantitative information on the security of the software, but in practice they were limited to evaluating different versions of the same software. Apart from being relative, the metrics were unable to detect security issues or point out problems in the design. Furthermore, interpreting the metrics’ results was difficult. In conclusion, the general state of the software security metrics leaves a lot to be desired. The metrics studied had both theoretical and practical issues, and are not suitable for daily engineering workflows. The metrics studied provided a basis for further research, since they pointed out areas where the security metrics were necessary to improve whether verification of security from the design was desired.

Datenherrschaft – an Ethically Justified Solution to the Problem of Ownership of Patient Information

Patient information systems are crucial components for the modern healthcare and medicine. It is obvious that without them the healthcare cannot function properly – one can try to imagine how brain surgery could be done without using information systems to gather and show information needed for an operation. Thus, it can be stated that digital information is irremovable part of modern healthcare. However, the legal ownership of patient information lacks a coherent and justified basis. The whole issue itself is actually bypassed by controlling pa- tient information with different laws and regulations how patient information can be used and by whom. Nonetheless, the issue itself – who owns the patient in- formation – is commonly missed or bypassed. This dissertation show the problems if the legislation of patient information ownership is not clear. Without clear legislation, the outcome can be unexpected like it seems to be in Finland, Sweden and United Kingdom: the lack of clear regulation has come up with unwanted consequences because of problematic Eu- ropean Union database directive implementation in those countries. The legal ownership is actually granted to the creators of databases which contains the pa- tient information, and this is not a desirable situation. In healthcare and medicine, we are dealing with issues such as life, health and information which are very sensitive and in many cases very personal. Thus, this dissertation leans on four philosophical theories form Locke, Kant, Heidegger and Rawls to have an ethically justified basis for regulating the patient infor- mation in a proper way. Because of the problems of property and ownership in the context of information, a new concept is needed and presented to replace the concept of owning, that concept being Datenherrschaft (eng. mastery over in- formation). Datenherrschaft seems to be suitable for regulating patient infor- mation because its core is the protection of one’s right over information and this aligns with the work of the philosophers whose theories are used in the work. The philosophical argumentation of this study shows that Datenherrschaft granted to the patients is ethically acceptable. It supports the view that patient should be controlling the patient information about themselves unless there are such specific circumstance that justifies the authorities to use patient information to protect other people’s basic rights. Thus, if the patients would be legally grant- ed Datenherrschaft over patient information we would endorse patients as indi- viduals who have their own and personal experience of their own life and have a strong stance against any unjustified paternalism in healthcare. Keywords: patient information, ownership, Datenherrschaft, ethics, Locke, Kant, Heidegger, Rawls

Democracia e eficiência: a difícil relação entre política e economia no debate contemporâneo

Democracy and efficiency: hard relations between politics and economy. Many economists see politics as an irrational activity. They also think state action usually generates market inefficiencies and democratic institutions, such as elections, often work as obstacles to sound economic measures. Showing that vision has been embedded into the main currents of economic thought since the last century, we also argue those ideas are exported to great part of contemporary political science, including the area of public policies. Examining the literature, we show that rational choice political scientists, as the economists, claim governability and effective decisions will be guaranteed mainly through concentrated arenas or through insulated arrangements able to protect policy makers from political interference. In other words, governability depends on the reduction of the political arenas. On the contrary, we reject this technocratic solution of splitting politics from economy. With the support of classical pluralist thinkers, we stand another conception, arguing politics is the privileged social space for building interests and values in an institutionalized way. The difficulties to surpass current international crises since 2008 reveal this is a crucial problem: reducing politics would prevent societies from improving institutional solutions which are the only ones able to give space to emerging conflicts and, then, reach eventual consensus around them.

Incerteza e não ergodicidade: crítica aos neoclássicos

The starting point of this essay is to show that, in our view, the problem of the traditional economics is not in the deductive method nor the mathematical methods used, but to attribute to economic agents "power" on the future and prescribe the existence of ergodic stochastic processes in their economic analyzes. Thus, building a theory on the ground whose bases are not able to sustain a proper understanding of the world, mainstream economics has difficulties in using the modeling for establishing deductions and conclusions that help understanding the system. Thus, the logical-mathematical rigor in economic models and deduction can be used with appropriate axioms, which is not the case of mainstream economics. Our hypothesis is that the inability of the mainstream in predicting economic crisis is due to the non-recognition of some principles that best describe the dynamics of financialized contemporary capitalism, as the principles of non-ergodicity and Keynesian uncertainty.

Monibrändisen arkkitehtuurin johtaminen

Työ käsittelee brändiportfolion hallintaa monibrändisessä arkkitehtuurissa. Työn painopiste on erityisesti erillisbrändi -strategioissa.Tutkimuksen keskeisin ongelma voidaan muotoilla kysymykseen: Miten erityispiirteitä monibrändisen arkkitehtuurin johtaminen sisältää? Alaongelmia kuuluvat seuraavat kysymykset: Mitä brändiportfolion rakentamisessa tulee ottaa huomioon? Mitä etuja monibrändisellä arkkitehtuurilla tavoitellaan? Mitä haasteita monibrändisen arkkitehtuurin johtaminen pitää sisällään? Miten monibrändisen strategian onnistumista arvioidaan ja mitataan?

Exploring knowledge worker motivation in autonomous and interdependent problem solving tasks on virtual platforms

The objective of this study is to understand why virtual knowledge workers conduct autonomous tasks and interdependent problem solving tasks on virtual platforms. The study is qualitative case study including three case organizations that tap the knowledge of expert networks, and utilize virtual platforms in the work processes. Research data includes 15 interviews, that is, five experts from each case company. According to the findings there are some specific characteristics in motivation to work on tasks on online platforms. Autonomy, self-improvement, meaningful tasks, knowledge sharing, time management, variety of contacts, and variety of tasks, and projects motivate virtual knowledge workers. Factors that may enhance individuals’ engagement to work on tasks are trust, security of continuous task flow and income, feedback, meaningful tasks and tasks that contribute to self-improvement, flexibility and effectiveness in time management, and virtual tools that support social interaction. The results also indicate that there are some differences in individuals’ motivation based on the tasks’ nature. That is, knowledge sharing and variety of contacts motivated experts who worked on interdependent problem solving tasks. Then again, autonomy and variety of tasks motivated experts who worked on autonomous tasks.

Building governance in the international financial system: Context and challenges

ABSTRACTThe international financial system has undergone deep changes since the 1970s and its stability cannot be reached in spite of actor's interests or the existence of countless coordination fora. Analyzing the system's incentive structure, one can note that its stability depends on the control of imbalances, which are not always harmful for States, creating, thus, a disturbing component in the quest for international financial management. Furthermore, non-state actors have acquired a disproportional share of power following financial globalization, escaping the control of States and of the international community.

Building IT architecture for developing nations using TOGAF

Developing nations vary in data usage techniques with respect to developed nations because of lack of standard information technology architecture. With the concept of globalization in the modern times, there is a necessity of information sharing between different developing nations for better advancements in socio-economic and science and technology fields. A robust IT architecture is needed and has to be built between different developing nations which eases information sharing and other data usage methods. A framework like TOGAF may work in this case as a normal IT framework may not fit to meet the requirements of an enterprise architecture. The intention of the thesis is to build an enterprise architecture between different developing nations using a framework TOGAF

The relationship between b2b branding and industrial buying in the digital era: evidence from Finnish gas industry

The aim of this study is to understand the importance of b2b brands in different phases of the industrial buying process in the digital era. The research problem is approached by examining a b2b supplier brand in the context of gas supplier selection. The data was collected by interviewing individuals from ten different companies. The findings contribute to previous theory by showing that as industrial buying behaviour is eventually individual behaviour, brands can influence decision making. The relevance of a brand depends on individual’s personality and preferences. Digital media cannot be ignored in managing brand image as buyers are present in the online environment. The results reveal that traditional personal selling is, nevertheless, in a key role in brand image building and is a source of added value. The salesperson influences buyers’ perceived associations of a brand and gives the brand a face.

Perceptions of green branding and identity building amongst small Finnish textile producers

The textile industry is one of the most polluting industries in the world. The amount of air and water pollution it causes puts a burden on the environment. There are companies who have taken the environmental and social aspects into account in the their production and chosen to operate in a green manner. This thesis studies how the phenomenon of green branding is seen from the perspectives of small Finnish textile companies. The theory used in this thesis has to do with green branding and identity building. The theory is used to analyze the results of the empirical findings. The main research question that the thesis aims to answer is how green branding is perceived within the Finnish textile industry. In order to answer the main research question, empirical data was collected from five relevant companies within the Finnish textile industry. The companies interviewed for the study were WST, Saana ja Olli, RCM, R-collection and Tiensivu. The study was conducted as a multiple case based study where multiple experts from green companies were interviewed. The experts were all owners or employees of companies that have a so-called green brand identity. The data was collected through semi-structured interviews, where the relevant experts from each company were interviewed either by themselves, in pairs or in groups. The data that was collected for this study was primary data, and the results of the study are mainly based on the experiences and opinions of the experts interviewed. The data collected does not cover the entire green textile industry within Finland, but study does however give a fairly comprehensive view of the phenomenon, as the textile industry in Finland is quite concise. The general findings of the study show that all experts from the companies interviewed agreed that a green brand identity does benefit their company in one way or the other. The findings also show contradictions with the older theory (eg. Charter et al. 1999, Pickett et al. 1995), and perhaps give a more modern view of the thoughts within the industry.

V&B celebrate building milestone

The firm celebrates the construction of new headquarters.

Central Utilities Building

View from outside the Central Utilities Building facing southwest.

Academic Staging Building

A view from the main parking lot near the time of completion of the complex.

The quality of the mother-child relationship during collaborative problem solving /

The quality of the mother-child relationship was examined in relation to joint planning, maternal teaching strategies, maternal emotional support, mutual positive affect and attachment security. Fifty-five grade five children and their mothers participated in a laboratory session comprised of various activities and completed questionnaires to evaluate attachment security. Joint planning and social problem solving were assessed observationally during an origami task. Problem solving effectiveness was unrelated to maternal teaching strategies, maternal encouragement and mutual positive affect. A marginally significant relationship was found between maternal encouragement and active child participation. Attachment security was found to be significantly related to sharing of responsibility during local planning, but only for child autonomous performance. An examination of conditional probabilities revealed that mutual positive affect did not increase the likelihood of subsequent mother-child dyadic regulation. However, mutual positive affect was found to be significantly related to both active child participation and dyadic regulation. The hypothesis predicting a mediational model was not supported. The implications of these findings in the theoretical and empirical literature were considered and suggestions for future research were made.

Vulnerability to adverse consequences of drinking and problem drinker status as predicted by risky drinking behaviours, drug use, sex differences and affect : a test of multiple models /

Although alcohol problems and alcohol consumption are related, consumption does not fully account for differences in vulnerability to alcohol problems. Therefore, other factors should account for these differences. Based on previous research, it was hypothesized that risky drinking behaviours, illicit and prescription drug use, affect and sex differences would account for differences in vulnerability to alcohol problems while statistically controlling for overall alcohol consumption. Four models were developed that were intended to test the predictive ability of these factors, three of which tested the predictor sets separately and a fourth which tested them in a combined model. In addition, two distinct criterion variables were regressed on the predictors. One was a measure of the frequency that participants experienced negative consequences that they attributed to their drinking and the other was a measure of the extent to which participants perceived themselves to be problem drinkers. Each of the models was tested on four samples from different populations, including fIrst year university students, university students in their graduating year, a clinical sample of people in treatment for addiction, and a community sample of young adults randomly selected from the general population. Overall, support was found for each of the models and each of the predictors in accounting for differences in vulnerability to alcohol problems. In particular, the frequency with which people become intoxicated, frequency of illicit drug use and high levels of negative affect were strong and consistent predictors of vulnerability to alcohol problems across samples and criterion variables. With the exception of the clinical sample, the combined models predicted vulnerability to negative consequences better than vulnerability to problem drinker status. Among the clinical and community samples the combined model predicted problem drinker status better than in the student samples.