Quantcast
Channel: Publications of the Laboratory for Education and Research in Secure Systems Engineering (LERSSE)
Browsing all 95 articles
Browse latest View live

Management of IT Security in Organizations: What Makes It Hard?

Security of information technology (IT) has become a critical issue for organizations as they must protect their information assets from unauthorized access and quickly resume business activities after...

View Article



Cooperative Secondary Authorization Recycling

As enterprise systems, Grids, and other distributed applications scale up and become increasingly complex, their authorization infrastructures—based predominantly on the request-response paradigm—are...

View Article

Challenges, Collaborative Interactions, and Diagnosis Performed by IT...

This thesis investigates four different aspects of information security management: challenges faced by security practitioners, interactive collaborations among security practitioners and other...

View Article

A Two-factor Authentication Mechanism Using Mobile Phones

Mobile devices are becoming more pervasive and more advanced with respect to their processing power and memory size. Relying on the personalized and trusted nature of such devices, security features...

View Article

Guidelines for Designing IT Security Management Tools

An important factor that impacts the effectiveness of security systems within an organization is the usability of security management tools. In this paper, we present a survey of design guidelines for...

View Article


On the Imbalance of the Security Problem Space and its Expected Consequences

Purpose – This paper aims to report on the results of an analysis of the computer security problem space, to suggest the areas with highest potential for making progress in the attacker-defender game,...

View Article

Authorization Using the Publish-Subscribe Model

Traditional authorization mechanisms based on the request-response model are generally supported by point-to-point communication between applications and authorization servers. As distributed...

View Article

Creation and Evaluation of SQL Injection Security Tools

This work summarizes our research on the topic of the creation and evaluation of security tools against SQL injection attacks (SQLIAs). We introduce briefly the key concepts and problems of information...

View Article


Auxiliary Material for the Study of Security Practitioners in Context: Their...

This technical report contains additional material for the study, which investigated the context of interactions of IT security practitioners.

View Article


Towards Improving Mental Models of Personal Firewall Users

Windows Vista’s personal firewall provides its diverse users with a basic interface that hides many operational details. However, our study of this interface revealed that concealing the impact of...

View Article

Mobile Applications for Public Sector: Balancing Usability and Security

Development of mobile software applications for use in specific domains such as Public Security must conform to stringent security requirements. While mobile devices have many known limitations,...

View Article

Usability Study of Windows Vista’s Firewall

Windows Vista is shipped with a built-in personal firewall. The firewall has lots of new features over its predecessor, XP’s firewall. But, previous studies showed that Vista’s firewall have a set of...

View Article

Usability of Windows Vista Firewall: A Laboratory User Study

In this project we conducted a user study of Microsoft Windows Vista Firewall: a lab study followed by a questionnaire to evaluate the usability of Vista’s personal firewall. Our results show that the...

View Article


A Usability Analysis of Microsoft Windows Vista’s Firewall

The usability of personal firewalls has not received a significant amount of attention in the literature. However, it is essential that these firewalls - which are used by the lay end-user to protect...

View Article

Security Practitioners in Context: Their Activities and Interactions with...

This study investigates the context of interactions of IT security practitioners, based on a qualitative analysis of 30 interviews and participatory observation. We identify nine different activities...

View Article


An integrated view of human, organizational, and technological challenges of...

Abstract Purpose – The purpose of this study is to determine the main challenges that IT security practitioners face in their organizations, including the interplay among human, organizational, and...

View Article

SQLPrevent: Effective Dynamic Protection Against SQL Injection Attacks

This paper presents an approach for retrofitting existing web applications with run-time protection against known as well as unseen SQL injection attacks (SQLIAs). This approach (1) is resistant to...

View Article


Usability Meets Access Control: Challenges and Research Opportunities

This panel discusses specific challenges in the usability of access control technologies and new opportunities for research. The questions vary from “Why nobody, even experts, uses access control lists...

View Article

Application-Based TCP Hijacking

We present application-based TCP hijacking (ABTH), a new attack on TCP applications that exploits flaws due to the interplay between TCP and application protocols to inject data into an application...

View Article

Identification of sources of failures and their propagation in critical...

Understanding the origin of infrastructure failures and their propagation patterns in critical infrastructures can provide important information for secure and reliable infrastructure design. Among the...

View Article
Browsing all 95 articles
Browse latest View live




Latest Images