Open Source Software security depends on a small, largely volunteer workforce of maintainers who triage incoming vulnerability reports. Since 2024, AI-generated reports have disrupted the assumption that surface quality signals underlying substance, something that recognition-based triage depended on.

This study investigates how AI-assisted security reports affect OSS maintainers and triage practices through twenty semi-structured interviews analyzed using Reflexive Thematic Analysis. Five themes emerged: a temporal shift in report quality, an evaluation crisis and adaptive response, asymmetric cost distribution, strain on the expertise pipeline and ecosystem viability concerns.

Maintainers independently converged on reproducibility as the signal AI cannot fake, began scrutinizing reporter identity alongside report content and deployed AI-assisted pre-triage while preserving human final judgment. Five practical recommendations are offered which are grounded in practices maintainers had already developed independently. ... Read more

Organizations often struggle to integrate new digital technologies into everyday work because adoption is shaped not only by technical features but also by routines, roles, and coordination practices. The rapid diffusion of generative artificial intelligence, exemplified by systems such as ChatGPT and Microsoft Copilot, has intensified this challenge while empirical knowledge about its everyday organizational use remains limited. This thesis examined how knowledge workers enact generative AI within work routines and how these enactments and routines evolve over time. Drawing on the practice lens and sociomateriality, the study conceptualized adoption as an ongoing process in which human action and technology co-constitute technology-in-practice. A qualitative longitudinal design was employed in a small German company in electronics manufacturing. Data was collected through two rounds of in-person shadowing and follow-up semi-structured interviews with seven employees across multiple functions. The analysis identified four themes: generative AI enacted as a flexible collaborator for bounded cognitive tasks, reconfiguration of the human-AI division of labor, the emergence and stabilization of prompting and feature routines, and sociomaterial tensions around trust, control, and risk. Overall, generative AI became embedded through layered workflows in which humans framed tasks, delegated execution, and reclaimed control for validation and refinement. The findings suggest that understanding integration requires practice-based perspectives that capture evolving routines, conditional trust, and shifting agency. ... Read more

Municipalities play a central role in delivering essential public services, including civil registration, social services, taxation, communication, and local democratic processes. In doing so, they increasingly rely on digital systems. Cyber incidents affecting these systems can disrupt service delivery, expose sensitive personal data, and impose significant recovery costs. Because municipalities are often the most visible and accessible layer of government for citizens, such incidents may also affect public trust. In addition, municipalities operate and oversee systems that support local critical infrastructure, such as water management, traffic control, and energy distribution, placing them within the scope of both financially motivated cybercriminals and state-sponsored advanced persistent threats (APTs).

In response to this threat landscape, municipalities are expected to implement a range of cybersecurity measures. These include complying with security frameworks and standards, managing vulnerabilities through patching and configuration, participating in information sharing and coordination structures, and preparing for incident response and recovery. At the same time, municipalities typically operate under constraints that distinguish them from many other organizations, including limited internal cybersecurity capacity, extensive reliance on outsourcing and shared service providers, and complex internal structures in which responsibility for systems and data is distributed across departments and external parties.

As a result, municipal cybersecurity is rarely a matter of isolated technical controls. Instead, it is shaped by interactions between municipalities and a broader ecosystem of actors, including vendors, managed service providers, sectoral and national CSIRTs, and commercial security firms. Information about threats and vulnerabilities often reaches municipalities through intermediaries, and the ability to act on that information depends on institutional arrangements, contractual relationships, and organizational processes. Understanding municipal cybersecurity, therefore, requires examining not only which security measures are in place but also how those measures function in practice within this institutional context.

This dissertation examines the security measures municipalities use to address cyber threats and how they function in practice under these conditions. It investigates vulnerability remediation, institutional support for incident prevention and response, and the use of commercial threat intelligence, and asks how these security measures can be improved in practice, addressing the central research question: How can municipalities improve security measures to address cyber threats? To answer this question, the dissertation presents three empirical studies that combine technical measurements with practitioner perspectives, adopting a socio-technical approach that connects technical observations to organizational and institutional contexts.
... Read more

Modern software depends heavily on third-party open-source libraries, with the vast majority of applications incorporating external components. While this dependency-driven development accelerates innovation, it creates significant security risks through complex, deeply nested dependency graphs where vulnerabilities can propagate across thousands of downstream systems.

While Software Composition Analysis (SCA) tools effectively identify known vulnerabilities, they generate overwhelming alert volumes in large organizations. Our analysis shows that over 8% of dependencies have known vulnerabilities, with each vulnerable version appearing multiple times across projects. This results in dozens of alerts per project, making manual triage infeasible.

This thesis presents a data-driven approach to prioritizing dependency risk, addressing the challenge of identifying the most critical security threats within the overwhelming volumes of alerts generated by SCA tools. The methodology integrates multiple risk indicators, including severity scores, exploit prediction metrics, known exploitation evidence, dependency freshness measures, and license compliance risks into a unified feature set. To capture transitive risk propagation while maintaining focus on actionable components, the framework applies a depth-weighted aggregation technique that assigns exponentially decreasing weights to deeper dependencies. Prioritization is performed using an autoencoder-based model, which leverages reconstruction error to rank dependencies by risk.

The framework was evaluated on thousands of real-world dependencies and showed promise in ranking components based on complex, multi-dimensional risk signals. It prioritized not only dependencies with extreme values in individual indicators but also those with unusual combinations across dimensions, including risks buried in transitive relationships. In a preliminary validation study, expert reviewers agreed with the model’s prioritizations in 96.7% of cases, highlighting its practical relevance and alignment with expert opinion.

By integrating diverse risk indicators, modeling transitive influence, and leveraging autoencoders, this work provides a practical framework for identifying high-risk dependencies in complex software ecosystems. It reduces noise in vulnerability alerts, highlights truly critical components, and supports more focused remediation. While not a replacement for expert judgment, the framework complements existing practices, representing a step toward more adaptive and risk-aware approaches within modern software ecosystems.
... Read more

With the rise of cloud computing, remote work, and interconnected systems, the traditional model of trusting everything inside the network perimeter has become increasingly risky. In response, Zero Trust Architecture (ZTA) has emerged as a model where no user or device is inherently trusted, regardless of their location. Micro-segmentation, one of ZTA’s key mechanisms, aims to limit lateral movement and enforce fine-grained access control. However, implementing micro-segmentation in environments with legacy systems remains particularly challenging due to outdated technologies, rigid configurations, and limited visibility.

Although the literature offers many advanced segmentation models, these are often designed for cloud-native or modern infrastructures and fail to address the constraints inherent in legacy-heavy environments. This research investigates how organizations with legacy systems can identify and evaluate appropriate micro-segmentation strategies based on their network characteristics and technical constraints. The central research question is:

How can organizations choose and implement micro-segmentation strategies that align with their network architectures and the technical constraints posed by legacy systems?

To address this question, the study began with a structured literature review, which revealed a lack of detailed and context-aware guidance for applying micro-segmentation in constrained environments. To fill this gap, a series of semi-structured interviews were conducted with cybersecurity professionals experienced in industrial and legacy-heavy systems. The interview data were analysed using thematic coding to uncover recurring patterns, practical challenges, and the decision-making logic used in real-world settings.

The findings reveal three principal categories of micro-segmentation strategies: network-based, agent-based, and hybrid. The choice between these depends on technical factors such as system compatibility, network architecture, and the level of administrative control available. In addition to strategy selection, the study identifies a phased implementation approach typically followed by organizations. The study also defines key criteria for evaluating segmentation outcomes, including enforcement of access control, operational continuity, system performance, network visibility, and many more. These insights form the basis of a structured, step-by-step implementation guide and a decision-support framework. Together, they enable organizations to assess their technical constraints and select appropriate strategies. The main contribution of this research is the development of a practice-oriented framework that supports the secure integration of legacy systems into Zero Trust environments. ... Read more

Role-Based Access Control (RBAC) is foundational to enterprise security, yet manual role engineering remains error-prone and unscalable. Although automated role mining addresses this, existing methods face a critical trade-off: exact approaches guarantee minimal roles but fail on real-world scales, while heuristics scale but lack formal guarantees. This inconsistency forces enterprises into suboptimal, insecure configurations—increasing vulnerability risks and compliance costs. We resolve this instability
through a four-level resource-aware framework that dynamically adapts: (1) a memory-light heuristic, (2) optimality-preserving reductions, (3) a greedy heuristic with logarithmic approximation bounds, and (4) an ILP-based exact solver. Notably, our approach eliminates more than 99% of edges in 26 out of 31 real-world systems, enabling globally optimal role configurations and achieving an average 53% simplification of existing RBAC systems. Our heuristics achieve near-optimal solutions, while providing significant speedups over prior heuristics. Beyond individual components, the unified, adaptive framework minimizes suboptimal decisions at any scale. We open-source this framework to enable minimal RBAC deployment at any scale. ... Read more

The thesis investigates how the EU’s new NIS2 cybersecurity directive, which establishes a unified framework covering 18 critical sectors, imposes demanding third-party risk management requirements on organizations. In particular, NIS2 mandates that organizations include supply chain security policies in their information security management systems and consider the vulnerabilities specific to each direct supplier and service provider in their risk assessments. These broad obligations create a major compliance challenge, as traditional TPRM practices are largely manual, fragmented, and non-standardized, causing duplicated efforts and inconsistencies in analysis.

To address this, the thesis asks: To what extent can third-party risk assessments be automated to enhance cybersecurity resilience under NIS2? To answer this, a mixed-methods research design was used. First, a systematic literature review and policy analysis established the problem context and identified gaps in existing TPRM processes. Second, in-depth interviews were conducted with cybersecurity consultants and tool vendors to provide practical insights into current TPRM workflows, data requirements, and automation opportunities. Third, leading commercial TPRM platforms were analyzed to identify their features and limitations. This combination of expert interviews, tool analysis, and literature review provided a comprehensive view of the technical and organizational factors affecting NIS2 compliance. Key findings show that many vendor assessment tasks (e.g., questionnaires, risk scoring, and monitoring) can indeed be automated, yielding faster, more consistent audits. For example, dynamic risk-scoring engines that aggregate questionnaire responses with external threat intelligence and past incident data can provide a continuous, quantitative view of each supplier’s security posture. Such automation substantially improves audit efficiency and accuracy compared to ad-hoc spreadsheet or survey-based processes. However, the study also found cultural and trust challenges: many organizations and vendors are still reluctant to share data or adopt common frameworks without strong governance.

Based on these results, the thesis recommends designing an integrated TPRM platform that centralizes vendor profiles, enforces a standardized assessment framework, and supports automated re-assessment and real-time monitoring. Vendors would upload a single security profile (covering certificates, policies, and controls) that can be reused across clients, avoiding duplicate questionnaires. The platform should support interoperability so that different tools and rating services can exchange information. For consultants, the implication is to shift from one-time static audits toward an ongoing advisory role within the platform ecosystem, helping interpret automated results and guide process improvements. For policymakers, the thesis suggests providing incentives and guidelines for interoperability and standardization (for example, common questionnaire templates for key vendor categories) to break down silos.

In conclusion, this work shows that automating TPRM under NIS2 is both feasible and highly beneficial. By embedding standardized data flows and machine-assisted analysis into vendor risk processes, organizations can more efficiently meet NIS2’s stringent requirements and improve overall cyber supply-chain resilience. The proposed recommendations automated platform architecture, policy levers for standardization, and a collaborative role for consultants provide a roadmap for practitioners and regulators to reduce manual efforts and strengthen third-party cybersecurity compliance. ... Read more

Courthouses in the Netherlands are grappling with substantial challenges stemming from escalating workloads and high burnout rates among court clerks. This strain not only compromises the well-being of essential judicial personnel but also hinders the overall efficiency and timeliness of the justice system. In response to this pressing issue, this research has delved into the potential application of Large Language Models (LLMs), a form of artificial intelligence like ChatGPT, as a means to alleviate these burdens. In order to investigate the potential of LLMs in the juridical field, the following main question has been drafted:
“How effective is an LLM in lowering the workload of the Dutch court clerks?”
The research employs a mixed research approach. The literature and desk review examines the tasks of the clerks, information about the available LLMs and prompt engineering technique. In addition to this, semi-structured interviews have been held to explore the different tasks of the clerks. Since the scope of this research is only big enough for one task, The task selection process utilized the elimination by aspects technique. After this, a targeted experiment has been conducted to analyse and evaluate the possible LLMs and select the most suitable model for this research. The effectiveness of the LLM-based prompt support have been evaluated using a mixed-methods approach, combining quantitative and qualitative data analysis, which are a within-subject experiment, semi-structured interviews, DeepEval Evaluation, expert evaluation, and a statistical analysis.
The results and the conclusion of this research are still under embargo.
... Read more

Visual Studio Code (VS Code) has become the dominant development environment worldwide, used by the majority of software professionals. Its success largely stems from its highly extensible architecture, supported by an extensive marketplace hosting more than 100,000 extensions that allow developers to tailor their workflows. However, recent research and industry investigations have revealed that these extensions can be exploited to execute arbitrary code, exfiltrate data, or compromise build environments.

Despite growing attention to these technical threats, little is known about how such risks are perceived and managed within organizational settings, where developer autonomy intersects with organizational governance and policy. Using a qualitative approach, interviews were conducted with 21 professionals from 19 companies across five countries to explore how developers perceive and manage the security of VS Code extensions in organizational contexts.

The findings reveal that extension management practices are largely convenience-driven, with developers relying on surface-level Marketplace signals, such as publisher verification, ratings, and download counts, that can easily be manipulated, as shown in prior research. These cues provide reassurance but not assurance, leading developers to conflate popularity or verified status with safety. In most organizations, extension governance is minimal or informal, resulting in fragmented practices where developers must independently assess security risks despite operating in managed environments.

The study concludes that secure extension use in VS Code is not merely a technical issue but a socio-technical and governance challenge that requires coordination across multiple levels. At the marketplace level, clearer communication of verification criteria, greater visibility of permissions or a modified permission model, and stronger mechanisms for signaling risk are needed. At the organizational level, structured allowlist policies, internal vetting workflows, and targeted awareness programs can bridge the gap between platform safeguards and developer behavior. At the developer level, improved understanding and interpretation of trust cues should be supported, not assumed, through organizational policy and education. Together, these measures align platform design, organizational governance, and developer practice toward a shared framework of accountability and safer extension use within professional environments.
... Read more

As digitalization advances, cybersecurity departments are increasingly overwhelmed by alerts and potential threats, leading to decision fatigue among security analysts. In response, many are adopting Artificial Intelligence (AI) to automate routine tasks, prioritize alerts, and accelerate incident response. However, the pace of AI adoption in cybersecurity lags behind that of threat actors, revealing underlying challenges. This thesis explores these challenges through a case study of a large European bank's cybersecurity department, using a sociotechnical systems (STS) approach. Semi-structured interviews with security analysts, data scientists, and leadership revealed four key themes: (1) mixed perceptions of AI, (2) the influence of organizational factors on AI adoption, (3) the importance of interdisciplinary collaboration, and (4) the critical role of trust in AI systems. While AI offers potential benefits like improved threat detection and reduced decision fatigue, challenges such as data quality issues and lack of transparency persist. Organizational readiness, leadership support, and effective change management are crucial for successful AI integration. Building trust through transparency and active user involvement is essential for adoption. The thesis proposes a conceptual model that addresses these challenges by integrating technical and social factors, offering practical recommendations for enhancing AI adoption in cybersecurity. Future research should expand on these findings through diverse case studies, human-centered AI frameworks, and longitudinal studies to better understand AI’s impact on trust and collaboration in cybersecurity. ... Read more

Organisations are becoming more conscious and deploying more and more security tools to ensure they are adequately protected against cyber-attacks. That means two things: (i) those extra tools inherently augment companies’ attack surface, and (ii) the Security Operations Centre (SOC) gets overwhelmed with the number of false positives those tools generate – leading to attack fatigue. In many cases, the SOC team cannot get through all alerts properly, allowing potential attacks to go unnoticed or be caught much later. Moreover, within a typical CISO organisation, the analysis of “attack” and “defence” data is done somewhat in silos. That means vulnerability data, red-team exercises, and the several available defence tooling data are not looked at as one.

Our work proposes an innovative way to bridge the gap between vulnerability data (CVEs) and security alert data originating from multiple security tools that protect servers using MITRE ATT&CK tactics. That would provide more context to the alerts which would be useful in their classification as attacks or false positives. We use DeBERTa (Decoding-enhanced BERT with Disentangled Attention), a deeplearning state-of-the-art model, to map CVE descriptions to MITRE ATT&CK tactics. Then, we map security alerts to MITRE ATT&CK tactics, which will be used as input to a context-enriched machinelearning model (by CVEs and tactics). That machine-learning model is used to classify security alerts as malicious or benign. We tested our approach using over 5.5 million security alert data combined with red-team exercise attacks and incident response labelling from the company, a large international organization with over 60,000 employees. Our CVE+tactic model (without hyperparameter tuning) detects 64% more true positives than the machine-learning model without that information. In addition, the SOC needs to investigate less than 1400 alerts to catch the red-team attacks in our test set, compared to more than 5500 generated by the model without CVE and tactics. Moreover, assuming a standard response time of 8 minutes per alert, this improved model would save the SOC team up to 550 person hours. That yields a model that catches red-team attacks without overwhelming the SOC with too many false positives. ... Read more

In the modern digital age, software vulnerabilities pose significant threats to security and privacy. These vulnerabilities are weaknesses in software products that can be exploited for malicious purposes. To manage and coordinate information about these vulnerabilities, the Common Vulnerabilities and Exposures (CVE) system is widely used. Although a lot of research has been done on coordinated CVEs, there is less focus on vulnerabilities that did not receive a CVE number. This research aims to estimate the number of vulnerabilities in open-source projects that do not receive CVE identification numbers and are consequently overlooked by the community. The focus of the research is on quantifying the prevalence of security issues in the issue tracker of GitHub projects, examining these security issues to find hidden CVEs and determining their severity based on the CVSS 3.1 scoring methodology. The methods used for the research are data extraction and analysis, transformer-based models for the classification of security issues, and expert validation for CVE identification and severity scoring. The findings of the research reveal crucial insights into the scale and nature of security threats in open-source software. The DeBERTaV3 model fine-tuned on the Chromium dataset demonstrated good performance metrics for the task of classifying security issues, achieving an f1 score of 0.9 with threshold modification. The case-study application of the model on the gRPC project demonstrated that in the issue tracker, 2.4\% of issues have been predicted as being security issues, out of which 52 were validated as CVEs with an average severity score CVSS 3.1 score of 5.3, compared to 11 CVEs attributed to the gRPC project on NVD. These findings suggest a need for revising current practices in vulnerability reporting and management in open-source projects, potentially influencing future security protocols and policies. The results of the study serve as information for the decision-making process of improving the coordinated vulnerability disclosure process in open-source software. An initial intervention suggestion is provided to induce behavior change and incentivize discoverers to disclose sensitive vulnerability information in private communication channels. Future work on understanding the motivations of discoverers to post such sensitive information in public trackers is required to create well-informed and effective policies for coordinated vulnerability disclosure. ... Read more

Generative AI is expected to have a significant impact on how business is done, especially for knowledge-intensive domains. Professional usage amongst knowledge workers is already widespread and many of them believe that LLM use for work will make them more efficient, help them generate ideas, and improve the quality of their work. Yet, the technology comes with numerous potential risks, including job displacement, threats to data privacy, unreliability, cybersecurity risks, and non-compliance with new AI regulation. The decision to adopt LLMs for knowledge work is thus a significant one as organisations must carefully weigh up the benefits and drawbacks that these models present.

Using a qualitative research approach, this study was aimed at exploring employee and organisational perceptions on the benefits and risks of LLM adoption within the Dutch financial sector. This study was conducted in partnership with a global Professional Services Firm and used their existing network of people and clients to conduct interviews with experts who act as advisors to top management in the decision-making process of new technology adoption such as LLMs. 18 semi-structured interviews were done to collect qualitative data. The research question to be answered is:

- How do employees’ and organisations’ perceived benefits and risks of Large Language Models (LLMs) influence financial organisations’ LLM adoption plans?

Exactly half of participants (9/18) said that they use LLMs in their own work while the other half stated that they do not due to a lack of perceived benefits. Microsoft was found to be a significant player in the current adoption of LLMs at Dutch financial institutions with 57% of all LLMs used by participants being owned by the software vendor. The most common LLM use cases were literary and creative in nature and included preparing presentation slides (16%), text generation (12%), email composition (12%), and structuring documents (12%).

The targeted capabilities that organisations would like to achieve with their future adoption plans include helping programmers write better code, analysing help desk conversations, assisting employees via LLM chatbots, and analysing emails to predict customer questions. Employees were most excited about the potential efficiency and productivity gains that LLMs offer for their work (19%), how LLM usage could free up more time for focused, interesting, and fun work (11%), repetitive tasks becoming automated by LLM (8%), the new opportunities that LLMs present (8%) such as new business models, and improvements to customer service (5%). General overlap can be seen between the targeted capabilities of future LLMs to be adopted and employee expectations.

Instead of restricting LLM usage, it is recommended that organisations find ways to incorporate them into their employee workflows by providing clear policies and guidelines. It was found that this approach will be most beneficial to creative and literary workflows like improving writing/grammar/translation, information search, structuring documents, and text generation. To achieve this integration, organisations should write and implement clear usage policies. This will ensure that the benefits of allowing LLM usage at work are enjoyed while mitigating the most important risks. ... Read more

The increasing dependence on technology has made society vulnerable to cyber threats, with ransomware becoming a major concern. The complex nature of the Ransomware-as-a-Service (RaaS) model makes identifying the attackers challenging. Traditional methods often rely on direct indicators, but these may not be readily available or reliable. This research explores the potential of utilizing indirect indicators to improve correlating ransomware attacks to specific threat actors. This results in the formulation of the following research question:

"If and to what extent can the analysis of indirect indicator be utilized to improve correlating ransomware attacks with cyber-threat actors?"

The research employs a mixed research approach. A literature review examines the techniques, indicators, and taxonomies used for attributing cyber-threat actors in general. Additionally, expert interviews explore differences in the attribution of ransomware threat actors compared to general cyber-threat actors. Furthermore, it highlights the need to use indirect indicators in the attribution process of ransomware threat actors. Therefore, a cybersecurity company's 2023 ransomware incident reports are analysed to understand how the ransomware attacks are investigated and how the conclusions are drawn.

This study identifies differences in attributing ransomware and general cyber-threat actors. While indirect indicators are crucial for attributing general cyber-threat actors, ransomware attackers often directly identify themselves through ransomware notes. These notes often provide access to communication channels and leak sites, offering substantial evidence for attribution.
The study also finds that Tactics, Techniques, and Procedures (TTPs) tend to be generic in ransomware attacks, offering limited value for differentiating between different actors. However, based on the interviews, there is a need for a central database of observed indirect indicators to facilitate future research and attribution efforts. Consequently, the research finds some promising results for using indirect indicators in ransomware threat actor attribution. The first finding is that the TTPs are less generic as initially thought as 32\% of the techniques and 47\% of the sub-techniques were unique. In addition, analysing the specific tools and techniques used by different actors, such as Blackcat's use of "nltest" for domain trust discovery, can help identify and differentiate them. Furthermore, threat actors observed only once in ransomware attacks of 2023 often used unique techniques, potentially allowing for differentiation based on this factor.

In conclusion, this study demonstrates that analysing indirect indicators can be a valuable tool in correlating ransomware attacks to specific threat actors. While certain limitations exist, continued research and development of this approach have the potential to significantly improve our ability to identify and track ransomware attackers. ... Read more

The internet's infrastructure relies heavily on Autonomous System Numbers (ASNs) for efficient and reliable data routing across complex networks. This thesis investigates the policies governing the allocation and management of ASNs across the five Regional Internet Registries by employing a mixed-method approach, including content analysis, surveys, and interviews. The study examines the potential impacts of recent policy changes, particularly the introduction of maintenance fees at RIPE NCC and APNIC as these fees could disproportionately affect smaller stakeholders.

The research highlights regional differences in ASN policies and the effects on stakeholders. It also explores the broader consequences of these policies for the global internet infrastructure. Based on the findings, several recommendations are proposed to harmonize policies, improve transparency, and ensure that the governance of ASNs remains responsive to the evolving needs of the Internet. The study concludes by addressing the critical balance between financial sustainability for RIRs and the accessibility of resources for diverse stakeholders. ... Read more

Intrusion detection systems (IDSs) are essential for protecting computer systems and networks from malicious attacks. However, IDSs face challenges in dealing with dynamic and imbalanced data, as well as limited label availability. In this thesis, we propose a novel elastic gradient boosting decision tree algorithm, namely Elastic CatBoost Uncertainty (eCBU), that adapts to concept drifts and copes with label scarcity by using a novel sequential uncertainty estimation method. We compare our method with state-of-the-art techniques on synthetic and real-world datasets and show that it achieves comparable accuracy and higher robustness to limited label availability in intrusion detection tasks. ... Read more

Increasing digitalization of systems bring about the grand challenge of keeping these systems secure from malicious prying eyes, and thus highlighting the need for increased Cybersecurity practices. Ransomware is among the most prevalent cybersecurity threats in our current digital era. The attacks are mainly done by advanced persistent threats (ATPs) to increase the impact done to organizations worldwide. Ransomware encrypt data using advanced cryptographic measures and lock users out of their systems to ask for a ransom that is typically paid through bitcoins. ATPs also exfiltrate sensitive data and utilize double and triple extortion methods where they either blackmail the organization with the public release or selling of their data, or they go to the customers to blackmail them, so they pressure the organization into paying the ransom. Defense against Ransomware is possible but in many cases, by the time, ransomware is detected the malicious actors already have strong access into the systems and data. All is not lost however as organizations can bring back their systems and data if there are backup & recovery policies that have been established prior. This thesis systematically explores the ransomware topic scoped on backups & recovery to identify how ransomware attack backups, what are the best practices for backups & recovery, and the corresponding challenges for organizations to produce policy recommendations. To this end, three methods are used. The methods are: semi-systematic literature review, qualitative content analysis, and semi-structured interviews. A triangulation of these methods over cybersecurity frameworks, expert knowledge and backup software provider reports establish essential insights. The main recommendations made are that organizations must ensure that they regularly must create redundant, airgapped, offline, and offsite backups that are stored in multiple storage media. Furthermore organizations must establish proper cyber hygiene practices in order to protect their backups. Lastly, organizations must ensure that they can test and maintain resilient backup & recovery policies through establishing responsibility and accountability of different stakeholders, streamlining their IT environments, and having a cybersecurity-enabling approach to organizational IT governance. The research is a rigorous and comprehensive overview of the backup & recovery topic against ransomware and is academically relevant as it fills research gaps on: how ransomware attacks target backups & recovery specifically, what the best practices offered by the most credible cybersecurity frameworks are, and why organizations still fail in setting up proper backup & recovery practices. The EPA relevance is characterized through navigating a branch of the grand challenge of cybersecurity, namely ransomware. This is a grand challenge as there are a plethora of stakeholders on an organizational level who have different opinions and views on the topic at hand where organizations are comprised of teams in different countries, subject to different regulations, etc. Therefore it is essential in this complex environment to see what could be made as policy recommendations for organizations of all levels against the treat of ransomware with respect to backup & recovery practices. ... Read more

The EU Artificial Intelligence Act (AI Act) proposed by the European Commission is a significant legislative effort to regulate AI systems. It is the first legal framework that specifically addresses the risks associated with AI systems, aiming to ensure their trustworthiness and alignment with the values enshrined in the Charter of the Fundamental Rights of the EU and the Union values. Thus, the draft of the AI Act emphasizes the importance of fundamental rights in Europe's AI approach.

The AI Act covers various AI applications, including machine learning, logical, statistical, and knowledge-based approaches. It provides a classification framework based on the purpose and risks posed by AI applications: Prohibited/Unacceptable risk, High-Risk, Limited-Risk, and Minimal/No risk. However, there are concerns about the clarity of the classification criteria mentioned in the AI Act. Some AI systems may fall into multiple classifications, leading to ambiguity. For example, a social robot used in patient treatment could be classified as High-Risk or Limited-Risk. This ambiguity is also observed in classifying AI systems in enterprise functions, where 40{\%} of the classifications remain unclear.

Therefore, these challenges provide an opportunity to improve the classification process of AI systems under the AI Act, facilitating the classification process and accommodating emerging AI technologies. The main research question addressed in this thesis is: \textbf{"To what extent can the process of AI systems classification under the AI Act be improved?"}

The research focuses specifically on AI systems classification. It explores specific provisions of the AI Act, including Prohibited Risk, Classification Rules for High-Risk AI systems, Transparency Obligations, and Annexes II and III.

To achieve the objective of improving the classification accuracy of AI systems based on the AI Act, the study adopts the Design Science Methodology. This methodology involves systematically studying existing AI systems classifications and challenges, extracting themes to develop a framework, and evaluating the framework through feedback from AI experts.

A decision tree is designed as the proposed framework. It is evaluated on 16 respondents from two different backgrounds: legal and non-legal. In order to obtain comprehensive insights, the evaluation is designed to incorporate an experiment where respondents are tasked to classify AI systems to the risk level with the AI Act only. Then in the second experiment, they have to classify AI systems using the proposed decision tree framework. It is important to note that the study acknowledges the possibility of overestimating or underestimating respondents' ability to classify AI systems due to their diverse backgrounds and levels of understanding of the AI Act. Furthermore, a semi-structured interview is conducted to strengthen the analysis.

Based on the evaluation, the decision tree's performance revealed higher accuracy than the classification approach without the decision tree. However, the overall accuracy remained low, indicating room for improvement. Challenges identified include the need for additional context and understanding of terms, definitions, and examples in the decision tree and the potential for misclassification due to vague definitions and assumptions. Respondents also expressed the need for more detailed information about AI system use cases to improve classification accuracy.

The decision tree's performance varied between obvious and non-obvious use cases, with non-obvious cases presenting challenges in accurate classification. The accuracy for obvious cases was higher, highlighting the difficulty of distinguishing between High-Risk and Unacceptable Risk categories. Lack of clarity in terms and definitions and limited contextual information contributed to the challenges faced in classifying non-obvious cases.

Legal experts demonstrated higher accuracy than non-legal respondents, indicating familiarity with legal terminology and the AI Act. However, legal and non-legal respondents encountered difficulties classifying non-obvious cases, emphasizing the need for clearer frameworks and tools to enhance clarity and streamline the classification process. Greater clarity in the AI Act and an interdisciplinary approach were recommended to address these challenges and facilitate understanding of the risks associated with AI systems.

Based on the analysis, several areas for improving AI systems classification under the AI Act have been identified. The current classification process faces challenges related to ambiguities in definitions, lack of contextual information, and difficulties in distinguishing between different risk levels.

To address these challenges and enhance the classification process, it is recommended to introduce clearer guidelines and refine the decision tree used for classification. The decision tree should incorporate additional criteria and features that provide more clarity and context. It is important to consider biases, subjective interpretations, clarity, and the dynamic nature of AI technologies in these improvements.

The study has certain limitations. The small sample size of respondents may impact the generalizability of the findings. The number of participants might not be representative of the entire population. Additionally, the limited number of use cases utilized in the research may limit the comprehensiveness of the classification framework. The study is based on the latest amendment of a policy proposal, and there is a potential for changes in the regulation's details, which may affect the effectiveness of the results. Finally, potential biases may exist in the development of the research, such as in making the decision tree and selecting the use cases.

Future research should explore the continuity of the decision tree's performance over time and its evaluation. There should be more research on non-obvious cases in specific domains or industries. It is crucial to focus on potential issues in classifying certain risk levels in the AI Act that hinder classification accuracy. Understanding the differences between legal and non-legal perspectives on the AI Act is also important to establish standardized understanding among stakeholders. Additionally, conducting quantitative research with larger and more diverse respondents from industrial backgrounds can further evaluate the proposed framework. ... Read more

Phishing attacks are a growing cause of cybersecurity incidents such as data breaches. With these attacks, malicious actors try to gain access to systems by exploiting the vulnerability of employees. Particularly, intruders use different tricks to create convincing phishing emails to force people to behave less securely. Unfortunately, technological applications are insufficient in detecting all possible phishing attempts. As the consequences of a successful breach can be disastrous for a company, especially in the banking sector, pressure is put on employees to recognise and report potential phishing emails. To aid them in this task, phishing training is provided by employers. Employees are taught what phishing emails look like and which actions they should take if an email appears malicious. However, the effectiveness of these training sessions is difficult to evaluate.

To understand the interaction of employees with phishing emails without influencing their behaviour, we study the emails employees report as suspicious to characterise the security culture at a bank. A better understanding of the behaviour provides grounds for recommendations to improve anti-phishing training and create a safer environment. The newfound metrics can provide an alternative to current methods.

This research uses Exploratory Data Analysis (EDA) to evaluate the email reporting behaviour of employees at a bank to answer the Research Question How can email reporting patterns in a large organisation measure the relationship between phishing training, reported emails and employee behaviour? With this case study, we apply EDA to a large dataset containing bank employees' reported emails over 16 months. We analysed the reported emails and related them to the provided phishing training events. Moreover, we did a text analysis of the emails' content using the Term Frequency - Inverse Document Frequency (TF-IDF) method. Additionally, we extract the dominant topics of the emails using topic modelling. Lastly, with the help of interviews, the results are tied to employees' experiences to understand their behaviour.

The major findings of the research are, firstly, the new metrics we identified to measure the security culture of a company. These metrics were found from both the analysis of employee behaviour over time, as well as the analysis of the email content. From the analysis of the reporting behaviour over time, new metrics include the unique reporters in relation to the total reported emails over time. Besides the unique reporters, unique reported emails can uncover the presence of campaigns. For example, a single email can explain the increase from 50 to 350 daily benign reports. The difference between the total reports and unique reports uncovered this. Secondly, topic analysis and content comparison show similarities between benign and malicious reported emails, indicating an increased vigilance of employees on these attributes.

A second finding originates from the analysis of the email components. One of the components was used in all simulation emails, while it was not present in all the benign and malicious reported emails. This shows that the simulation emails can be extended to include different scenarios. Therefore, we recommend the company to extend the phishing simulation emails to contain varied phishing tactics to expose employees to other types of attacks and incorporate all aspects taught during the E-learning.

Lastly, the analysis shows no concrete relation between the number of reported emails and the timing of the simulation wave. Although the reported p-value of benign emails after the simulation is 0.03, this significance can also be explained by external factors.

With these results, we can measure employees' security culture and awareness in real-world circumstances without influencing the employees' behaviour, providing a new approach to investigating phishing behaviour. Adding to the research of Steves et al. (2020),, the click rates can be explained by more than solely the employees' awareness levels, and new explanations come forward to handle phishing threats. Moreover, the absence of a required test environment for the analysis created a solution for existing gaps. For example, as seen in (Hillman et al., 2023).

A limitation of exploratory data analysis is that results are often ambiguous and mainly provide possible directions for future research. Furthermore, external factors influencing the behaviour could provide alternative reasons for the discussed interactions.

To conclude, by using the reported emails to measure security behaviour related to phishing, we found new metrics which do not influence the employees in their daily behaviour while still providing insights to improve the tactics of a company in combating phishing attacks. Reporting behaviour can be used to analyse the current anti-phishing tactics of a company and provide suggestions for improvements.

Future research should explore the differences in applying the method in other companies and across sectors. Overlap and differences can create an understanding of the diversity in security culture and the effect of external factors. Combining these results with a comprehensive understanding of a company's operations can expose directions for improvement in the security approach. Additionally, the effect of the recommendations can be analysed using the metrics we proposed. This can be done with a follow-up analysis of the behaviour to see whether the desired effect can be observed. ... Read more

With the ever-increasing digitalisation of society and the explosion of internet-enabled devices with the Internet of Things (IoT), keeping services and devices secure is becoming more important. Logs play a critical role in sustaining system reliability. Manual analysis of logs has become increasingly difficult, accelerating the development of automated methods for log-anomaly detection. Despite significant progress in automating log analysis, current state-of-the-art methods face challenges dealing with unstable log data, which means that the content of log messages evolves over time.

We show that LogBERT, a state-of-the-art technique based on Bidirectional Encoder Representations from Transformers (BERT), cannot deal with unstable log data. On the three most prevalent publicly available log datasets, Mathew's Correlation Coefficient (MCC) score (which measures the correlation between a model's output and the correct labels) of LogBERT dropped by 90% after increasing log data instability from 1% to over 80% normal sequences containing logkeys in the test set. Log data instability was increased by only reassigning samples between the train and test set. Furthermore, we show that the high performance of LogBERT reported in the original paper was achieved because the model relied on a simple heuristic that only worked under specific conditions.
To address this issue, we propose a novel sequence anomaly detection technique based on BERT: Vocabulary-Free BERT (VoBERT). VoBERT uses a novel pre-training task we designed specifically for anomaly detection: Vocabulary-Free Masked Language Modeling (VF-MLM). We adapted traditional MLM and removed the fixed vocabulary constraint, which allows VF-MLM to classify out-of-vocabulary logkeys correctly.
We highlight that VoBERT is more stable than LogBERT and outperforms the latter in certain situations where log data is very unstable. For the public datasets, the MCC score of the specific train-test split used in the LogBERT paper dropped by 90% after reassigning the train-test split, increasing log data instability. In addition to sequence-level anomaly predictions, we evaluated all approaches on element level, providing a more granular performance assessment.
To assess the generalisation of the experimental results to real-world scenarios, we conducted a case study evaluating the anomaly detection models on real-world security event data collected at a large bank (50,000+ employees). We found that the simple heuristic did not work for this real-world data, having a negative correlation with the correct results. VoBERT showed performance on par with LogBERT on this real-world security event dataset.
We urge future researchers to evaluate their methods on real-world data, as we showed that the commonly used public datasets do not represent real-world scenarios. Furthermore, it is important to assess how difficult it is to detect anomalies in datasets used for evaluation. When a simple heuristic can perform well, such datasets might not be well suited to evaluate a complex anomaly detection model.
This thesis is a proof of concept for the novel pre-training task VF-MLM and paves the way for future work to refine this technique further, as well as to develop additional robust and adaptable solutions for log and security event anomaly detection. ... Read more