Physical Sciences and Mathematics Commons^™

Cloud Container Security’ Next Move, Vishakha Sadhwani

Dissertations and Theses

In the last few years, it is apparent to cybersecurity experts everywhere that the proverbial container tech genie is out of the bottle, and has been widely embraced across multiple organizations. To achieve the flexibility of building and deploying applications anywhere and everywhere, cloud native environments have gained great momentum and made the development lifecycle simpler than ever. However, container environments brings with them a range of cybersecurity issues that includes images, containers, hosts, runtimes, registries, and orchestration platforms, which needs the necessity to focus on investing in securing your container stack.

According to this report[1], released by cloud-native …

Addressing Human Error Through Effective Cyber Policy Design, Katherine Amoresano

Emergency Preparedness, Homeland Security, and Cybersecurity

Human error is a significant contributing factor to the rise in Cybersecurity attacks regardless of increased technical control implemented to safeguard Information systems. Adversaries can circumvent technical safeguards due to human errors which result from inadequate enforceable policies and training on Cybersecurity for the everyday user. Several studies and articles show that the majority of successful attacks are human enabled, proving the need for human-centric cybersecurity research and practices. This exploratory work reviews the human aspect of Cybersecurity by investigating the cybersecurity policies at SUNY Albany and other SUNY institutions. We used a survey of students and faculty members at …

A Relevance Model For Threat-Centric Ranking Of Cybersecurity Vulnerabilities, Corren G. Mccoy

Computer Science Theses & Dissertations

The relentless and often haphazard process of tracking and remediating vulnerabilities is a top concern for cybersecurity professionals. The key challenge they face is trying to identify a remediation scheme specific to in-house, organizational objectives. Without a strategy, the result is a patchwork of fixes applied to a tide of vulnerabilities, any one of which could be the single point of failure in an otherwise formidable defense. This means one of the biggest challenges in vulnerability management relates to prioritization. Given that so few vulnerabilities are a focus of real-world attacks, a practical remediation strategy is to identify vulnerabilities likely …

Cyber Resilience Analytics For Cyber-Physical Systems, Md Ariful Haque

Electrical & Computer Engineering Theses & Dissertations

Cyber-physical systems (CPSs) are complex systems that evolve from the integrations of components dealing with physical processes and real-time computations, along with networking. CPSs often incorporate approaches merging from different scientific fields such as embedded systems, control systems, operational technology, information technology systems (ITS), and cybernetics. Today critical infrastructures (CIs) (e.g., energy systems, electric grids, etc.) and other CPSs (e.g., manufacturing industries, autonomous transportation systems, etc.) are experiencing challenges in dealing with cyberattacks. Major cybersecurity concerns are rising around CPSs because of their ever-growing use of information technology based automation. Often the security concerns are limited to probability-based possible attack …

Software Protection And Secure Authentication For Autonomous Vehicular Cloud Computing, Muhammad Hataba

Dissertations

Artificial Intelligence (AI) is changing every technology we deal with. Autonomy has been a sought-after goal in vehicles, and now more than ever we are very close to that goal. Vehicles before were dumb mechanical devices, now they are becoming smart, computerized, and connected coined as Autonomous Vehicles (AVs). Moreover, researchers found a way to make more use of these enormous capabilities and introduced Autonomous Vehicles Cloud Computing (AVCC). In these platforms, vehicles can lend their unused resources and sensory data to join AVCC.

In this dissertation, we investigate security and privacy issues in AVCC. As background, we built our …

Supporting The Discovery, Reuse, And Validation Of Cybersecurity Requirements At The Early Stages Of The Software Development Lifecycle, Jessica Antonia Steinmann

Doctoral Dissertations and Master's Theses

The focus of this research is to develop an approach that enhances the elicitation and specification of reusable cybersecurity requirements. Cybersecurity has become a global concern as cyber-attacks are projected to cost damages totaling more than $10.5 trillion dollars by 2025. Cybersecurity requirements are more challenging to elicit than other requirements because they are nonfunctional requirements that requires cybersecurity expertise and knowledge of the proposed system. The goal of this research is to generate cybersecurity requirements based on knowledge acquired from requirements elicitation and analysis activities, to provide cybersecurity specifications without requiring the specialized knowledge of a cybersecurity expert, and …

Development Of A Security-Focused Multi-Channel Communication Protocol And Associated Quality Of Secure Service (Qoss) Metrics, Paul M. Simon

Theses and Dissertations

The threat of eavesdropping, and the challenge of recognizing and correcting for corrupted or suppressed information in communication systems is a consistent challenge. Effectively managing protection mechanisms requires an ability to accurately gauge the likelihood or severity of a threat, and adapt the security features available in a system to mitigate the threat. This research focuses on the design and development of a security-focused communication protocol at the session-layer based on a re-prioritized communication architecture model and associated metrics. From a probabilistic model that considers data leakage and data corruption as surrogates for breaches of confidentiality and integrity, a set …

Cyber Deception For Critical Infrastructure Resiliency, Md Ali Reza Al Amin

Computational Modeling & Simulation Engineering Theses & Dissertations

The high connectivity of modern cyber networks and devices has brought many improvements to the functionality and efficiency of networked systems. Unfortunately, these benefits have come with many new entry points for attackers, making systems much more vulnerable to intrusions. Thus, it is critically important to protect cyber infrastructure against cyber attacks. The static nature of cyber infrastructure leads to adversaries performing reconnaissance activities and identifying potential threats. Threats related to software vulnerabilities can be mitigated upon discovering a vulnerability and-, developing and releasing a patch to remove the vulnerability. Unfortunately, the period between discovering a vulnerability and applying a …

Predictors Of Email Response: Determinants Of The Intention Of Not Following Security Recommendations, Miguel Angel Toro-Jarrin

Engineering Management & Systems Engineering Theses & Dissertations

Organizations and government leaders are concerned about cyber incidents. For some time, researchers have studied what motivates people to act in ways that put the confidentiality, integrity, and availability of information in organizations at risk. Still, several areas remained unexplored, including the role of employees’ evaluation of the organizational systems and the role of value orientation at work as precursors of secure and insecure actions in relation to information technologies (information security [IS] action). The objective of this research project was to examine how the evaluations of formal and informal security norms are associated with the intention to follow them …

Adaptive Pedagogy Framework For Risk Management, Incident Response And Disaster Recovery Education, Hsiao-An Wang

Dissertations (1934 -)

The field of Cybersecurity, both in cybersecurity education and cybersecurity workforce demands, has been growing steadily as the dangers of cyber-threats continue to rise. The gap between the supply and demand of the cybersecurity workforce has been widening throughout the past decade. In response to the increased demand, many government agencies have actively engaged in collaborative efforts with higher education institutions to produce more capable graduates to address the need. However, with the various educational utilities available to instructors, few utilities offer content related to risk management, incident response, and disaster recovery practices. Furthermore, many students lack the awareness to …

Investigation Of Python Variable Privacy, Joshua Bartholomew

Honors Theses

This study looks at the relative security of Python regarding private variables and functions used in most other programming languages. Python has only grown in popularity due to its simple syntax and developing capabilities. However, little research has been published about how secure Python code and programs compiled from Python code actually are. This research seeks to expose vulnerabilities in Python code and determine what must be done for these vulnerabilities to be exploited by hackers to abuse potentially sensitive information contained within the program.

The proposed methodology includes examining the private variable concept in other programming languages and conducting …

Demonstration Of Cyberattacks And Mitigation Of Vulnerabilities In A Webserver Interface For A Cybersecure Power Router, Benjamin Allen

Computer Science and Computer Engineering Undergraduate Honors Theses

Cyberattacks are a threat to critical infrastructure, which must be secured against them to ensure continued operation. A defense-in-depth approach is necessary to secure all layers of a smart-grid system and contain the impact of any exploited vulnerabilities. In this undergraduate thesis a webserver interface for smart-grid devices communicating over Modbus TCP was developed and exposed to SQL Injection attacks and Cross-Site Scripting attacks. Analysis was performed on Supply-Chain attacks and a mitigation developed for attacks stemming from compromised Content Delivery Networks. All attempted attacks were unable to exploit vulnerabilities in the webserver due to its use of input sanitization …

Malware And Memory Forensics On M1 Macs, Charles E. Glass

LSU Master's Theses

As malware continues to evolve, infection mechanisms that can only be seen in memory are increasingly commonplace. These techniques evade traditional forensic analysis, requiring the use of memory forensics. Memory forensics allows for the recovery of historical data created by running malware, including information that it tries to hide. Memory analysis capabilities have lagged behind on Apple's new M1 architecture while the number of malicious programs only grows. To make matters worse, Apple has developed Rosetta 2, the translation layer for running x86_64 binaries on an M1 Mac. As a result, all malware compiled for Intel Macs is theoretically functional …

Securing Infiniband Networks With End-Point Encryption, Noah B. Diamond

Theses and Dissertations

The NVIDIA-Mellanox Bluefield-2 is a 100 Gbps high-performance network interface which offers hardware offload and acceleration features that can operate directly on network traffic without routine involvement from the ARM CPU. This allows the ARM multi-core CPU to orchestrate the hardware to perform operations on both Ethernet and RDMA traffic at high rates rather than processing all the traffic directly. A testbed called TNAP was created for performance testing and a MiTM verification process called MiTMVMP is used to ensure proper network configuration. The hardware accelerators of the Bluefield-2 support a throughput of nearly 86 Gbps when using IPsec to …

Experimental Study To Assess The Role Of Environment And Device Type On The Success Of Social Engineering Attacks: The Case Of Judgment Errors, Tommy Pollock

CCE Theses and Dissertations

Phishing continues to be an invasive threat to computer and mobile device users. Cybercriminals continuously develop new phishing schemes using e-mail and malicious search engine links to gather the personal information of unsuspecting users. This information is used for financial gains through identity theft schemes or draining victims' financial accounts. Many users of varying demographic backgrounds fall victim to phishing schemes at one time or another. Users are often distracted and fail to process the phishing attempts fully, then unknowingly fall victim to the scam until much later. Users operating mobile phones and computers are likely to make judgment errors …

A Universal Cybersecurity Competency Framework For Organizational Users, Patricia A. Baker

CCE Theses and Dissertations

The global reliance on the Internet to facilitate organizational operations necessitates further investments in organizational information security. Such investments hold the potential for protecting information assets from cybercriminals. To assist organizations with their information security, The National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework (NCWF) was created. The framework referenced the cybersecurity work, knowledge, and skills required to competently complete the tasks that strengthen their information security. Organizational users’ limited cybersecurity competency contributes to the financial and information losses suffered by organizations year after year. While most organizational users may be able to respond positively to a cybersecurity threat, …

Strategies For The Reduction Of Cybersecurity Breaches In Hospitals, Donovan M. A. Pottinger

Walden Dissertations and Doctoral Studies

AbstractRecent cyberattacks in hospitals show the urgency of the need to enhance secure information technology (IT) infrastructure. Hospitals are statistically more at cyber risk than all the multiple industries against ransomware, malware, hacking and internal threats. Guided by routine activity theory, the purpose of this exploratory multiple case study was to explore strategies utilized by hospitals' IT security managers to reduce cybersecurity breaches associated with sensitive data. The participants were nine IT security managers from hospitals in the eastern United States. Data were collected via semistructured interviews and supporting documentation from the consenting participants and hospitals' websites. Through thematic analysis, …

Examining Cooperative System Responses Against Grid Integrity Attacks, Alexander D. Parady

Honors Undergraduate Theses

Smart grid technologies are integral to society’s transition to sustainable energy sources, but they do not come without a cost. As the energy sector shifts away from a century’s reliance on fossil fuels and centralized generation, technology that actively monitors and controls every aspect of the power infrastructure has been widely adopted, resulting in a plethora of new vulnerabilities that have already wreaked havoc on critical infrastructure. Integrity attacks that feedback false data through industrial control systems, which result in possible catastrophic overcorrections and ensuing failures, have plagued grid infrastructure over the past several years. This threat is now at …

Zero Trust Architecture, Ahmed Abdullah Syed

All Student Theses

Cyber threats are becoming increasingly sophisticated, and IT organizations need to continue to modernize their approaches to cybersecurity in light of today's dynamic cyber threat environment. Cybersecurity professionals must adopt a zero-trust security model and the mindset needed to engineer and operate a system specifically designed to operate according to zero trust principles in order to ensure the security of sensitive data, systems, and services as enterprise networks become increasingly dispersed and complex.

Impact Of Internal Control, Cybersecurity Risk, And Competitive Advantage On Retail Cybersecurity Budget, Samuel William Pfanstiel

Walden Dissertations and Doctoral Studies

Retail organizations are driven to improve security posture for many reasons, including meeting financial regulation requirements, mitigating threats of data breach, and differentiating themselves within markets affected by customer perception. The problem was that little was known about how these drivers of internal control, cybersecurity risk, and competitive advantage impact retail cybersecurity budgets within the retail sector. The purpose of this quantitative nonexperimental correlational study was to describe the relationship between cybersecurity budget and drivers of internal control, cybersecurity risk, and competitive advantage among U.S.-based retail merchant organizations. Real options theory provided a foundation for explaining this decision-making process. Data …

Strategies For Cybercrime Prevention In Information Technology Businesses, Sophfronia G. Tucker

Walden Dissertations and Doctoral Studies

Cybercrime continues to be a devastating phenomenon, impacting individuals and businesses across the globe. Information technology (IT) businesses need solutions to defend and secure their data and networks from cyberattacks. Grounded in general systems theory and transformational leadership theory, the purpose of this qualitative multiple case study was to explore strategies IT business leaders use to protect their systems from a cyberattack. The participants included six IT business leaders with experience in cybersecurity or system security in the Midlands region of South Carolina. Data were collected using semistructured interviews and reviews of government standards documents; data were analyzed using thematic …

Strategies Business Leaders Use To Mitigate Online Credit Card Fraud, Clarissa Rosario-Tavarez

Walden Dissertations and Doctoral Studies

Online credit card fraud targeting banks, customers, and businesses costs millions of U.S. dollars annually. Online business leaders face challenges securing and regulating the online payment processing environment. Grounded in the situational crime prevention theory, the purpose of this qualitative multiple case study was to explore strategies online business leaders use to mitigate the loss of revenue caused by online credit card fraud. The participants comprised five online business leaders of an organization in the Southwest of the United States, who implemented strategies that successfully mitigated revenue losses due to online credit card fraud. The data were collected from semistructured …

Enhancing Cybersecurity Of Power Systems Using Machine Learning, Fayha Almutairy

Graduate College Dissertations and Theses

The continuous and accelerated digitalization of industries and technologies has made most of our daily activities obtrusively depend on electricity. Consequently, reliable power system operation became the cornerstone of economic sustainability and technological development. Unfortunately, the grown dependency of modern power infrastructure on Information and Communication Technology (ICT) has increased the risks of cyber-attacks. According to the most recent statistics, the electrical power sector is one of the significant fields in the number of cyber-attacks per year. The most devious types of cyber-attacks target the power system state estimation. Realtime state estimation aims to filter out the noise of measurements …

Few-Shot Malware Detection Using A Novel Adversarial Reprogramming Model, Ekula Praveen Kumar

Browse all Theses and Dissertations

The increasing sophistication of malware has made detecting and defending against new strains a major challenge for cybersecurity. One promising approach to this problem is using machine learning techniques that extract representative features and train classification models to detect malware in an early stage. However, training such machine learning-based malware detection models represents a significant challenge that requires a large number of high-quality labeled data samples while it is very costly to obtain them in real-world scenarios. In other words, training machine learning models for malware detection requires the capability to learn from only a few labeled examples. To address …