Search results
1 – 3 of 3Robin Mueller, Sebastian Schrittwieser, Peter Fruehwirt, Peter Kieseberg and Edgar Weippl
This paper aims to give an overview on a number of selected applications in comparison to a previous evaluation conducted two years ago, as well as performing an analysis on…
Abstract
Purpose
This paper aims to give an overview on a number of selected applications in comparison to a previous evaluation conducted two years ago, as well as performing an analysis on several new applications. Mobile messaging and VoIP applications for smartphones have seen a massive surge in popularity, which has also sparked the interest in research related to their security and privacy protection, leading to in-depth analyses of specific applications or vulnerabilities.
Design/methodology/approach
The evaluation methods mostly focus on known vulnerabilities in connection with authentication and validation mechanisms but also describe some newly identified attack vectors.
Findings
The results show a positive trend for new applications, which are mostly being developed with security and privacy features, whereas some of the older applications have shown little progress or have even introduced new vulnerabilities. In addition, this paper shows privacy implications of smartphone messaging that are not even solved by today’s most sophisticated “secure” smartphone messaging applications, as well as discusses methods for protecting user privacy during the creation of the user network.
Research limitations/implications
Currently, there is no perfect solution available; thus, further research on this topic needs to be conducted.
Originality/value
In addition to conducting a security evaluation of existing applications together with newly designed messengers that were designed with a security background in mind, several methods for protecting user privacy were discussed. Furthermore, some new attack vectors were discussed.
Details
Keywords
Peter Kieseberg, Sebastian Schrittwieser, Lorcan Morgan, Martin Mulazzani, Markus Huber and Edgar Weippl
Today's database management systems implement sophisticated access control mechanisms to prevent unauthorized access and modifications. For instance, this is an important basic…
Abstract
Purpose
Today's database management systems implement sophisticated access control mechanisms to prevent unauthorized access and modifications. For instance, this is an important basic requirement for SOX (Sarbanes‐Oxley Act) compliance, whereby every past transaction has to be traceable at any time. However, malicious database administrators may still be able to bypass the security mechanisms in order to make hidden modifications to the database. This paper aims to address these issues.
Design/methodology/approach
In this paper the authors define a novel signature of a B+‐tree, a widely‐used storage structure in database management systems, and propose its utilization for supporting the logging in databases. This additional logging mechanism is especially useful in conjunction with forensic techniques that directly target the underlying tree‐structure of an index. Several techniques for applying this signature in the context of digital forensics on B+‐trees are proposed in the course of this paper. Furthermore, the authors' signature can be used to generate exact copies of an index for backup purposes, thereby enabling the owner to completely restore data, even on the structural level.
Findings
For database systems in enterprise environments, compliance to regulatory standards such as SOX (Sarbanes‐Oxley Act), whereby every past transaction has to be traceable at any time, is a fundamental requirement. Today's database management systems usually implement sophisticated access control mechanisms to prevent unauthorized access and modifications. Nonetheless malicious database administrators would be able to bypass the security mechanisms in order to make modifications to the database, while covering their tracks.
Originality/value
In this paper, the authors demonstrate how the tree structure of the underlying store engine can be used to enhance forensic logging mechanisms of the database. They define a novel signature for B+‐trees, which are used by the InnoDB storage engine. This signature stores the structure of database storage files and can help in reconstructing previous versions of the file for forensic purposes. Furthermore, the authors' signature can be used to generate exact copies of an index for backup purposes, thus enabling the owner to completely restore data, even on the structural level. The authors applied their concept to four real‐life scenarios in order to evaluate its effectiveness.
Details
Keywords
The growth of the internet, access to technology and rapid digital transformations have paved the way for developing attack surfaces for individuals and organizations. There is a…
Abstract
Purpose
The growth of the internet, access to technology and rapid digital transformations have paved the way for developing attack surfaces for individuals and organizations. There is a dire need to provide cybersecurity awareness most effectively. Gamification-based platforms have evolved to make cybersecurity education more engaging and effective. This study explores the gamification platforms available for cybersecurity training and awareness, the extent to which they are used and their benefits and challenges.
Design/methodology/approach
PRISMA 2020 was used to conduct the systematic literature review.
Findings
The study comprehends the game design elements and their role in the effectiveness of cybersecurity training and awareness. The study unveils that traditional education methodologies are insignificant in cybersecurity awareness, and gamification-based platforms are more beneficial. The paper summarizes the implications of the findings and further postulates future research directions.
Originality/value
This work comprehends the various forms of gamification platforms and frameworks available for cybersecurity training and will motivate further development of gamification platforms. This paper will help academia, private and public organizations and game designers enhance their gamification-based cybersecurity education interventions.
Details