Interdisciplinary Research Group in Socio-technical CybersecurityMaybe Poor Johnny Really Cannot Encrypt – The Case for a Complexity Theory for Usable SecurityZinaida Benenson, Gabriele Lenzini, Daniela Oliveira, Simon Parkin, Sven UebelackerAbstract:Psychology and neuroscience literature shows the existance of upper bounds on the human capacity for executing cognitive tasks and for information processing. These bounds are where, … Continued

Interdisciplinary Research Group in Socio-technical CybersecurityA Framework for Analyzing Verifiability in Traditional and Electronic ExamsJannik Dreier, Rosario Giustolisi, Ali Kassem, Pascal Lafourcade, Gabriele LenziniAbstract:The main concern for institutions that organize exams is to detect when students cheat. Actually more frauds are possible and even authorities can be dishonest. If institutions wish to keep exams a … Continued

Interdisciplinary Research Group in Socio-technical CybersecurityFormal Security Analysis of Traditional and Electronic ExamsJannik Dreier, Rosario Giustolisi, Ali Kassem, Pascal Lafourcade, Gabriele Lenzini, Peter Y. A. RyanAbstract:Nowadays, students can be assessed not only by means of pencil-and-paper tests, but also by electronic exams which they take in examination centers or even from home. Electronic exams are … Continued

Interdisciplinary Research Group in Socio-technical CybersecurityIn Cyber-Space No One Can Hear You S·CREAM, A Root Cause Analysis for Socio-Technical SecurityAna Ferreira, Jean-Louis Huynen, Vincent Koenig, Gabriele LenziniAbstract:Inspired by the root cause analysis techniques that in the field of safety research and practice help investigators understand the reasons of an incident, this paper investigates the use … Continued

Interdisciplinary Research Group in Socio-technical CybersecurityDo Graphical Cues Effectively Inform Users? A Socio-Technical Security Study in Accessing Wifi NetworksAna Ferreira, Jean-Louis Huynen, Vincent Koenig, Gabriele Lenzini, Salvador RivasAbstract:We study whether the padlock and the signal strength bars, two visual cues shown in network managers, convey their intended messages. Since users often choose insecure networks when … Continued

Interdisciplinary Research Group in Socio-technical CybersecurityAn Analysis of Social Engineering Principles in Effective PhishingAna Ferreira, Gabriele LenziniAbstract:Phishing is a widespread practice and a lucrative business. It is invasive and hard to stop: a company needs to worry about all emails that all employees receive, while an attacker only needs to have a response from a … Continued

Interdisciplinary Research Group in Socio-technical CybersecurityPrinciples of Persuasion in Social Engineering and Their Use in PhishingAna Ferreira, Lynne Coventry, Gabriele LenziniAbstract:Research on marketing and deception has identified principles of persuasion that influence human decisions. However, this research is scattered: it focuses on specific contexts and produces different taxonomies. In regard to frauds and scams, three … Continued

Interdisciplinary Research Group in Socio-technical CybersecurityCan Transparency Enhancing Tools support patient’s accessing Electronic Health Records?Ana Ferreira, Gabriele LenziniAbstract:Patients that access their health records take more care of their health and, when in therapy, commit more seriously to improve their condition. This leads to a more effective and more efficient healthcare management, and is also in … Continued

Interdisciplinary Research Group in Socio-technical CybersecuritySecurity analysis of socio-technical physical systemsGabriele Lenzini, Sjouke Mauwa, Samir OuchaniAbstract:Recent initiatives that evaluate the security of physical systems with objects as assets and people as agents – here called socio-technical physical systems – have limitations: their agent behavior is too simple, they just estimate feasibility and not the likelihood … Continued

Interdisciplinary Research Group in Socio-technical CybersecurityGenerating attacks in SysML activity diagrams by detecting attack surfacesSamir Ouchani, Gabriele Lenzini Abstract:In the development process of a secure system is essential to detect as early as possible the system’s vulnerable points, the so called attack surfaces, and to estimate how feasible it would be that known attacks breach … Continued