Interdisciplinary Research Group in Socio-technical CybersecurityFormal Security Analysis of Traditional and Electronic ExamsJannik Dreier, Rosario Giustolisi, Ali Kassem, Pascal Lafourcade, Gabriele Lenzini, Peter Y. A. RyanAbstract:Nowadays, students can be assessed not only by means of pencil-and-paper tests, but also by electronic exams which they take in examination centers or even from home. Electronic exams are … Continued

Interdisciplinary Research Group in Socio-technical CybersecurityIn Cyber-Space No One Can Hear You S·CREAM, A Root Cause Analysis for Socio-Technical SecurityAna Ferreira, Jean-Louis Huynen, Vincent Koenig, Gabriele LenziniAbstract:Inspired by the root cause analysis techniques that in the field of safety research and practice help investigators understand the reasons of an incident, this paper investigates the use … Continued

Interdisciplinary Research Group in Socio-technical CybersecurityDo Graphical Cues Effectively Inform Users? A Socio-Technical Security Study in Accessing Wifi NetworksAna Ferreira, Jean-Louis Huynen, Vincent Koenig, Gabriele Lenzini, Salvador RivasAbstract:We study whether the padlock and the signal strength bars, two visual cues shown in network managers, convey their intended messages. Since users often choose insecure networks when … Continued

Interdisciplinary Research Group in Socio-technical CybersecurityAn Analysis of Social Engineering Principles in Effective PhishingAna Ferreira, Gabriele LenziniAbstract:Phishing is a widespread practice and a lucrative business. It is invasive and hard to stop: a company needs to worry about all emails that all employees receive, while an attacker only needs to have a response from a … Continued

Interdisciplinary Research Group in Socio-technical CybersecurityPrinciples of Persuasion in Social Engineering and Their Use in PhishingAna Ferreira, Lynne Coventry, Gabriele LenziniAbstract:Research on marketing and deception has identified principles of persuasion that influence human decisions. However, this research is scattered: it focuses on specific contexts and produces different taxonomies. In regard to frauds and scams, three … Continued

Interdisciplinary Research Group in Socio-technical CybersecurityCan Transparency Enhancing Tools support patient’s accessing Electronic Health Records?Ana Ferreira, Gabriele LenziniAbstract:Patients that access their health records take more care of their health and, when in therapy, commit more seriously to improve their condition. This leads to a more effective and more efficient healthcare management, and is also in … Continued

Interdisciplinary Research Group in Socio-technical CybersecuritySecurity analysis of socio-technical physical systemsGabriele Lenzini, Sjouke Mauwa, Samir OuchaniAbstract:Recent initiatives that evaluate the security of physical systems with objects as assets and people as agents – here called socio-technical physical systems – have limitations: their agent behavior is too simple, they just estimate feasibility and not the likelihood … Continued

Interdisciplinary Research Group in Socio-technical CybersecurityGenerating attacks in SysML activity diagrams by detecting attack surfacesSamir Ouchani, Gabriele Lenzini Abstract:In the development process of a secure system is essential to detect as early as possible the system’s vulnerable points, the so called attack surfaces, and to estimate how feasible it would be that known attacks breach … Continued

Interdisciplinary Research Group in Socio-technical CybersecuritySecurity on medical data sharing (a literature review)Dayana Spagnuelo, Gabriele LenziniAbstract:Medical records (e.g., test results and health reports) are about patients. Hospitals and healthcare institutions generate them after a patient’s visit. Today they are digitized, stored electronically, and accessed remotely by professionals. European directives suggest that patients should access these … Continued

Interdisciplinary Research Group in Socio-technical CybersecurityA Socio-Technical Methodology for the Security and Privacy Analysis of ServicesGiampaolo Bella, Paul Curzon, Rosario Giustolisi, Gabriele LenziniAbstract:There is a widely accepted need for methodologies to verify the security of services. A typical service requires user data and then makes them available through the Internet independently from access platforms or … Continued