Publications
Some of the downloadable files are authors' versions or pre-prints. See also the respective
disclaimers.
Books
- Pape, S.: Authentication in Insecure Environments -- Using Visual Cryptography and Non-Transferable Credentials in Practise. Springer Vieweg, Research , 2014.
![Sebastian Pape discusses two different scenarios for authentication. On the one hand, users cannot trust their devices and nevertheless want to be able to do secure authentication. On the other hand, users may not want to be tracked while their service provider does not want them to share their credentials. Many users may not be able to determine whether their device is trustworthy, i.e. it might contain malware. One solution is to use visual cryptography for authentication. The author generalizes this concept to human decipherable encryption schemes and establishes a relationship to CAPTCHAS. He proposes a new security model and presents the first visual encryption scheme which makes use of noise to complicate the adversary's task. To prevent service providers from keeping their users under surveillance, anonymous credentials may be used. However, sometimes it is desirable to prevent the users from sharing their credentials. The author compares existing approaches based on non-transferable anonymous credentials and proposes an approach which combines biometrics and smartcards. Abstract pape14authentication](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![crypto](/pictures/icon/keyword/crypto.png)
![privacy](/pictures/icon/keyword/privacy.png)
![security](/pictures/icon/keyword/security.png)
- Pape, S.: Sicherheitsmodelle für das Ajtai-Dwork-Kryptosystem: Untersuchungen eines Kryptosystems mit Worst-Case / Average-Case Äquivalenz zum unique Shortest Vector Problem. Vdm Verlag Dr. Müller, 2008.
![](/pictures/icon/blank.png)
![Beim Entwurf von Kryptosystemen versucht man deren Sicherheit mittels Reduktionen auf gewisse mathematische Basisprobleme zu gründen. Wer das Kryptosystem brechen kann ist damit auch in der Lage, das Basisproblem zu lösen. Wird dem Angreifer nicht zugestanden, das Basisproblem zu lösen, gilt das Kryptosystem als sicher. Ein Problem dieser Beweisführung ist jedoch, dass Basisprobleme meist nur im Allgemeinen schwer sind. Bei der Reduktion von Kryptosystemen treten jedoch typischerweise durchschnittliche Probleminstanzen auf, die unter Umständen sehr viel leichter zu lösen sind. Deshalb erregte das Public-Key Kryptosystem von Ajtai und Dwork einiges an Aufsehen. Ihnen war es erstmals gelungen, eine Worst-Case / Average-Case Äquivalenz zwischen dem Kryptosystem und dem zugrunde liegenden Basisproblem zu zeigen. Ajtai und Dwork beschränkten sich allerdings auf den Reduktionsbeweis. Eine formalere Beschreibung der Annahmen über die Fähigkeiten und Absichten eines potentiellen Angreifers liefern Sicherheitsmodelle. In diesem Buch wird daher untersucht, in welchen Sicherheitsmodellen das Ajtai-Dwork-Kryptosystem als sicher gelten kann. Abstract pape08ajtai-dwork](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![crypto](/pictures/icon/keyword/crypto.png)
Journal Articles
- Harborth, D. and Pape, S.: Investigating Privacy Concerns Related to Mobile Augmented Reality Apps - A Vignette Based Online Experiment. In Computers in Human Behavior, 122, 2021.
![Augmented reality (AR) gained much public attention after the success of Pokemon Go in 2016, and has found application in online games, social media, interior design, and other services since then. AR is highly dependent on various different sensors gathering real time context-specific personal information about the users causing more severe and new privacy threats compared to other technologies. These threats have to be investigated as long as AR is still shapeable in order to ensure users' privacy and foster market adoption of privacy-friendly AR systems. To provide viable recommendations regarding the design of privacy-friendly AR systems, we follow a user-centric approach and investigate the role and causes of privacy concerns within the context of mobile AR (MAR) apps. We design a vignette-based online experiment adapting ideas from the framework of contextual integrity to analyze drivers of privacy concerns related to MAR apps, such as characteristics of permissions, trust-evoking signals, and AR-related contextual factors. Abstract HP21chb](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
![cs4e](/pictures/icon/project/cs4e.png)
- Löbner, S.; Tesfay, W. B.; Nakamura, T. and Pape, S.: Explainable Machine Learning for Default Privacy Setting Prediction. In IEEE Access, 9: 63700-63717, 2021.
![When requesting a web-based service, users often fail in setting the website's privacy settings according to their self privacy preferences. Being overwhelmed by the choice of preferences, a lack of knowledge of related technologies or unawareness of the own privacy preferences are just some reasons why users tend to struggle. To address all these problems, privacy setting prediction tools are particularly well suited. Such tools aim to lower the burden to set privacy preferences according to owners privacy preferences. To be in line with the increased demand for explainability and interpretability by regulatory obligations - such as the General Data Protection Regulation (GDPR) in Europe - this paper introduces an explainable model for default privacy setting prediction. Compared to the previous work we present an improved feature selection, increased interpretability of each step in model design and enhanced evaluation metrics to better identify weaknesses in the model's design before they go into production. As a result, we aim to provide an explainable and transparent tool for default privacy setting prediction which users easily understand and are therefore more likely to use. Abstract LTNP21access](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
![cs4e](/pictures/icon/project/cs4e.png)
- Pape, S. and Kipker, D-K.: Case Study: Checking a Serious Security-Awareness Game for its Legal Adequacy. In Datenschutz und Datensicherheit, 45 (5): 310-314, 2021.
![It is generally accepted that the management of a company has a legal obligation to maintain and operate IT security measures as part of the company's own compliance - this includes training employees with regard to social engineering attacks. On the other hand, the question arises whether and how the employee must tolerate associated measures, as for example social engineering penetration testing can be very intrusive. Abstract PK21dud](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![social engineering](/pictures/icon/keyword/social engineering.png)
![cs4e](/pictures/icon/project/cs4e.png)
![hatch](/pictures/icon/project/hatch.png)
![threat-arrest](/pictures/icon/project/threat-arrest.png)
- Schmitz, C.; Schmid, M.; Harborth, D. and Pape, S.: Maturity Level Assessments of Information Security Controls: An Empirical Analysis of Practitioners' Assessment Capabilities. In Computers & Security, 108, 2021.
![Maturity models are a widely used concept for measuring information security. The idea is to systematically evaluate the maturity of security-relevant processes in an organisation. This enables decision makers to get an overview of the implementation status of relevant processes to identify neuralgic points. Maturity models thus play a central role in the conception of information security management systems (ISMS). Some industries, for instance, the German automotive industry, have even established security maturity levels as the de facto standard for measuring information security. However, the quality of security maturity level assessments has not been sufficiently investigated yet. We have analysed to what extent security managers can accurately assess the maturity levels of security controls. To verify the quality of maturity level assessments a case study was conducted where security experts assessed a subset of the ISO/IEC 27002 security controls for a hypothetical scenario using the COBIT maturity levels. Additionally, ex-post interviews have been conducted with several study participants to verify some of the hypotheses developed during the previous analyses. Our results show that many security experts struggled with the task and did not perform well. However, we discovered professional characteristics that have a strong significant effect on the assessment capabilities. We also identified various types of additional support that can help practitioners to make more reliable assessments in practice. Moreover, the experts' self-perception was overly optimistic when asked to assess their performance. We even found a weak inverted correlation for more experienced experts, also known as Dunning-Kruger effect. Our results have a strong impact on practise since they indicate that practitioners need support to carry out high-quality assessments and they also show what kind of support addresses the identified challenges. Abstract SSHP21cose](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![cs4e](/pictures/icon/project/cs4e.png)
- Harborth, D. and Pape, S.: Empirically Investigating Extraneous Influences on the "APCO" Model - Childhood Brand Nostalgia and the Positivity Bias. In Future Internet, 12(12) (220), 2020.
![Pokémon Go is one of the most successful mobile games of all time. Millions played and still play this mobile augmented reality (AR) application although severe privacy issues are pervasive in the app due to its use of several sensors such as location data and camera. In general, individuals regularly use online services and mobile apps although they might know that the use is associated with high privacy risks. This seemingly contradictory behavior of users is analyzed from a variety of different perspectives in the information systems domain. One of these perspectives evaluates privacy-related decision making processes based on concepts from behavioral economics. We follow this line of work by empirically testing one exemplary extraneous factor within the 'enhanced APCO model' (antecedents - privacy concerns - outcome). Specific empirical tests on such biases are rare in the literature which is why we propose and empirically analyze the extraneous influence of a positivity bias. In our case, we hypothesize that the bias is induced by childhood brand nostalgia towards the Pokémon franchise. We analyze our proposition in the context of an online survey with 418 active players of the game. Our results indicate that childhood brand nostalgia influences the privacy calculus by exerting a large effect on the benefits within the trade-off and, therefore, causing a higher use frequency. Our work shows two important implications. First, the behavioral economics perspective on privacy provides additional insights relative to previous research. However, the effects of several other biases and heuristics have to be tested in future work. Second, relying on nostalgia represents an important, but also double-edged instrument for practitioners to market new services and applications. Abstract HP20futureinternet](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
![anon](/pictures/icon/project/anon.png)
- Harborth, D. and Pape, S.: How Privacy Concerns, Trust and Risk Beliefs and Privacy Literacy Influence Users' Intentions to Use Privacy-Enhancing Technologies - The Case of Tor. In ACM SIGMIS Database: the DATABASE for Advances in Information Systems, 51 (1): 51-69, 2020.
![Due to an increasing collection of personal data by internet companies and several data breaches, research related to privacy gained importance in the last years in the information systems domain. Privacy concerns can strongly influence users' decision to use a service. The Internet Users Information Privacy Concerns (IUIPC) construct is one operationalization to measure the impact of privacy concerns on the use of technologies. However, when applied to a privacy enhancing technology (PET) such as an anonymization service the original rationales do not hold anymore. In particular, an inverted impact of trusting and risk beliefs on behavioral intentions can be expected. We show that the IUIPC model needs to be adapted for the case of PETs. In addition, we extend the original causal model by including trusting beliefs in the anonymization service itself as well as a measure for privacy literacy. A survey among 124 users of the anonymization service Tor shows that trust in Tor has a statistically significant effect on the actual use behavior of the PET. In addition, the results indicate that privacy literacy has a negative impact on trusting beliefs in general and a positive effect on trust in Tor. Abstract HP20sigmis](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![information systems](/pictures/icon/keyword/information systems.png)
![privacy](/pictures/icon/keyword/privacy.png)
![anon](/pictures/icon/project/anon.png)
- Harborth, D.; Pape, S. and Rannenberg, K.: Explaining the Technology Use Behavior of Privacy-Enhancing Technologies: The Case of Tor and JonDonym. In Proceedings on Privacy Enhancing Technologies (PoPETs), 2020 (2): 111-128, 2020.
![Today's environment of data-driven business models relies heavily on collecting as much personal data as possible. Besides being protected by governmental regulation, internet users can also try to protect their privacy on an individual basis. One of the most famous ways to accomplish this, is to use privacy-enhancing technologies (PETs). However, the number of users is particularly important for the anonymity set of the service. The more users use the service, the more difficult it will be to trace an individual user. There is a lot of research determining the technical properties of PETs like Tor or JonDonym, but the use behavior of the users is rarely considered, although it is a decisive factor for the acceptance of a PET. Therefore, it is an important driver for increasing the user base. We undertake a first step towards understanding the use behavior of PETs employing a mixed-method approach. We conducted an online survey with 265 users of the anonymity services Tor and JonDonym (124 users of Tor and 141 users of JonDonym). We use the technology acceptance model as a theoretical starting point and extend it with the constructs perceived anonymity and trust in the service in order to take account for the specific nature of PETs. Our model explains almost half of the variance of the behavioral intention to use the two PETs. The results indicate that both newly added variables are highly relevant factors in the path model. We augment these insights with a qualitative analysis of answers to open questions about the users' concerns, the circumstances under which they would pay money and choose a paid premium tariff (only for JonDonym), features they would like to have and why they would or would not recommend Tor/JonDonym. Thereby, we provide additional insights about the users' attitudes and perceptions of the services and propose new use factors not covered by our model for future research. Abstract HPR20pets](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![information systems](/pictures/icon/keyword/information systems.png)
![privacy](/pictures/icon/keyword/privacy.png)
![anon](/pictures/icon/project/anon.png)
![cs4e](/pictures/icon/project/cs4e.png)
- Pape, S.; Ivan, A.; Harborth, D.; Nakamura, T.; Kiyomoto, S.; Takasaki, H. and Rannenberg, K.: Re-evaluating Internet Users' Information Privacy Concerns: The Case in Japan. In AIS Transactions on Replication Research, 6 (18): 1-18, 2020.
![To expand the understanding of privacy concerns in the digital sphere, this paper makes use of the Internet Users' Information Privacy Concerns (IUIPC) model by Malhotra et al. (2004). The lack of empirical studies conducted in East-Asian societies makes it difficult, if not impossible, to shed light on multi-cultural differences in information privacy concerns of internet users. Therefore, we collected data of more than 9,000 Japanese respondents to conduct a conceptual replication of the IUIPC model. For our research goal, we re-assess the validity and reliability of the IUIPC model for Japan and compare the results with internet users' privacy concerns in the USA. Our results indicate that the second-order IUIPC construct, measured reflectively through the constructs awareness, collection, and control, is reliable and valid. Furthermore, three out of the five structural paths of the IUIPC model were confirmed for our Japanese sample. In contrast to the original study, the impact of IUIPC on trusting beliefs, as well as that of trusting beliefs on risk beliefs was negligible. Statistically significant differences in the IUIPC could only be found for the covariate gender. Abstract PIHNKTR20trr](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
- Pape, S.; Ivan, A.; Harborth, D.; Nakamura, T.; Kiyomoto, S.; Takasaki, H. and Rannenberg, K.: Open Materials Discourse: Re-evaluating Internet Users' Information Privacy Concerns: The Case in Japan. In AIS Transactions on Replication Research, 6 (22): 1-7, 2020.
![This paper provides the survey materials used to collect the data for the conceptual replication of the Internet Users' Information Privacy Concerns (IUIPC) model by Malhotra et al. (2004). The replication paper (Pape et al., 2020) used awareness, collection and control as constructs for the second order construct of IUIPC, as well as risk and trusting beliefs from the original paper. Instead of intended behavior the self-developed construct of willingness to share was used. Altogether more than 9,000 data points were collected. This paper provides additional materials and details on the participants, and the Japanese survey questions along with an English version for readers who are unfamiliar with Japanese. We hope that the additional information and in particular the Japanese questions provide some background on our study which will allow others a better understanding of our research and to make use of the questions themselves. Abstract PIHNKTR20trromd](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
- Pape, S.; Paci, F.; Juerjens, J. and Massacci, F.: Selecting a Secure Cloud Provider: An Empirical Study and Multi Criteria Approach. In Information, 11 (5), 2020.
![Security has become one of the primary factors that cloud customers consider when they select a cloud provider for migrating their data and applications into the Cloud. To this end, the Cloud Security Alliance (CSA) has provided the Consensus Assessment Questionnaire (CAIQ), which consists of a set of questions that providers should answer to document which security controls their cloud offerings support. In this paper, we adopted an empirical approach to investigate whether the CAIQ facilitates the comparison and ranking of the security offered by competitive cloud providers. We conducted an empirical study to investigate if comparing and ranking the security posture of a cloud provider based on CAIQ's answers is feasible in practice. Since the study revealed that manually comparing and ranking cloud providers based on the CAIQ is too time-consuming, we designed an approach that semi-automates the selection of cloud providers based on CAIQ. The approach uses the providers' answers to the CAIQ to assign a value to the different security capabilities of cloud providers. Tenants have to prioritize their security requirements. With that input, our approach uses an Analytical Hierarchy Process (AHP) to rank the providers' security based on their capabilities and the tenants' requirements. Our implementation shows that this approach is computationally feasible and once the providers' answers to the CAIQ are assessed, they can be used for multiple CSP selections. To the best of our knowledge this is the first approach for cloud provider selection that provides a way to assess the security posture of a cloud provider in practice. Abstract PPJM20information](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![cloudat](/pictures/icon/project/cloudat.png)
![cs4e](/pictures/icon/project/cs4e.png)
![seconomics](/pictures/icon/project/seconomics.png)
- Schmitz, C. and Pape, S.: LiSRA: Lightweight Security Risk Assessment for Decision Support in Information Security. In Computers & Security, 90, 2020.
![Information security risk assessment frameworks support decision-makers in assessing and understanding the risks their organisation is exposed to. However, there is a lack of lightweight approaches. Most existing frameworks require security-related information that are not available and that are very challenging to gather. So they are not suitable in practice, especially for small and medium-sized enterprises (SMEs) who often lack in data and in security knowledge. On the other hand, other explicit SME approaches have far less informative value than LiSRA. Moreover, many approaches only provide extensive process descriptions that are challenging for SMEs. In order to overcome this challenge, we propose LiSRA, a lightweight, domain-specific framework to support information security decision making. It is designed with a two-sided input where domain experts initially provide domain-specific information (e.g. attack scenarios for a specific domain), whereupon users can focus on specifying their security practices and organisational characteristics by entering information that many organisations have already collected. This information is then linked to attack paths and to the corresponding adverse impacts in order to finally assess the total risk. Moreover, LiSRA can be used to get transparent recommendations for future security activities and presents detailed insights on the mitigating effects of each recommendation. They are being evaluated taking into account the security activities already in place, and also considering the dependencies between multiple overlapping activities that can be of complementary, substitutive or dependent nature. Both aspects are ignored by most existing evaluation approaches which can lead to an over-investment in security. A prototype has been implemented, and the applicability of the framework has been evaluated with performance and robustness analyses and with initial qualitative evaluations. Abstract SP20cose](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![sidate](/pictures/icon/project/sidate.png)
- Harborth, D. and Pape, S.: How Nostalgic Feelings Impact Pokémon Go Players - Integrating Childhood Brand Nostalgia into the Technology Acceptance Theory. In Behaviour & Information Technology, 39 (12): 1276-1296, 2019.
![The augmented reality smartphone game Pokemon Go is one of the biggest commercial successes in the last years, posing the question concerning the factors contributing to the game's success. An apparent distinction to other games is the strong brand Pokemon. We derive a research model based on the established theory of technology acceptance, which includes an established construct for nostalgic feelings - childhood brand nostalgia - and theorize on how it is related to beliefs about technology characteristics and the intention to play the game. For this purpose, we adapt one of the most prominent technology acceptance models for the consumer context and for hedonic information systems, the UTAUT2 model. Based on our model, we conduct a study with 418 active German players aged between 18 and 35. Our results indicate that the effect of childhood brand nostalgia on behavioural intention is fully mediated by the belief constructs. Thus, nostalgic feelings about Pokemon influence the intention of users through altering beliefs concerning Pokemon. We include nostalgic feelings in a technology acceptance model for the first time, therefore contributing to the theoretical advance in the IS domain. The results can be used to enhance the technology acceptance of newly designed products. Abstract HP19bit](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![information systems](/pictures/icon/keyword/information systems.png)
![anon](/pictures/icon/project/anon.png)
- Pape, S. and Rannenberg, K.: Applying Privacy Patterns to the Internet of Things' (IoT) Architecture. In Mobile Networks and Applications (MONET) -- The Journal of SPECIAL ISSUES on Mobility of Systems, Users, Data and Computing, 24 (3): 925-933, 2019.
![The concept of cloud computing relies on central large datacentres with huge amounts of computational power. The rapidly growing Internet of Things with its vast amount of data showed that this architecture produces costly, inefficient and in some cases infeasible communication. Thus, fog computing, a new architecture with distributed computational power closer to the IoT devices was developed. So far, this decentralised fog-oriented architecture has only been used for performance and resource management improvements. We show how it could also be used for improving the users' privacy. For that purpose, we map privacy patterns to the IoT / fog computing / cloud computing architecture. Privacy patterns are software design patterns with the focus to translate 'privacy-by-design' into practical advice. As a proof of concept, for each of the used privacy patterns we give an example from a smart vehicle scenario to illustrate how the patterns could improve the users' privacy. Abstract PR19monet](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![iot](/pictures/icon/keyword/iot.png)
![privacy](/pictures/icon/keyword/privacy.png)
![software engineering](/pictures/icon/keyword/software engineering.png)
- Pape, S. and Rannenberg, K.: Cyber-Gefahren auf dem Radar. In ManagementKompass: Unternehmen schützen -- Risiken minimieren, November (03): pages 9-12, 2018.
![](/pictures/icon/blank.png)
![Link](/pictures/icon/link.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
- Schaab, P.; Beckers, K. and Pape, S.: Social engineering defence mechanisms and counteracting training strategies. In Information and Computer Security, 25 (2): 206-222, 2017.
![Purpose This paper aims to outline strategies for defence against social engineering that are missing in the current best practices of information technology (IT) security. Reason for the incomplete training techniques in IT security is the interdisciplinary of the field. Social engineering is focusing on exploiting human behaviour, and this is not sufficiently addressed in IT security. Instead, most defence strategies are devised by IT security experts with a background in information systems rather than human behaviour. The authors aim to outline this gap and point out strategies to fill the gaps. Design/methodology/approach The authors conducted a literature review from viewpoint IT security and viewpoint of social psychology. In addition, they mapped the results to outline gaps and analysed how these gaps could be filled using established methods from social psychology and discussed the findings. Findings The authors analysed gaps in social engineering defences and mapped them to underlying psychological principles of social engineering attacks, for example, social proof. Furthermore, the authors discuss which type of countermeasure proposed in social psychology should be applied to counteract which principle. The authors derived two training strategies from these results that go beyond the state-of-the-art trainings in IT security and allow security professionals to raise companies' bars against social engineering attacks. Originality/value The training strategies outline how interdisciplinary research between computer science and social psychology can lead to a more complete defence against social engineering by providing reference points for researchers and IT security professionals with advice on how to improve training. Abstract SBP17ics](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![social engineering](/pictures/icon/keyword/social engineering.png)
- Pape, S.; Schöch, C. and Wegner, L.: TEICHI and the Tools Paradox. Developing a Publishing Framework for Digital Editions. In Journal of the Text Encoding Initiative, 2: 1-16, 2012.
![This paper presents a newly developed framework for online publishing of scholarly text editions based on the recommendations of the Text Encoding Initiative (TEI). At the core of our publishing framework is the idea of providing support for delivery of TEI-encoded documents in Drupal, a popular, fairly powerful, modular, and easy-to-use Content Management system (CMS). We present the TEICHI suite of modules for Drupal we developed as well as a prototype implementation. TEICHI consists of a collection of modules for displaying XML/TEI files online (via XSLT and CSS), interacting with them (via Java Script), as well as uploading and retrieving (search, download) them. To showcase the particular strengths and possible use cases of our framework, we compare our tool to other currently available systems. Here, we focus on those tools which are suitable for textual scholars new to Digital Humanities and the TEI, scholars who would like to use the powerful encoding mechanisms provided by the TEI but have relatively little technical expertise. Therefore, we compare the TEICHI framework specifically to the Versioning Machine (VM) and the Scalable Architecture for Digital Editions (SADE). We look at these tools from four perspectives: that of the user interacting with the digital edition or archive, of the editor encoding and publishing texts, of the administrator setting up the publishing tool, and of the programmer possibly modifying or enhancing the tool. Our more general aim here is to investigate, from the perspective of tool development in the area of online delivery of TEI-encoded documents, what could be called the 'tools paradox': there is evidence for textual scholars' need of such tools, and a number of them are available; however, the existing tools are not widely adopted by scholars. Our findings suggest that tool development has to address two aims which seem to be mutually exclusive, that of 'keeping it simple' and that of 'going generic'. In fact, we suggest that tool developers need to find ways of turning these conflicting aims into concurrent aims if they want to build successful tools and broaden their user base. Abstract PSW12jtei](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![software engineering](/pictures/icon/keyword/software engineering.png)
![teichi](/pictures/icon/project/teichi.png)
Conference and Workshop Papers (peer-reviewed)
- Bracamonte, V.; Pape, S. and Kiyomoto, S.: Investigating User Intention to Use a Privacy Sensitive Information Detection Tool. In Symposium on Cryptography and Information Security (SCIS), 2021.
![](/pictures/icon/blank.png)
![Privacy sensitive information (PSI) detection tools have the potential to help users protect their privacy when posting information online, i.e. they can identify when a social media post contains information that users could later regret sharing. However, although users consider this type of tools useful, previous research indicates that the intention of using them is not very high. In this paper, we conduct a user survey (n=147) to investigate the factors that influence the intention to use a PSI detection tool. The results of a logistic regression analysis indicate a positive association of intention to use a PSI detection tool with performance expectation, social influence, and perception of accuracy of the tool. In addition, intention is negatively associated with privacy concerns related to the tool itself and with the participants' self-perceived ability to protect their own privacy. On the other hand, we did not find significant association with the participants' demographic characteristics or social media posting experience. We discuss these findings in the context of the design and development of PSI detection tools. Abstract BPK21SCIS](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
- Hatzivasilis, G.; Ioannidis, S.; Smyrlis, M.; Spanoudakis, G.; Frati, F.; Braghin, C.; Damiani, E.; Koshutanski, H.; Tsakirakis, G.; Hildebrandt, T.; Goeke, L.; Pape, S.; Blinder, O.; Vinov, M.; Leftheriotis, G.; Kunc, M.; Oikonomou, F.; Magilo, G.; Petrarolo, V.; Chieti, A. and Bordianu, R.: The THREAT-ARREST cyber ranges platform. In IEEE CSR Workshop on Cyber Ranges and Security Training (CRST), 2021.
![](/pictures/icon/blank.png)
![Emerging technologies are facilitating our daily activities and drive the digital transformation. The Internet of Things (IoT) and 5G communications will provide a wide range of new applications and business opportunities, but with a wide and quite complex attack surface. Several users are not aware of the underlying threats and most of them do not possess the knowledge to set and operate the various digital assets securely. Therefore, cyber security training is becoming mandatory both for simple users and security experts. Cyber ranges constitute an advance training technique where trainees gain hands-on experiences on a safe virtual environment, which can be a realistic digital twin of an actual system. This paper presents the cyber ranges platform THREAT-ARREST. Its design is fully model-driven and offers all modern training features (i.e. emulation, simulation, serious games, and fabricated data). The platform has been evaluated under the smart energy, intelligent transportation, and healthcare domains. Abstract HISSFBDKTHGPBVLKOMPCB21crst](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
- Harborth, D.; Pape, S. and Rannenberg, K.: Explaining the Technology Use Behavior of Privacy-Enhancing Technologies: The Case of Tor and JonDonym (Poster). In 17th Symposium on Usable Privacy and Security (SOUPS 2021), 2021.
![](/pictures/icon/blank.png)
![Today's environment of data-driven business models relies heavily on collecting as much personal data as possible. Besides being protected by governmental regulation, internet users can also try to protect their privacy on an individual basis. One of the most famous ways to accomplish this, is to use privacy-enhancing technologies (PETs). However, the number of users is particularly important for the anonymity set of the service. The more users use the service, the more difficult it will be to trace an individual user. There is a lot of research determining the technical properties of PETs like Tor or JonDonym, but the use behavior of the users is rarely considered, although it is a decisive factor for the acceptance of a PET. Therefore, it is an important driver for increasing the user base. We undertake a first step towards understanding the use behavior of PETs employing a mixed-method approach. We conducted an online survey with 265 users of the anonymity services Tor and JonDonym (124 users of Tor and 141 users of JonDonym). We use the technology acceptance model as a theoretical starting point and extend it with the constructs perceived anonymity and trust in the service in order to take account for the specific nature of PETs. Our model explains almost half of the variance of the behavioral intention to use the two PETs. The results indicate that both newly added variables are highly relevant factors in the path model. We augment these insights with a qualitative analysis of answers to open questions about the users' concerns, the circumstances under which they would pay money and choose a paid premium tariff (only for JonDonym), features they would like to have and why they would or would not recommend Tor/JonDonym. Thereby, we provide additional insights about the users' attitudes and perceptions of the services and propose new use factors not covered by our model for future research. Abstract HPR21soupsposter](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
- Pape, S.; Harborth, D. and Kröger, J. L.: Privacy Concerns Go Hand in Hand with Lack of Knowledge: The Case of the German Corona-Warn-App. In ICT Systems Security and Privacy Protection - 36th IFIP TC 11 International Conference, SEC 2021, pages 256-269, Springer, IFIP Advances in Information and Communication Technology 625, 2021.
![The German Corona-Warn-App (CWA) is one of the most controversial tools to mitigate the Corona virus spread with roughly 25 million users. In this study, we investigate individuals' knowledge about the CWA and associated privacy concerns alongside different demographic factors. For that purpose, we conducted a study with 1752 participants in Germany to investigate knowledge and privacy concerns of users and non-users of the German Corona-Warn-App (CWA). We investigate the relationship between knowledge and privacy concerns and analyze the demographic effects on both. Our results indicate that knowledge about the CWA significantly reduces the privacy concerns about it. Non surprisingly, users have far lower privacy concerns than non-users, but they also have more knowledge about the app. We also find a positive significant effect of education and income and a small negative effect of age on the participants' knowledge. Furthermore, we find a significant negative effect of income and education on the privacy concerns. Our study has important implications for political decision-makers aiming at increasing adoption rates for helpful technologies to mitigate the severe effects of the pandemic. Most relevant here is to acknowledge the results regarding education, knowledge, privacy concerns and CWA use and devise effective strategies to reach certain groups in the society which are currently not using the CWA. Abstract PHK21ifipsec](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![information systems](/pictures/icon/keyword/information systems.png)
![privacy](/pictures/icon/keyword/privacy.png)
![cs4e](/pictures/icon/project/cs4e.png)
- Pape, S.; Klauer, A. and Rebler, M.: Leech: Let's Expose Evidently bad data Collecting Habits - Towards a Serious Game on Understanding Privacy Policies (Poster). In 17th Symposium on Usable Privacy and Security (SOUPS 2021), 2021.
![](/pictures/icon/blank.png)
![Most privacy policies are incomprehensive and largely unreadable. As a consequence, most users do not bother to read them. We propose Leech, a serious game developed in a students' project for learning about the contents and structure of privacy policies so that users get a rough understanding what to expect in privacy policies. Leech is an adventure game and the player has to solve quests to complete the game. Two of the tasks are implemented as a mini game to allow more complexity. Two pre-tests led to promising results and we intend to quantitatively evaluate the game in the next step by investigating players' online privacy literacy, demographics, values on privacy policies, actions within the game, and their in-game experience. Abstract PKR21soupsposter](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
- Hazilov, V. and Pape, S.: Systematic Scenario Creation for Serious Security-Awareness Games. In Computer Security - ESORICS 2020 International Workshops, DETIPS, DeSECSys, MPS, and SPOSE, Guildford, UK, September 17-18, 2020, Revised Selected Papers, Springer International Publishing, Cham, LNCS 12580, 2020.
![While social engineering is still a recent threat, many organisations only address it by using traditional training, penetration tests or standardized security awareness campaigns or serious games. Existing research has shown that in particular raising the awareness of employees is more effective if it is adjusted to its target audience. For that purpose, we propose to create specific scenarios for serious games considering the organisation's specifics. Based on the work of Faily and Flechais, who created personas utilizing grounded theory, we demonstrate how to develop a specific scenario for HATCH, a serious game on social engineering. Our method for adapting the scenario of a serious game on social engineering resulted in a realistic scenario and thus was effective. Since the method is also very time-consuming, we propose future work to investigate if the effort can be reduced. Abstract HP20spose](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![social engineering](/pictures/icon/keyword/social engineering.png)
![cs4e](/pictures/icon/project/cs4e.png)
![hatch](/pictures/icon/project/hatch.png)
![threat-arrest](/pictures/icon/project/threat-arrest.png)
- Pape, S.; Goeke, L.; Quintanar, A. and Beckers, K.: Conceptualization of a CyberSecurity Awareness Quiz. In Computer Security - ESORICS 2020 International Workshops MSTEC, pages 61-76, Springer International Publishing, Cham, LNCS 12512, 2020.
![Recent approaches to raise security awareness have improved a lot in terms of user-friendliness and user engagement. However, since social engineering attacks on employees are evolving fast, new variants arise very rapidly. To deal with recent changes, our serious game CyberSecurity Awareness Quiz provides a quiz on recent variants to make employees aware of new attacks or attack variants in an entertaining way. While the gameplay of a quiz is more or less generic, the core of our contribution is a concept to create questions and answers based on current affairs and attacks observed in the wild. Abstract PGQB20mstec](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![serious game](/pictures/icon/keyword/serious game.png)
![social engineering](/pictures/icon/keyword/social engineering.png)
![cs4e](/pictures/icon/project/cs4e.png)
![threat-arrest](/pictures/icon/project/threat-arrest.png)
- Pape, S.; Schmitz, C.; Kipker, D-K. and Sekula, A.: On the use of Information Security Management Systems by German Energy Providers. In Presented at the Fourteenth IFIP Working Group 11.10 International Conference on Critical Infrastructure Protection, 2020.
![](/pictures/icon/blank.png)
![Along with other requirements, the German critical infrastructure programme required critical infrastructure providers, i.e. energy providers to implement an ISMS. We used the unique opportunity to observe the implementation and surveyed all German energy providers in autumn 2016 and 2018. Our study shows, that most of the energy providers implemented an ISMS between our surveys and reported an perceived increase in information security suggesting that the critical infrastructure programme fulfilled its purpose. Abstract PSKS20iccip](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![information systems](/pictures/icon/keyword/information systems.png)
![security](/pictures/icon/keyword/security.png)
![cs4e](/pictures/icon/project/cs4e.png)
![sidate](/pictures/icon/project/sidate.png)
- Schmitz, C.; Sekulla, A. and Pape, S.: Asset-centric analysis and visualisation of attack trees. In Graphical Models for Security - 7th International Workshop, GraMSec@CSF 2020, Boston, MA, USA, Virtual Conference, June 22, 2020, Revised Selected Papers, pages 45-64, Springer, LNCS 12419, 2020.
![Attack trees are an established concept in threat and risk analysis. They build the basis for numerous frameworks aiming to determine the risk of attack scenarios or to identify critical attacks or attack paths. However, existing frameworks do not provide systematic analyses on the asset-level like the probability of (un)successful attacks per asset. But these insights are important to enable decision-makers to make more informed decisions. Therefore, a generic approach is presented that extends classical attack tree approaches by asset-specific analyses. For this purpose, the attack steps in the attack trees are annotated with corresponding assets. This allows to identify the attack paths each asset is exposed to. In combination with the standard attack tree parameter 'probability of attack success' a set of complementing attack success and protection metrics can be applied on each step of the paths. Furthermore, an integrated visualisation scheme is proposed that illustrates the results in a comprehensible way so that decision-makers can intuitively understand what the metrics indicate. It also includes several features improving the usability and scalability. As a proof of concept, we have implemented a prototype of our proposed method. Abstract SSP20gramsec](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![cs4e](/pictures/icon/project/cs4e.png)
- Goeke, L.; Quintanar, A.; Beckers, K. and Pape, S.: PROTECT - An Easy Configurable Serious Game to Train Employees Against Social Engineering Attacks. In Computer Security - ESORICS 2019 International Workshops, IOSec, MSTEC, and FINSEC, Luxembourg City, Luxembourg, September 26-27, 2019, Revised Selected Papers, pages 156-171, Springer International Publishing, Cham, LNCS 11981, 2019.
![Social engineering is the clever manipulation of human trust. While most security protection focuses on technical aspects, organisations remain vulnerable to social engineers. Approaches employed in social engineering do not differ significantly from the ones used in common fraud. This implies defence mechanisms against the fraud are useful to prevent social engineering, as well. We tackle this problem using and enhancing an existing online serious game to train employees to use defence mechanisms of social psychology. The game has shown promising tendencies towards raising awareness for social engineering in an entertaining way. Training is highly effective when it is adapted to the players context. Our contribution focuses on enhancing the game with highly configurable game settings and content to allow the adaption to the player's context as well as the integration into training platforms. We discuss the resulting game with practitioners in the field of security awareness to gather some qualitative feedback. Abstract GQBP19mstec](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![serious game](/pictures/icon/keyword/serious game.png)
![social engineering](/pictures/icon/keyword/social engineering.png)
![threat-arrest](/pictures/icon/project/threat-arrest.png)
- Harborth, D.; Cai, X. and Pape, S.: Why Do People Pay for Privacy?. In ICT Systems Security and Privacy Protection - 34th IFIP TC 11 International Conference, SEC 2019, Lisbon, Portugal, June 25-27, 2019, Proceedings, pages 253-267, 2019, Acceptance rate: 26 / 142 = 18.3%.
![Today's environment of data-driven business models relies heavily on collecting as much personal data as possible. One way to prevent this extensive collection, is to use privacy-enhancing technologies (PETs). However, until now, PETs did not succeed in larger consumer markets. In addition, there is a lot of research determining the technical properties of PETs, i.e. for Tor, but the use behavior of the users and, especially, their attitude towards spending money for such services is rarely considered. Yet, determining factors which lead to an increased willingness to pay (WTP) for privacy is an important step to establish economically sustainable PETs. We argue that the lack of WTP for privacy is one of the most important reasons for the non-existence of large players engaging in the offering of a PET. The relative success of services like Tor corroborates this claim since this is a service without any monetary costs attached. Thus, we empirically investigate the drivers of active users' WTP of a commercial PET - JonDonym - and compare them with the respective results for a donation-based service - Tor. Furthermore, we provide recommendations for the design of tariff schemes for commercial PETs. Abstract HCP19ifipsec](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![information systems](/pictures/icon/keyword/information systems.png)
![privacy](/pictures/icon/keyword/privacy.png)
![anon](/pictures/icon/project/anon.png)
- Hamm, P.; Harborth, D. and Pape, S.: A Systematic Analysis of User Evaluations in Security Research. In Proceedings of the 14th International Conference on Availability, Reliability and Security, ARES 2019, Canterbury, UK, August 26-29, 2019, ACM, 2019.
![We conducted a literature survey on reproducibility and replicability of user surveys in security research. For that purpose, we examined all papers published over the last five years at three leading security research conferences and recorded the type of study and whether the authors made the underlying responses available as open data, as well as if they published the used questionnaire respectively interview guide. We uncovered how user surveys become more widespread in security research and how authors and conferences are increasingly publishing their methodologies, while we had no examples of data being made available. Based on these findings, we recommend that future researchers publish their data in addition to their results to facilitate replication and ensure a firm basis for user studies in security research. Abstract HHP19iwsmr](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![cs4e](/pictures/icon/project/cs4e.png)
- Harborth, D. and Pape, S.: How Privacy Concerns and Trust and Risk Beliefs Influence Users' Intentions to Use Privacy-Enhancing Technologies -- The Case of Tor. In 52nd Hawaii International Conference on System Sciences (HICSS) 2019, pages 4851-4860, 2019, Acceptance rate: 48%.
![Due to an increasing collection of personal data by internet companies and several data breaches, research related to privacy gained importance in the last years in the information systems domain. It was shown that privacy concerns can strongly influence users' decision to use a service. The Internet Users Information Privacy Concerns (IUIPC) construct is one operationalization to measure the impact of privacy concerns on the use of technologies. However, studies haven't yet applied it to a privacy enhancing technology (PET) such as an anonymization service. Therefore, we conducted a survey among 124 users of the anonymization service Tor. We show that the IUIPC model needs to be adapted for the case of PETs. In addition, we extend the original causal model by including trust beliefs in the anonymization service itself and show that they have a significant effect on the actual use behavior of the PET. Abstract HP19hicss](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![information systems](/pictures/icon/keyword/information systems.png)
![privacy](/pictures/icon/keyword/privacy.png)
![anon](/pictures/icon/project/anon.png)
- Harborth, D. and Pape, S.: Investigating Privacy Concerns related to Mobile Augmented Reality Applications. In Proceedings of the 40th International Conference on Information Systems ICIS 2019, Munich, Germany, December 13-15, 2019, 2019.
![PDF](/pictures/icon/pdf.png)
![Augmented reality (AR) gained much public attention since the success of Pokemon Go in 2016. Technology companies like Apple or Google are focusing primarily on mobile AR (MAR) applications running on smartphones or tablets since this type of AR is widely available for the end consumer. Associated privacy issues have to be investigated early as long as AR is still shapeable in order to foster market adoption and improve users' privacy. Thus, we designed a vignette-based online experiment to investigate influencing factors of privacy concerns related to a hypothetical MAR app. Furthermore, we investigate whether individuals associate higher privacy concerns with AR compared to non-AR by manipulating the description of the app. Thereby, we want to better understand the attitude formation process related to AR and the relation to privacy concerns. We conduct a pretest with 91 German smartphone users to evaluate the used constructs and our proposed research model. Abstract HP19icis](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![information systems](/pictures/icon/keyword/information systems.png)
![privacy](/pictures/icon/keyword/privacy.png)
- Hatamian, M.; Pape, S. and Rannenberg, K.: ESARA: A Framework for Enterprise Smartphone Apps Risk Assessment. In ICT Systems Security and Privacy Protection - 34th IFIP TC 11 International Conference, SEC 2019, Lisbon, Portugal, June 25-27, 2019, Proceedings, pages 165-179, 2019, Acceptance rate: 26 / 142 = 18.3%.
![Protecting enterprise's confidential data and infrastructure against adversaries and unauthorized accesses has been always challenging. This gets even more critical when it comes to smartphones due to their mobile nature which enables them to have access to a wide range of sensitive information that can be misused. The crucial questions here are: How the employees can make sure the smartphone apps that they use are trustworthy? How can the enterprises check and validate the trustworthiness of apps being used within the enterprise network? What about the security and privacy aspects? Are the confidential information such as passwords, important documents, etc. are treated safely? Are the employees' installed apps monitoring/spying the enterprise environment? To answer these questions, we propose Enterprise Smartphone Apps Risk Assessment (ESARA) as a novel framework to support and enable enterprises to analyze and quantify the potential privacy and security risks associated with their employees' installed apps. Given an app, ESARA first conducts various analyses to characterize its vulnerabilities. Afterwards, it examines the app's behavior and overall privacy and security perceptions associated with it by applying natural language processing and machine learning techniques. The experimental results using app behavior and perception analyses indicate that: (1) ESARA is able to examine apps' behavior for potential invasive activities; and (2) the analyzed privacy and security perceptions by ESARA usually reveal interesting information corresponding to apps' behavior achieved with high accuracy. Abstract HPR19ifipsec](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![privacy'n'us](/pictures/icon/project/privacy'n'us.png)
- Pape, S. and Stankovic, J.: An Insight into Decisive Factors in Cloud Provider Selection with a Focus on Security. In Computer Security - ESORICS 2019 International Workshops, CyberICPS, SECPRE, SPOSE, ADIoT, Luxembourg City, Luxembourg, September 26-27, 2019, Revised Selected Papers, pages 287-306, Springer International Publishing, Cham, LNCS 11980, 2019.
![In the last ten years cloud computing has developed from a buzz word to the new computing paradigm on a global scale. Computing power or storage capacity can be bought and consumed flexibly and on-demand, which opens up new opportunities for cost-saving and data processing. However, it also goes with security concerns as it represents a form of IT outsourcing. We investigate how these concerns manifest as a decisive factor in cloud provider selection by interviews with eight practitioners from German companies. As only a moderate interest is discovered, it is further examined why this is the case. Additionally, we compared the results from a systematic literature survey on cloud security assurance to cloud customers' verification of their providers' security measures. This paper provides a qualitative in-depth examination of companies' attitudes towards security in the cloud. The results of the analysed sample show that security is not necessarily decisive in cloud provider selection. Nevertheless, providers are required to guarantee security and comply. Traditional forms of assurance techniques play a role in assessing cloud providers and verifying their security measures. Moreover, compliance is identified as a strong driver to pursue security and assurance. Abstract PS19spose](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![information systems](/pictures/icon/keyword/information systems.png)
![security](/pictures/icon/keyword/security.png)
- Schmid, M.; Akarkach, K. and Pape, S.: Comparison of different aggregated information security control maturities from AHP ranked companies (Extended abstract). In Preproceedings of IFIP Summer School on Privacy and Identity Management - Data for Better Living: AI and Privacy 2019 (IFIPSC2019), 2019.
![](/pictures/icon/blank.png)
![General Data Protection Regulation (GDRP) has not only a great influence on data protection but also on the area of information security especially with regard to Article 32. This article emphasizes the importance of a process for regularly testing, assessing and evaluating the security, but measuring of information security involves overcoming many obstacles. The goodness of information security can only be measured indirectly using metrics and Key Performance Indicators (KPIs), as there exist no gold standard. Many studies are concerned with using metrics to get as close as possible to the status of information security but only a few focus on the comparison of information security metrics. This paper deals with the significance of the ranking from a AHP-comparison of information security among different companies within a specific industry. The required model has already been developed by the authors and tested for applicability by means of case studies. In order to investigate the significance of the ranking from the comparison in more detail, this paper will try to figure out which way a maturity control should be determined to serve the company best in improving their security. This result will be helpful for all companies aiming to regularly assess and improve their security as requested by the GDPR. To verify the significance of the results with different sets, real information security data from a large international media and technology company is used. Abstract SAP19sec](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
- Schmid, M. and Pape, S.: A structured comparison of the corporate information security. In ICT Systems Security and Privacy Protection - 34th IFIP TC 11 International Conference, SEC 2019, Lisbon, Portugal, June 25-27, 2019, Proceedings, pages 223-237, 2019, Acceptance rate: 26 / 142 = 18.3%.
![Generally, measuring the information security maturity is the first step to build a knowledge information security management system in an organization. Unfortunately, it is not possible to measure information security directly. Thus, in order to get an estimate, one has to find reliable measurements. One way to assess information security is by applying a maturity model and assess the level of controls. This does not need to be equivalent to the level of security. Nevertheless, evaluating the level of information security maturity in companies has been a major challenge for years. Although many studies have been conducted to address these challenges, there is still a lack of research to properly analyze these assessments. The primary objective of this study is to show how to use the analytic hierarchy process (AHP) to compare the information security controls' level of maturity within an industry in order to rank different companies. To validate the approach of this study, we used real information security data from a large international media and technology company. Abstract SP19ifipsec](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
- Sekulla, A.; Schmitz, C.; Pape, S. and Pipek, V.: Demonstrator zur Beschreibung und Visualisierung einer kritischen Infrastruktur. In Human Practice. Digital Ecologies. Our Future. 14. Internationale Tagung Wirtschaftsinformatik (WI 2019), February 24-27, 2019, Siegen, Germany, pages 1978, 2019.
![](/pictures/icon/blank.png)
![Kleine und mittelständische Unternehmen haben oftmals grosse Probleme in der Einführung eines ISMS und einer Verbesserung der eigenen ITSicherheit. Besonders kritische Infrastrukturen wie Energienetzbetreiber sind gesetzlich dazu verpflichtet ein ISMS einzuführen und für eine bestmögliche Sicherheit zu sorgen. Diesen Unternehmen fehlt es jedoch oftmals an möglichen Mitteln und Erfahrungen. Mit dem Forschungsprojekt SIDATE soll dieses Wissensdefizit untersucht und analysiert werden. Es wurden mehrere leichtgewichtige Werkzeuge entwickelt, die auf einer zentralen Wissens- und Austauschplattform angesiedelt sind. So sollen mit der Entwicklung einer leichtgewichtigen Beschreibungssprache und dem zugehörigen Demonstrator kleine und mittelständische Energienetzbetreiber untersützt werden. Mit dieser Arbeit möchten wir den Demonstrator zur Beschreibung, Visualisierung und Untersuchung auf IT-Sicherheit einer kritischen Infrastruktur vorstellen. Mit der Beschreibungssprache ist es zudem öglich Angriffszenarien und Angriffsbäume zu visualisieren, um mögliche Sicherheitslücken besser aufdecken zu können. Insbesondere soll dieses Werkzeug durch Exportfunktionen einen Erfahrungsaustausch zwischen den Nutzern bzw. Energienetzbetreibern fördern und eine Steigerung der IT-Sicherheit stärken. Abstract SSPP19wi](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![sidate](/pictures/icon/project/sidate.png)
- Aladawy, D.; Beckers, K. and Pape, S.: PERSUADED: Fighting Social Engineering Attacks with a Serious Game. In Trust, Privacy and Security in Digital Business - 15th International Conference, TrustBus 2018, Regensburg, Germany, September 5-6, 2018, Proceedings, Springer, Lecture Notes in Computer Science 11033, 2018, ISBN 978-3-319-98384-4, Acceptance rate: 15 / 29 = 51.7%.
![Social engineering is the clever manipulation of the human element to acquire information assets. While technical security of most critical systems is high, the systems remain vulnerable to attacks from social engineers. The challenge in defeating social engineering is that it is a deceptive process that exploits human beings. Methods employed in social engineering do not differ much from those used to perform traditional fraud. This implies the applicability of defense mechanisms against the latter to the context of social engineering. Taking this problem into consideration, we designed a serious game that trains people against social engineering using defense mechanisms of social psychology. The results of our empirical evaluation of the game indicate that the game is able to raise awareness for social engineering in an entertaining way. Abstract ABP18trustbus](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
![security](/pictures/icon/keyword/security.png)
![serious game](/pictures/icon/keyword/serious game.png)
![social engineering](/pictures/icon/keyword/social engineering.png)
![sidate](/pictures/icon/project/sidate.png)
- Harborth, D.; Braun, M.; Grosz, A.; Pape, S. and Rannenberg, K.: Anreize und Hemmnisse für die Implementierung von Privacy-Enhancing Technologies im Unternehmenskontext. In Sicherheit 2018: Sicherheit, Schutz und Zuverlässigkeit, Beiträge der 9. Jahrestagung des Fachbereichs Sicherheit der Gesellschaft für Informatik e.V. (GI), 25.-27. April 2018, Konstanz, pages 29-41, 2018.
![Wir untersuchen in diesem Artikel mögliche Anreize für Firmen Privacy-Enhancing Technologies (PETs) zu implementieren, und damit das Privatsphäre- und Datenschutzniveau von Endkonsumenten zu erhöhen. Ein Gro'ssteil aktueller Forschung zu Privatsphäre- und Datenschutz (im Weiteren Privacy) wird aktuell aus Nutzersicht, und nicht aus der Unternehmensperspektive geführt. Um diese bislang relativ unerforschte Lücke zu füllen, interviewten wir zehn Experten mit einem beruflichen Hintergrund zum Thema Privacy. Die Resultate unserer qualitativen Auswertung zeigen eine komplexe Anreizstruktur für Unternehmen im Umgang mit PETs. Durch das sukzessive Herausarbeiten zahlreicher Interdependenzen der gebildeten Kategorien leiten wir externe sowie unternehmens- und produktspezifische Anreize und Hemmnisse zur Implementierung von PETs in Firmen ab. Die gefundenen Ergebnisse präsentieren wir anschließend in einer Taxonomie. Unsere Ergebnisse haben relevante Implikationen für Organisationen und Gesetzgeber sowie die aktuelle Ausrichtung der Privacyforschung. Abstract HBGPR18sicherheit](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![information systems](/pictures/icon/keyword/information systems.png)
![privacy](/pictures/icon/keyword/privacy.png)
![anon](/pictures/icon/project/anon.png)
![sioc](/pictures/icon/project/sioc.png)
- Harborth, D. and Pape, S.: Examining Technology Use Factors of Privacy-Enhancing Technologies: The Role of Perceived Anonymity and Trust. In 24th Americas Conference on Information Systems, AMCIS 2018, New Orleans, LA, USA, August 16-18, 2018, Association for Information Systems, 2018.
![PDF](/pictures/icon/pdf.png)
![Today's environment of data-driven business models rely heavily on collecting as much personal data as possible. This is one of the main causes for the importance of privacy-enhancing technologies (PETs) to protect internet users' privacy. Still, PETs are rather a niche product used by relatively few users on the internet. We undertake a first step towards understanding the use behavior of such technologies. For that purpose, we conducted an online survey with 141 users of the anonymity service 'JonDonym'. We use the technology acceptance model as a theoretical starting point and extend it with the constructs perceived anonymity and trust in the service. Our model explains almost half of the variance of the behavioral intention to use JonDonym and the actual use behavior. In addition, the results indicate that both added variables are highly relevant factors in the path model. Abstract HP18amcis](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![information systems](/pictures/icon/keyword/information systems.png)
![privacy](/pictures/icon/keyword/privacy.png)
![anon](/pictures/icon/project/anon.png)
- Harborth, D. and Pape, S.: JonDonym Users' Information Privacy Concerns. In ICT Systems Security and Privacy Protection - 33rd IFIP TC 11 International Conference, SEC 2018, Held at the 24th IFIP World Computer Congress, WCC 2018, Poznan, Poland, September 18-20, 2018, Proceedings, pages 170-184, 2018, Acceptance rate: 27 / 89 = 30.3%.
![Privacy concerns as well as trust and risk beliefs are important factors that can influence users' decision to use a service. One popular model that integrates these factors is relating the Internet Users Information Privacy Concerns (IUIPC) construct to trust and risk beliefs. However, studies haven't yet applied it to a privacy enhancing technology (PET) such as an anonymization service. Therefore, we conducted a survey among 416 users of the anonymization service JonDonym and collected 141 complete questionnaires. We rely on the IUIPC construct and the related trust-risk model and show that it needs to be adapted for the case of PETs. In addition, we extend the original causal model by including trust beliefs in the anonymization service provider and show that they have a significant effect on the actual use behavior of the PET. Abstract HP18ifipsec](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![information systems](/pictures/icon/keyword/information systems.png)
![privacy](/pictures/icon/keyword/privacy.png)
![anon](/pictures/icon/project/anon.png)
- Pape, S.; Tasche, D.; Bastys, I.; Grosz, A.; Laessig, J. and Rannenberg, K.: Towards an Architecture for Pseudonymous E-Commerce -- Applying Privacy by Design to Online Shopping. In Sicherheit 2018: Sicherheit, Schutz und Zuverlässigkeit, Beiträge der 9. Jahrestagung des Fachbereichs Sicherheit der Gesellschaft für Informatik e.V. (GI), 25.-27. April 2018, Konstanz, pages 17-28, 2018.
![In this paper, we apply privacy by design in practice in the domain of e-commerce. Therefore, we elicit the requirements for a data minimised version of online shopping. We propose several variants of the traditional online shopping process and compared them based on privacy threats, transparency of data flows for the user, usability and compatibility with existing business models. Abstract PTBGLR18sicherheit](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
![sioc](/pictures/icon/project/sioc.png)
- Paul, N.; Tesfay, W. B.; Kipker, D-K.; Stelter, M. and Pape, S.: Assessing Privacy Policies of Internet of Things Services. In ICT Systems Security and Privacy Protection - 33rd IFIP TC 11 International Conference, SEC 2018, Held at the 24th IFIP World Computer Congress, WCC 2018, Poznan, Poland, September 18-20, 2018, Proceedings, pages 156-169, 2018, Acceptance rate: 27 / 89 = 30.3%.
![This paper provides an assessment framework for privacy policies of Internet of Things Services which is based on particular GDPR requirements. The objective of the framework is to serve as supportive tool for users to take privacy-related informed decisions. For example when buying a new fitness tracker, users could compare different models in respect to privacy friendliness or more particular aspects of the framework such as if data is given to a third party. The framework consists of 16 parameters with one to four yes-or-no-questions each and allows the users to bring in their own weights for the different parameters. We assessed 110 devices which had 94 different policies. Furthermore, we did a legal assessment for the parameters to deal with the case that there is no statement at all regarding a certain parameter. The results of this comparative study show that most of the examined privacy policies of IoT devices/services are insufficient to address particular GDPR requirements and beyond. We also found a correlation between the length of the policy and the privacy transparency score, respectively. Abstract PTKSP18ifipsec](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![iot](/pictures/icon/keyword/iot.png)
![privacy](/pictures/icon/keyword/privacy.png)
![anon](/pictures/icon/project/anon.png)
- Schmitz, C.; Sekula, A.; Pape, S.; Pipek, V. and Rannenberg, K.: Easing the Burden of Security Self-Assessments. In 12th International Symposium on Human Aspects of Information Security & Assurance, HAISA 2018 ,Dundee, Scotland, August 29-31, 2018, Proceedings., 2018.
![PDF](/pictures/icon/pdf.png)
![A web-based platform was developed to support the inter-organisational collaboration between small and medium-sized energy providers. Since critical infrastructures are subject to new security regulations in Germany, the platform particularly serves for the exchange of experience and for mutual support in information security. The focus of this work is the security self-assessment component. In order to ease the burden of going through a long questionnaire we have implemented small, motivating modules that are spread across the platform. The data entered is used for an individual risk assessment but also for a fine granular inter-organisational security benchmarking which builds a common added value for the entire community on the platform and strengthens the community building process. We implemented a prototype of the platform and evaluated the it in a focus group. Abstract SSPPR18haisa](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![sidate](/pictures/icon/project/sidate.png)
- Beckers, K.; Fries, V.; Groen, E. C. and Pape, S.: Creativity Techniques for Social Engineering Threat Elicitation: A Controlled Experiment. In Joint Proceedings of REFSQ-2017 Workshops, Doctoral Symposium, Research Method Track, and Poster Track co-located with the 22nd International Conference on Requirements Engineering: Foundation for Software Quality (REFSQ 2017), Essen, Germany, February 27, 2017., 2017.
![PDF](/pictures/icon/pdf.png)
![We propose a controlled experiment to assess how well creativity techniques can support social engineering threat assessment. Social engineering threats form the basis for the elicitation of security requirements, a type of quality requirement, which state what threat should be prevented or mitigated. The proposed experiment compares a serious game and the Morphological Forced Connections technique with regard to their productivity, as well as completeness and precision. Abstract BFGP17CreaRE](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![serious game](/pictures/icon/keyword/serious game.png)
![social engineering](/pictures/icon/keyword/social engineering.png)
![hatch](/pictures/icon/project/hatch.png)
- Beckers, K.; Schosser, D.; Pape, S. and Schaab, P.: A Structured Comparison of Social Engineering Intelligence Gathering Tools. In Trust, Privacy and Security in Digital Business - 14th International Conference, TrustBus 2017, Lyon, France, August 30-31, 2017, Proceedings, pages 232-246, 2017, Revision 1, Table 7 was corrected, see https://link.springer.com/10.1007/978-3-319-64483-7_16.
![Social engineering is the clever manipulation of the human tendency to trust to acquire information assets. While technical security of most critical systems is high, the systems remain vulnerable to attacks from social engineers. Traditional penetration testing approaches often focus on vulnerabilities in network or software systems. Few approaches even consider the exploitation of humans via social engineering. While the amount of social engineering attacks and the damage they cause rise every year, the defences against social engineering do not evolve accordingly. However, tools exist for social engineering intelligence gathering, which means the gathering of information about possible victims that can be used in an attack. We survey these tools and present an overview of their capabilities. We concluded that attackers have a wide range of intelligence gathering tools at their disposal, which increases the likelihood of future attacks and allows even non-technical skilled users to apply these tools. Abstract BSPS17trustbus](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
![security](/pictures/icon/keyword/security.png)
![social engineering](/pictures/icon/keyword/social engineering.png)
![sidate](/pictures/icon/project/sidate.png)
- Harborth, D. and Pape, S.: Age Matters - Privacy Concerns of Pokémon Go Players in Germany (Extended Abstract). In Preproceedings of IFIP Summer School on Privacy and Identity Management - the Smart World Revolution 2017 (IFIPSC2017), 2017.
![PDF](/pictures/icon/pdf.png)
![We investigate privacy concerns and the privacy behavior of users of the AR smartphone game Pokémon Go. Pokémon Go accesses several functionalities of the smartphone and, in turn, collects a plethora of data of its users. For assessing the privacy concerns, we conduct an online study in Germany with 683 users of the game. The results indicate that the majority of the active players are concerned about the privacy practices of companies. This result hints towards the existence of a cognitive dissonance, i.e. the privacy paradox. Since this result is common in the privacy literature, we complement the first study with a second one with 199 users, which aims to assess the behavior of users with regard to which measures they undertake for protecting their privacy. The results are highly mixed and dependent on the measure, i.e. relatively many participants use privacy-preserving measures when interacting with their smartphone. This implies that many users know about risks and might take actions to protect their privacy, but deliberately trade-off their information privacy for the utility generated by playing the game. Abstract HP17ifipsc_ea](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![information systems](/pictures/icon/keyword/information systems.png)
![privacy](/pictures/icon/keyword/privacy.png)
- Harborth, D. and Pape, S.: Exploring the Hype: Investigating Technology Acceptance Factors of Pokémon Go. In 2017 IEEE International Symposium on Mixed and Augmented Reality, ISMAR 2017, Nantes, France, October 9-13, 2017, pages 155-168, 2017, Acceptance rate: (17)/99 = 17.2 %.
![We investigate the technology acceptance factors of the AR smart-phone game Pokemon Go with a PLS-SEM approach based on the UTAUT2 model by Venkatesh et al. [1]. Therefore, we conducted an online study in Germany with 683 users of the game. Many other studies rely on the users' imagination of the application's functionality or laboratory environments. In contrast, we asked a relatively large user base already interacting in the natural environment with the application. Not surprisingly, the strongest predictor of behavioral intention to play Pokémon Go is hedonic motivation, i.e. fun and pleasure due to playing the game. Additionally, we find medium-sized effects of effort expectancy on behavioral intention, and of habit on behavioral intention and use behavior. These results imply that AR applications -- besides needing to be easily integrable in the users' daily life -- should be designed in an intuitive and easily understandable way. We contribute to the understanding of the phenomenon of Pokémon Go by investigating established acceptance factors that potentially fostered the massive adoption of the game. Abstract HP17ismar](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![information systems](/pictures/icon/keyword/information systems.png)
- Sailer, M.; Hoppenz, C.; Beckers, K. and Pape, S.: Förderung von IT-Sicherheitsbewusstheit durch spielbasiertes Lernen - eine experimentelle Studie. In Tagung der Sektion ``Empirische Bildungsforschung'' -- Educational Research and Governance (AEPF 2017), 2017.
![PDF](/pictures/icon/pdf.png)
![IT-Sicherheit nimmt eine zunehmend zentrale Bedeutung in unserem Alltag und in unserem Arbeitsleben ein. Auch die KMK (2016) betont im Rahmen der Auseinandersetzung mit Medienkompetenzen das Thema 'Schützen vor Risiken in technischer, datenschutzrechtlicher und privater Hinsicht' und fordert einen kritischen und reflektierten Umgang mit digitalen Ressourcen. Hierbei ist es von besonderer Wichtigkeit - im Sinne einer proaktiven Sicherheitsbewusstheit - Hinweise auf mögliche sicherheitsbezogene Gefahren zu erkennen und diese für das eigene Handeln zu berücksichtigen . Ziel der Studie ist es zu untersuchen, inwieweit ein spielbasiertes Training IT-Sicherheitsbewusstheit fördern kann. Im Spiel werden Angriffe auf die eigene IT-Sicherheit simuliert, vor denen sich der Lerner mit der richtigen Taktik verteidigen muss. Solche Angriffe, die zumeist die Ausbeutung von Vertrauen mit dem Ziel Informationen zu erhalten, anstreben, werden als Social-Engineering bezeichnet. Abstract SHBP17aepf](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![serious game](/pictures/icon/keyword/serious game.png)
![social engineering](/pictures/icon/keyword/social engineering.png)
- Beckers, K. and Pape, S.: A Serious Game for Eliciting Social Engineering Security Requirements. In Proceedings of the 24th IEEE International Conference on Requirements Engineering, IEEE Computer Society, RE '16 , 2016, Acceptance Rate: 22/79 = 27.8%.
![Social engineering is the acquisition of information about computer systems by methods that deeply include non-technical means. While technical security of most critical systems is high, the systems remain vulnerable to attacks from social engineers. Social engineering is a technique that: (i) does not require any (advanced) technical tools, (ii) can be used by anyone, (iii) is cheap. Traditional security requirements elicitation approaches often focus on vulnerabilities in network or software systems. Few approaches even consider the exploitation of humans via social engineering and none of them elicits personal behaviours of individual employees. While the amount of social engineering attacks and the damage they cause rise every year, the security awareness of these attacks and their consideration during requirements elicitation remains negligible. We propose to use a card game to elicit these requirements, which all employees of a company can play to understand the threat and document security requirements. The game considers the individual context of a company and presents underlying principles of human behaviour that social engineers exploit, as well as concrete attack patterns. We evaluated our approach with several groups of researchers, IT administrators, and professionals from industry. Abstract BP16re](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![serious game](/pictures/icon/keyword/serious game.png)
![social engineering](/pictures/icon/keyword/social engineering.png)
![hatch](/pictures/icon/project/hatch.png)
![sidate](/pictures/icon/project/sidate.png)
- Beckers, K.; Pape, S. and Fries, V.: HATCH: Hack And Trick Capricious Humans -- A Serious Game on Social Engineering. In Proceedings of the 2016 British HCI Conference, Bournemouth, United Kingdom, July 11-15, 2016, 2016.
![PDF](/pictures/icon/pdf.png)
![Social engineering is the illicit acquisition of information about computer systems by primarily non-technical means. Although the technical security of most critical systems is usually being regarded in penetration tests, such systems remain highly vulnerable to attacks from social engineers that exploit human behavioural patterns to obtain information (e.g., phishing). To achieve resilience against these attacks, we need to train people to teach them how these attacks work and how to detect them. Once realised someone is trying to trick us into taken actions that not in our best interest, we can simply say no. While traditional training techniques involve talks and questionnaires and often force employees to participate. We propose a serious game that helps players to understand how social engineering attackers work. The game can be played based on the real scenario in the company/department or based on a generic office scenario with personas that can be attacked. Our game trains people in realising social engineering attacks in an entertaining way, which shall cause a lasting learning effect. Abstract BPF16bhci](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![serious game](/pictures/icon/keyword/serious game.png)
![social engineering](/pictures/icon/keyword/social engineering.png)
![hatch](/pictures/icon/project/hatch.png)
![sidate](/pictures/icon/project/sidate.png)
- Dax, J.; Hamburg, D.; Kreusch, M.; Ley, B.; Pape, S.; Pipek, V.; Rannenberg, K.; Schmitz, C. and Terhaag, F.: Sichere Informationsinfrastrukturen für kleine und mittlere Energieversorger. In Multikonferenz Wirtschaftsinformatik (MKWI) -- Teilkonferenz IT-Sicherheit für Kritische Infrastrukturen (Poster), 2016.
![PDF](/pictures/icon/pdf.png)
![Eine sicher funktionierende Energieinfrastruktur ist für fast alle Lebensbereiche unserer heutigen Gesellschaft grundlegend. Damit die Energieversorgung im Rahmen der Energiewende auch nachhaltig sichergestellt werden kann, wird auch im Energiesektor immer mehr Informations- und Kommunikationstechnik (IKT) eingesetzt. Gleichzeitig erhöht sich dadurch jedoch auch das Risiko für IT-basierte Angriffe auf die Kritische Infrastruktur. Die effektive und effiziente Absicherung der eigenen Infrastruktur vor solchen Angriffen stellt insbesondere kleine und mittelgrosse Energienetzbetreiber mit begrenzten Ressourcen vor eine besondere Herausforderung. Im Forschungsprojekt SIDATE setzen wir an dieser Stelle an und erarbeiten geeignete Konzepte und Werkzeuge, die kleine und mittelgrosse Energieversorger bei der Verbesserung ihrer IT-Sicherheit angemessen unterstützen sollen. Der Forschungsschwerpunkt liegt dabei auf den drei Kernthemen Bewertung von IT-Sicherheit, Wissensaustausch und Zertifizierung. Wir verfolgen im Projekt eine praxisnahe Forschungsmethodik die einen intensive Einbeziehung der Energieversorger in den gesamten Forschungsprozess vorsieht. Abstract DHKLPPRST16mkwi](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![sidate](/pictures/icon/project/sidate.png)
- Dax, J.; Ley, B.; Pape, S.; Schmitz, C.; Pipek, V. and Rannenberg, K.: Elicitation of Requirements for an inter-organizational Platform to Support Security Management Decisions. In 10th International Symposium on Human Aspects of Information Security & Assurance, HAISA 2016 ,Frankfurt, Germany, July 19-21, 2016, Proceedings., 2016.
![PDF](/pictures/icon/pdf.png)
![Due to new regulations energy providers are required to obtain IT security certificates. Especially small and medium-sized energy providers struggle to fulfill these new requirements. Since most of them are in the same situation, we aim to support their collaboration with a platform. We elicited criteria from energy providers how such a platform should be designed to support them. The main contribution is a set of requirements for the collaboration platform along with the implications for its construction. The focus of this work is not on technical innovation but on how existing technologies and best practices can be adopted for the needs of small and medium-sized energy providers. Abstract DLPSPR16haisa](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![sidate](/pictures/icon/project/sidate.png)
- Pape, S.; Flake, J.; Beckmann, A. and Jürjens, J.: STAGE -- A Software Tool for Automatic Grading of Testing Exercises -- Case Study Paper. In Proceedings of the 38th International Conference on Software Engineering, ICSE 2016, Austin, TX, USA, May 14-22, 2016 - Companion Volume, pages 491-500, 2016, Acceptance rate: (22+4)/64 = (34.4 + 6.3) %.
![We report on an approach and associated tool-support for automatically evaluating and grading exercises in Software Engineering courses, by connecting various third-party tools to the online learning platform Moodle. In the case study presented here, the tool was used in several instances of a lecture course to automatically measure the test coverage criteria wrt. the test cases defined by the students for a given Java code. We report on empirical evidence gathered using this case-study (involving more than 250 students), including the results of a survey conducted after the exercises (which yielded positive feedback from the students), as well as a performance evaluation of our tool implementation. Abstract PFBJ16icse](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![software engineering](/pictures/icon/keyword/software engineering.png)
- Schaab, P.; Beckers, K. and Pape, S.: A systematic Gap Analysis of Social Engineering Defence Mechanisms considering Social Psychology. In 10th International Symposium on Human Aspects of Information Security & Assurance, HAISA 2016, Frankfurt, Germany, July 19-21, 2016, Proceedings., 2016.
![PDF](/pictures/icon/pdf.png)
![Social engineering is the acquisition of information about computer systems by methods that deeply include non-technical means. While technical security of most critical systems is high, the systems remain vulnerable to attacks from social engineers. Social engineering is a technique that: (i) does not require any (advanced) technical tools, (ii) can be used by anyone, (iii) is cheap. Traditional penetration testing approaches often focus on vulnerabilities in network or software systems. Few approaches even consider the exploitation of humans via social engineering. While the amount of social engineering attacks and the damage they cause rise every year, the defences against social engineering do not evolve accordingly. Hence, the security awareness of these attacks by employees remains low. We examined the psychological principles of social engineering and which psychological techniques induce resistance to persuasion applicable for social engineering. The techniques examined are an enhancement of persuasion knowledge, attitude bolstering and influencing the decision making. While research exists elaborating on security awareness, the integration of resistance against persuasion has not been done. Therefore, we analysed current defence mechanisms and provide a gap analysis based on research in social psychology. Based on our findings we provide guidelines of how to improve social engineering defence mechanisms such as security awareness programs. Abstract SBP16haisa](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![social engineering](/pictures/icon/keyword/social engineering.png)
- Tschersich, M.; Kiyomoto, S.; Pape, S.; Nakamura, T.; Bal, G.; Takasaki, H. and Rannenberg, K.: On Gender Specific Perception of Data Sharing in Japan. In ICT Systems Security and Privacy Protection - 31st IFIP TC 11 International Conference, SEC 2016, Ghent, Belgium, May 30 - June 1, 2016, Proceedings, pages 150-160, 2016, Acceptance rate: 27/139 = 20.9%.
![Privacy and its protection is an important part of the culture in the USA and Europe. Literature in this field lacks empirical data from Japan. Thus, it is difficult ? especially for foreign researchers ? to understand the situation in Japan. To get a deeper understanding we examined the perception of a topic that is closely related to privacy: the perceived benefits of sharing data and the willingness to share in respect to the benefits for oneself, others and companies. We found a significant impact of the gender to each of the six analysed constructs. Abstract TKPNBTR16ifipsec](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![information systems](/pictures/icon/keyword/information systems.png)
![privacy](/pictures/icon/keyword/privacy.png)
- Tesfay, W. B.; Serna, J. and Pape, S.: Challenges in Detecting Privacy Revealing Information in Unstructured Text. In Workshop on Society, Privacy and the Semantic Web - Policy and Technology PrivOn 2016 at the International Semantic Web Conference (ISWC) 2016, Kobe, Japan, 2016.
![PDF](/pictures/icon/pdf.png)
![This paper discusses the challenges in detecting privacy revealing information using ontologies, natural language processing and machine learning techniques. It reviews current definitions, and sketches problem levels towards identifying the main open challenges. Furthermore, it elicits that the current notion of personally identifiable information lacks robustness to be used in varying contexts and user perceptions, and shows the need to additionally consider privacy sensitive information. Abstract TSP16privon](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
- Pape, S.; Serna-Olvera, J. and Tesfay, W.: Why Open Data May Threaten Your Privacy. In Workshop on Privacy and Inference, co-located with KI, 2015.
![PDF](/pictures/icon/pdf.png)
![In this position paper we discuss the effect of open data on privacy. In order to reduce privacy issues due to the publication of open data, we suggest to build a database which overviews open data in a structured way with a special focus on privacy. This database could be enhanced with tools which automatically try to link existing datasets and allow publishers to check potential de-anonymization risks. Abstract PST15prinf](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
- Pape, S.: Sample or Random Security - A Security Model for Segment-Based Visual Cryptography. In Financial Cryptography and Data Security - 18th International Conference, FC 2014, Christ Church, Barbados, March 3-7, 2014, Revised Selected Papers, pages 291-303, 2014, Acceptance rate: 31 / 138 = 22.5%.
![In some scenarios, especially when visual cryptography is used, the attacker has no access to an encryption oracle, and thus is not able to mount chosen-plaintext attacks. Based on the notion of real-or-random security under chosen-plaintext attacks (ROR-CPA) given by Bellare et al., we propose the notion of sample-or-random security under ciphertext-only attacks (SOR-CO). We prove that the notion of SOR-CO is fundamentally weaker than the notion of ROR-CPA security and demonstrate the usefulness of our notion by applying it to segment-based visual cryptography. An additional contribution of this paper is the construction of a new segment-based visual encryption scheme with noise based on work by Doberitz. To our knowledge, this is the first visual encryption scheme which makes use of noise. We conjecture that it is secure in the sense of SOR-CO security if the key is not used too often and if the encryption schemes security parameters are chosen accordingly. Abstract Pape14fc](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![crypto](/pictures/icon/keyword/crypto.png)
- Bleikertz, S.; Mastelic, T.; Pape, S.; Pieters, W. and Dimkov, T.: Defining the Cloud Battlefield -- Supporting Security Assessments by Cloud Customers. In Proceedings of IEEE International Conference on Cloud Engineering (IC2E), pages 78-87, 2013, Acceptance rate: 22 / 107 = 20.6%.
![Cloud computing is becoming more and more popular, but security concerns overshadow its technical and economic benefits. In particular, insider attacks and malicious insiders are considered as one of the major threats and risks in cloud computing. As physical boundaries disappear and a variety of parties are involved in cloud services, it is becoming harder to define a security perimeter that divides insiders from outsiders, therefore making security assessments by cloud customers more difficult. In this paper, we propose a model that combines a comprehensive system model of infrastructure clouds with a security model that captures security requirements of cloud customers as well as characteristics of attackers. This combination provides a powerful tool for systematically analyzing attacks in cloud environments, supporting cloud customers in their security assessment by providing a better understanding of existing attacks and threats. Furthermore, we use the model to construct ``what-if'' scenarios that could possible lead to new attacks and to raise concerns about unknown threats among cloud customers. Abstract BMPPD13ic2e](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![secureclouds](/pictures/icon/project/secureclouds.png)
- Pape, S.; Schöch, C. and Wegner, L.: Bringing Bérardier de Bataut's Essai sur le récit to the Web: Editorial Requirements and Publishing Framework (Poster). In Poster at: TEI 2010, The 2010 Conference of the Text Encoding Initiative Consortium, 2010.
![](/pictures/icon/blank.png)
![Link](/pictures/icon/link.png)
![Bibtex](/pictures/icon/bibtex.png)
![software engineering](/pictures/icon/keyword/software engineering.png)
![teichi](/pictures/icon/project/teichi.png)
- Greveler, U.; Laskov, P. and Pape, S.: Sicherer Umgang mit sensiblen Daten - technische Prävention und Reaktionen auf Datenschutzverletzungen. In GI Jahrestagung: Informatik 2009: Im Focus das Leben, Beiträge der 39. Jahrestagung der Gesellschaft für Informatik e.V. (GI), 28.9.-2.10.2009, Lübeck, Proceedings, pages 186-190, GI, LNI 154, 2009.
![](/pictures/icon/blank.png)
![Link](/pictures/icon/link.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
- Pape, S.: A Survey on Untransferable Anonymous Credentials (extended abstract). In Pre-Proceedings of the IFIP/FIDIS Summer School on ``The Future of Identity in the Information Society'', Brno, 2008.
![](/pictures/icon/blank.png)
![Abstract. There are at least two principal approaches to prevent users from sharing their anonymous credentials: adding valuable secrets into the system the user does not want to share or embedding biometric access control. This work aims to identify possible fields of application and compare both approaches in respect of the credentials' untransferability. Abstract Pape08fidispre](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
- Pape, S. and Benamar, N.: Using Identity-Based Public-Key Cryptography with Images to Preserve Privacy (extended Abstract). In Pre-Proceedings of the IFIP/FIDIS Summer School on ``The Future of Identity in the Information Society'', Karlstad, 2007.
![](/pictures/icon/blank.png)
![We propose a public-key signature and encryption application which strongly relies on identity-based public-key cryptography. By alternately using identity information and pictures of the involved parties as public keys we preserve all advantages gained by identity-based public-key schemes, mainly including the absence of a public-key infrastructure. On the other hand, all parties obtain only obvious and necessary information about other involved parties. Abstract PB07fidispre](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![crypto](/pictures/icon/keyword/crypto.png)
![privacy](/pictures/icon/keyword/privacy.png)
- Pape, S.; Dietz, L. and Tandler, P.: Single Display Gaming: Examining Collaborative Games for Multi-User Tabletops. In Workshop on Gaming Applications in Pervasive Computing Environments at Pervasive '04, 2004.
![](/pictures/icon/blank.png)
![Abstract. Playing games has always been a joint activity. New hardware developments such as multi-user touch-sensitive tabletop surfaces offer new possibilities to support games with information technology. This paper analyzes the properties of games that are relevant for choosing an appropriate hardware setup, e.g. the need for public or personal data for different players. These properties lead us to a categorization of games. Based on these results, possible hardware configurations for different game categories are discussed. Four sample games are presented by which the influence of the hardware setup on the game has been studied. The paper concludes with the lessons learned from our classification of games and their weaknesses and the next steps we are going to make. Abstract PDT04pervasive](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![software engineering](/pictures/icon/keyword/software engineering.png)
Book Chapters
- Schmid, M. and Pape, S.: Aggregating Corporate Information Security Maturity Levels of Different Assets. In Privacy and Identity Management. Data for Better Living: AI and Privacy - 14th IFIP WG 9.2, 9.6/11.7, 11.6/SIG 9.2.2 International Summer School, Windisch, Switzerland, August 19-23, 2019, Revised Selected Papers, pages 376-392, Springer Boston, IFIP Advances in Information and Communication Technology , 2019.
![General Data Protection Regulation (GDPR) has not only a great influence on data protection but also on the area of information security especially with regard to Article 32. This article emphasizes the importance of having a process to regularly test, assess and evaluate the security. The measuring of information security however, involves overcoming many obstacles. The quality of information security can only be measured indirectly using metrics and Key Performance Indicators (KPIs), as no gold standard exist. Many studies are concerned with using metrics to get as close as possible to the status of information security but only a few focus on the comparison of information security metrics. This paper deals with aggregation types of corporate information security maturity levels from different assets in order to find out how the different aggregation functions effect the results and which conclusions can be drawn from them. The required model has already been developed by the authors and tested for applicability by means of case studies. In order to investigate the significance of the ranking from the comparison of the aggregation in more detail, this paper will try to work out in which way a maturity control should be aggregated in order to serve the company best in improving its security. This result will be helpful for all companies aiming to regularly assess and improve their security as requested by the GDPR. To verify the significance of the results with different sets, real information security data from a large international media and technology company has been used. Abstract SP19ifipsc](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
![security](/pictures/icon/keyword/security.png)
- Dax, J.; Hamburg, D.; Pape, S.; Pipek, V.; Rannenberg, K.; Schmitz, C.; Sekulla, A. and Terhaag, F.: Sichere Informationsnetze bei kleinen und mittleren Energieversorgern (SIDATE). In State of the Art: IT-Sicherheit für Kritische Infrastrukturen, pages 29, Universität der Bundeswehr, Neubiberg, 2018.
![](/pictures/icon/blank.png)
![Link](/pictures/icon/link.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![sidate](/pictures/icon/project/sidate.png)
- Dax, J.; Ley, B.; Pape, S.; Pipek, V.; Rannenberg, K.; Schmitz, C. and Sekulla, A.: Stand der IT-Sicherheit bei deutschen Stromnetzbetreibern. In State of the Art: IT-Sicherheit für Kritische Infrastrukturen, pages 69-74, Universität der Bundeswehr, Neubiberg, 2018.
![](/pictures/icon/blank.png)
![Link](/pictures/icon/link.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![sidate](/pictures/icon/project/sidate.png)
- Dax, J.; Pape, S.; Pipek, V.; Rannenberg, K.; Schmitz, C.; Sekulla, A. and Terhaag, F.: Das SIDATE-Portal im Einsatz. In State of the Art: IT-Sicherheit für Kritische Infrastrukturen, pages 145-150, Universität der Bundeswehr, Neubiberg, 2018.
![PDF](/pictures/icon/pdf.png)
![Link](/pictures/icon/link.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![sidate](/pictures/icon/project/sidate.png)
- Hamburg, D.; Niephaus, T.; Noll, W.; Pape, S.; Rannenberg, K. and Schmitz, C.: SIDATE: Gefährdungen und Sicherheitsmassnahmen. In State of the Art: IT-Sicherheit für Kritische Infrastrukturen, pages 51, Universität der Bundeswehr, Neubiberg, 2018.
![PDF](/pictures/icon/pdf.png)
![Link](/pictures/icon/link.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![sidate](/pictures/icon/project/sidate.png)
- Kipker, D-K.; Pape, S.; Wojak, S. and Beckers, K.: Juristische Bewertung eines Social-Engineering-Abwehr Trainings. In State of the Art: IT-Sicherheit für Kritische Infrastrukturen, pages 112-115, Universität der Bundeswehr, Neubiberg, 2018.
![PDF](/pictures/icon/pdf.png)
![Link](/pictures/icon/link.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![serious game](/pictures/icon/keyword/serious game.png)
![social engineering](/pictures/icon/keyword/social engineering.png)
![hatch](/pictures/icon/project/hatch.png)
![sidate](/pictures/icon/project/sidate.png)
- Harborth, D. and Pape, S.: Privacy Concerns and Behavior of Pokémon Go Players in Germany. In Privacy and Identity Management. The Smart Revolution - 12th IFIP WG 9.2, 9.5, 9.6/11.7, 11.6/SIG 9.2.2 International Summer School, Ispra, Italy, September 4-8, 2017, Revised Selected Papers, pages 314-329, Springer International Publishing, IFIP Advances in Information and Communication Technology 526, 2017.
![We investigate privacy concerns and the privacy behavior of users of the AR smartphone game Pokémon Go. Pokémon Go accesses several functionalities of the smartphone and, in turn, collects a plethora of data of its users. For assessing the privacy concerns, we conduct an online study in Germany with 683 users of the game. The results indicate that the majority of the active players are concerned about the privacy practices of companies. This result hints towards the existence of a cognitive dissonance, i.e. the privacy paradox. Since this result is common in the privacy literature, we complement the first study with a second one with 199 users, which aims to assess the behavior of users with regard to which measures they undertake for protecting their privacy. The results are highly mixed and dependent on the measure, i.e. relatively many participants use privacy-preserving measures when interacting with their smartphone. This implies that many users know about risks and might take actions to protect their privacy, but deliberately trade-off their information privacy for the utility generated by playing the game. Abstract HP17ifipsc](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![information systems](/pictures/icon/keyword/information systems.png)
![privacy](/pictures/icon/keyword/privacy.png)
![anon](/pictures/icon/project/anon.png)
- Pape, S.: Technische Bedingungen wirksamer Verschlüsselung. In Jahrbuch 2016, Deutsche Gesellschaft für Recht und Informatik, 2017, available via https://www.dgri.de/55/Publikationen/Schriftenreihe-der-DGRI.htm.
![](/pictures/icon/blank.png)
![Link](/pictures/icon/link.png)
![Bibtex](/pictures/icon/bibtex.png)
![crypto](/pictures/icon/keyword/crypto.png)
![security](/pictures/icon/keyword/security.png)
- Pape, S.: A Survey on Non-transferable Anonymous Credentials. In The Future of Identity in the Information Society, pages 107-118, Springer Boston, Brno, Czech Republic, IFIP Advances in Information and Communication Technology 298, 2009.
![There are at least two principal approaches to prevent users from sharing their anonymous credentials: adding valuable secrets into the system the user does not want to share or embedding biometric access control. This paper seeks to identify possible fields of application and to compare both approaches with respect to the credentials' non-transferability. The paper shows that both approaches do not ensure the non- transferability of anonymous credentials, but may be applicable in some fields. On the one hand, it might be hard to find valuable secrets to really prevent the sharing of credentials, in particular with close family members. On the other hand, biometric sensors embedded in a smartcard can be circumvented with some effort, especially if access control is unattended. Although the combination of both approaches may prevent more users from sharing their credentials, it suffers from restrictions of both approaches and from the effort needed to put it in place. However, assuming that anonymous credentials will probably not be used in high-security environments, both approaches might be sufficient to prevent sharing in some applications. If the users already possess personal digital assistants, embedded valuable secrets are a quite cheap solution, even though they raise the system's value. If access control is attended, biometric sensors are reasonably safe and limit the possibility of unintentionally sharing the credentials for free. Abstract Pape09ifipsc](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
- Pape, S. and Benamar, N.: Using Identity-Based Public-Key Cryptography with Images to Preserve Privacy. In The Future of Identity in the Information Society, pages 299-310, Springer Boston, IFIP International Federation for Information Processing 262, 2008.
![We propose a public-key signature and encryption application which strongly relies on identity-based public-key cryptography. By alternately using obvious identity information like names and essential image data of the involved parties as public keys we preserve all advantages gained by identity-based public-key schemes, mainly including the absence of a public-key infrastructure. On the other hand, all parties obtain only obvious and necessary information about other involved parties. Abstract PB08ifipsc](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![crypto](/pictures/icon/keyword/crypto.png)
![privacy](/pictures/icon/keyword/privacy.png)
Theses
- Pape, S.: Requirements Engineering and Tool-Support for Security and Privacy.
![](/pictures/icon/blank.png)
![In order to address security and privacy problems in practice, it is very important to have a solid elicitation of requirements, before trying to address the problem. In this thesis, specific challenges of the areas of social engineering, security management and privacy enhancing technologies are analyzed: Social Engineering: An overview of existing tools usable for social engineering is provided and defenses against social engineering are analyzed. Serious games are proposed as a more pleasant way to raise employees' awareness and to train them. Security Management: Specific requirements for small and medium sized energy providers are analyzed and a set of tools to support them in assessing security risks and improving their security is proposed. Larger enterprises are supported by a method to collect security key performance indicators for different subsidiaries and with a risk assessment method for apps on mobile devices. Furthermore, a method to select a secure cloud provider - the currently most popular form of outsourcing - is provided. Privacy Enhancing Technologies: Relevant factors for the users' adoption of privacy enhancing technologies are identified and economic incentives and hindrances for companies are discussed. Privacy by design is applied to integrate privacy into the use cases e-commerce and internet of things. Abstract Pape20habil](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![iot](/pictures/icon/keyword/iot.png)
![privacy](/pictures/icon/keyword/privacy.png)
![security](/pictures/icon/keyword/security.png)
![serious game](/pictures/icon/keyword/serious game.png)
![social engineering](/pictures/icon/keyword/social engineering.png)
- Pape, S.: The Challenge of Authentication in Insecure Environments.
![](/pictures/icon/blank.png)
![](/pictures/icon/blank.png)
![Bibtex](/pictures/icon/bibtex.png)
![crypto](/pictures/icon/keyword/crypto.png)
![privacy](/pictures/icon/keyword/privacy.png)
![security](/pictures/icon/keyword/security.png)
- Pape, S.: Sicherheitsmodelle für das Ajtai-Dwork-Kryptosystem.
![PDF](/pictures/icon/pdf.png)
![Ziel der Diplomarbeit war es, zu untersuchen, welche Sicherheitsmodelle durch das Ajtai-Dwork-Kryptosystem erfuellt werden. Dazu wurden verschiedene Absichten und Faehigkeiten eines potentiellen Angreifersvorgestellt. Als zu untersuchende Sicherheitsmodelle kristallisierten sich die von Bellare, Desai, Pointcheval und Rogaway in [BDPR98] bzw. [BDPR01] vorgeschlagenen Sicherheitsmodelle heraus. Dies lag zum einen daran, dass andere Angriffe - wie der Ciphertext-Verification-Angriff von Halevi und Krawczyk [HK99] oder der Reaktionsangriff von Hall, Goldberg und Schneier [HGS99] - sich auf Chosen-Plaintext-Angriffe zurueckfuehren liessen. Zum anderen konnten andere Sicherheitsziele wie bspw. Plaintext-Awareness nicht in passender Weise auf das Ajtai-Dwork-Kryptosystem angewandt werden. Also wurden die verschiedenen Varianten des Ajtai-Dwork-Kryptosystems daraufhin untersucht, ob sie Indistinguishability oder Non-Malleability unter Chosen-Plaintext-Angriffen und (non-)adaptive Chosen-Ciphertext- Angriffen bieten koennen. Dabei stellte sich heraus, dass keine der Varianten sicher im Sinne von Non-Malleability unter Chosen-Plaintext-Angriffen (NM-CPA) oder sicher im Sinne von Indistinguishability unter non-adaptive Chosen-Ciphertext-Angriffen (IND-CCA1) ist. Im Falle der beschraenkten Variante reichte es dazu aus, die Idee des Reduktionsbeweises von Ajtai und Dwork zu betrachten. Der Reduktionsbeweis zeigt, dass ein Angreifer, der in der Lage ist, Verschluesselungen von Null und Eins zu unterscheiden, auch in der Lage ist, den privaten Schluessel zu errechnen. Da sich Non-Malleability unter Chosen-Plaintext-Angriffen auf Indistinguishability unter Parallel-Angriffen zurueckfuehren laesst, steht dem Angreifer in beiden Faellen ein Entschluesselungsorakel zur Verfuegung. Damit kann er Verschluesselungen von Null von Verschluesselungen von Eins unterscheiden und somit den privaten Schluessel erlangen. Bei der unbeschraenkten Variante war dies nur fuer Indistinguishability unter non-adaptive Chosen-Ciphertext-Angriffen moeglich. Wir konnten jedoch einen Parallel-Angriff auf die Indistinguishability der unbeschraenkten Variante zeigen. Dieser macht sich zu Nutze, dass Ciphertexte Punkte im n- dimensionalen Raum sind und Punkte, die dicht beieinander liegen, mit hoher Wahrscheinlichkeit als Verschluesselungen desselben Klartextes betrachtet werden koennen. Der Angreifer kann also das Entschluesselungsorakel nach entsprechenden Punkten fragen und so Informationen ueber den zu entschuesselnden Ciphertext erhalten. Der Reduktionsbeweis der Hauptvariante des Ajtai-Dwork-Kryptosystems konnte jedoch nicht direkt fuer einen non-adaptive Chosen-Ciphertext-Angriff auf die Indistinguishability genutzt werden. Stattdessen konnten wir aber den von Hall, Goldberg und Schneier in [HGS99] gezeigten Reaktionsangriff auf die Variante nach Goldreich, Goldwasser und Halevi in einen erfolgreichen Angriff auf die Hauptvariante aendern. Die Idee des Angriffes ist, durch Anfragen an das Entschluesselungsorakel die Laenge des privaten Schluesselvektors zu approximieren. Ist die Laenge jeder Dimension bekannt, so kann durch weitere Anfragen an das Orakel das Vorzeichen der jeweiligen Dimension und so der private Schluessel herausgefunden werden. Chosen-Plaintext-Angriffe auf die Non-Malleability liessen sich aehnlich den Angriffen in der unbeschraenkten Variante durchfuehren. Fuer non-adaptive Chosen-Ciphertext-Angriffe auf die Indistinguishability der Variante nach Goldreich, Goldwasser und Halevi konnte der eben beschriebene Reaktionsangriff von Hall, Goldberg und Schneier direkt verwendet werden. Allerdings mussten noch zwei Fehler aus der Darstellung in [HGS99] beseitigt werden. Auch bei dieser Variante liessen sich Chosen- Plaintext-Angriffe auf die Non-Malleability aehnlich den Angriffen in der unbeschraenkten Variante durchfuehren. Da alle hier gezeigten Angriffe elementare Eigenschaften des Ajtai-Dwork- Kryptosystems nutzen, ist fuer keine der vier Varianten eine 'Reparatur' des Kryptosystems durch einfache Modifikationen moeglich. Wie in der Einleitung schon angedeutet, wiegt jedoch schwerer, dass auch Chosen-Plaintext-Angriffe auf das Ajtai-Dwork-Kryptosystem von Nguyen und Stern [NS98, NS99] gefunden wurden. Dazu wurden Gitterbasisreduktionsalgorithmen benutzt, um das Shortest-Vector-Problem zu approximieren und so den privaten Schluessel zu errechnen. Wie Nguyen und Stern aufzeigen, benoetigt man dadurch so immens grosse Schluessel, dass der praktische Einsatz des Ajtai-Dwork-Kryptosystems nicht in Frage kommt. Als Ausblick verweisen wir auf das von Regev entwickelte Kryptosystem [Reg03b], dessen Sicherheit auf der Worst-Case Schwierigkeit des n^(1.5) - unique Shortest-Vector-Problem beruht. Eine gruendliche Untersuchung dieses Systems konnte im Rahmen dieser Diplomarbeit nicht erfolgen. Der Angriff auf die Non-Malleability unter Chosen-Plaintext-Angriffen konnte jedoch vom Ajtai-Dwork-Kryptosystem auf Regevs System uebertragen werden. Abstract pape04thesis](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![crypto](/pictures/icon/keyword/crypto.png)
Datasets
- Harborth, D. and Pape, S.: Dataset on Actual Users of the Privacy-Enhancing Technology Jondonym. IEEE Dataport, 2020.
![This dataset was collected for research conducted within the project AN.ON-Next funded by the German Federal Ministry of Education and Research (BMBF) with grant number: 16KIS0371. The dataset includes - among others - constructs from different established models of the literature like the technology acceptance model (TAM) by Davis (1985) and the Internet Users Information Privacy Concerns (IUIPC) model by Malhotra et al. (2004). Furthermore, there are extensive questions on privacy literacy covered by the online privacy literacy scale (OPLIS) by Masur et al. (2017). See Table 1 for the complete list of questions in the dataset. Abstract HP20dataportJD](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
![anon](/pictures/icon/project/anon.png)
- Harborth, D. and Pape, S.: Dataset on Actual Users of the Privacy-Enhancing Technology Tor. IEEE Dataport, 2020.
![This dataset was collected for research conducted within the project AN.ON-Next funded by the German Federal Ministry of Education and Research (BMBF) with grant number: 16KIS0371. The dataset is based on an online survey with actual users of the Tor technology. The dataset includes - among others - constructs from different established models of the literature like the technology acceptance model (TAM) by Davis (1985) and the Internet Users Information Privacy Concerns (IUIPC) model by Malhotra et al. (2004). Furthermore, there are extensive questions on privacy literacy covered by the online privacy literacy scale (OPLIS) by Masur et al. (2017). Abstract HP20dataportTor](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
![anon](/pictures/icon/project/anon.png)
Techreports and Other Contributions
- Goeke, L.; Pape, S. and Tsakirakis, G.: THREAT-ARREST serious games v2. Technical Report Deliverable 4.9, Threat-Arrest, 2021.
![](/pictures/icon/blank.png)
![This deliverable is the result of the second and last iteration of activities with respect to task 'T4.2 - Serious gaming tools'. It describes the concepts and implementation of the gaming tools AWARENESS QUIZ and PROTECT as well as their integration into THREAT - ARREST training scenarios. Additionally, the physical and multi-player card game HATCH is described. This second version updates the deliverable 'D4.2 - THREAT-ARREST serious games v1' from month 12. Compared to D4.2, the main update considers the architecture of the AWARENESS QUIZ components and their implementation. Furthermore, improvements of PROTECT are described. Regarding HATCH, a new gaming scenario and a process for the creation of game scenarios are introduced. Abstract TA21D4.9](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![threat-arrest](/pictures/icon/project/threat-arrest.png)
- Miller, V. M.; Miller, M.; Rannenberg, K.; Niknia, A.; Arastouei, N.; Pape, S.; Skarmeta, A.; Ferreira, A.; Markatos, E.; Matyas, V.; Crabu, M.; Lopez, J.; Fernandez, C.; Pasic, A.; Omerovic, A.; Lafuente, A. L.; Angelini, M.; Hemetsberger, L.; Halunen, K.; Krenn, S.; Annicchino, P.; Kamm, L.; Goodman, D.; Goodman, R.; Surinx, D.; Preuveneers, D.; Sterlini, P.; Kadenko, N.; Douligeris, C. and Benzekri, A.: Clustering results and SU-ICT-03 project CONCERTATION conference year 1. Technical Report, CyberSec4Europe, 2020.
![](/pictures/icon/blank.png)
![This deliverable is intended to capture the key discussions and messages resulting from the first CyberSec4Europe Concertation Event held in Toulouse, France in November 2019. In addition, the document also includes a summary of collaboration activities undertaken by CyberSec4Europe project partners over the first one year of the project. In the original description of this deliverable a clustering task was included, however, this project clustering was actually first done at the CyberSec4Europe proposal stage (a summary of which is included as Figure 1, and furthermore, since another H2020 project (Cyberwatching.eu) has undertaken an extensive effort to address this specific task including more than 150 projects, rather than repeating the efforts, we have made the decision to place more work upon the key elements of the high level concertation event and the extensive collaboration work undertaken by the CyberSec4Europe partners. The concertation event included the active participation and discussions with top level European representatives from industry (e.g. Airbus), academia & research (e.g. IRIT and many other research and universities), the European Commission (e.g. DG CNECT), regional and national government (e.g. France and Occitanie Region), as well as a very significant and broad comprehensive set of stakeholders both from outside the consortium and as partners within CyberSec4Europe. The results, recommendations and conclusions are truly representative of the broadest set of inputs and feedback from the different communities and stakeholders, and as such can be used to form the basis for informed decision-making looking forward well into the future. Abstract CS4E20D10.1](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
![security](/pictures/icon/keyword/security.png)
![cs4e](/pictures/icon/project/cs4e.png)
- Canavese, D.; Lioy, A.; Pedone, I.; Regano, L.; Hatamian, M.; Löbner, S.; Pape, S.; Arastouei, N.; Skarmeta, A.; Hita, A. and Bernal, J.: Cybersecurity outlook 1. Technical Report, CyberSec4Europe, 2020.
![](/pictures/icon/blank.png)
![This deliverable describes the state-of-the-art, the current trends that are currently emerging in the cybersecurity field. This document is the first outcome of Task 3.9 'Continuous scouting', whose goal is to constantly look for new outgoing research challenges and developments that can provide interesting ideas not only to the academic partners, but also to the use case owners. Henceforth, this document reports a variety of new advancements, and emerging security technologies in various branches, such as artificial intelligence, 5G applications and trusted execution environments, that, in the near future, could play a pivotal role in our daily lives, but, at least for now, provide us with new hints and food for thoughts. Abstract CS4E20D3.10](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
![security](/pictures/icon/keyword/security.png)
![cs4e](/pictures/icon/project/cs4e.png)
- Halunen, K.; Cheminod, M.; Beckerle, M.; Durante, L.; Preuveneers, D.; Kompara, M.; Martinie, C.; Bernabe, J. B.; Garofalo, G.; Tesfay, W. B.; Pape, S.; Palanque, P.; Crispo, B. and Gupta, S.: Usable security & privacy methods and recommendations. Technical Report, CyberSec4Europe, 2020.
![](/pictures/icon/blank.png)
![This document presents the most relevant state of the art in usable security and privacy as well as usability related to these topics in the context of Cyber Security for Europe project. The document focuses on the most relevant use cases as identified in the demonstrators of this project. In the end, four recommendations are provided both for general use and in the context of use cases from CyberSec4Europe. We recommend the use of authenticated encryption whenever possible, early user involvement in the development of new security and privacy features, user modeling and tests for new features and the use of authentication methods that are secure and privacy-friendly. Also, future directions for research in these topics are provided. The main concern is to keep up with the changing user behavior and security and privacy technologies and threats. Abstract CS4E20D3.5](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
![security](/pictures/icon/keyword/security.png)
![cs4e](/pictures/icon/project/cs4e.png)
- Crispo, B.; Gupta, S.; Halunen, K.; Kompara, M.; Preuveneers, D.; Palanque, P.; Beckerle, M.; Martinie, C.; Hita, A. and Pape, S.: Usability Requirements Validation. Technical Report, CyberSec4Europe, 2020.
![](/pictures/icon/blank.png)
![This document presents the most relevant state of the art in usability requirements validation methodology and frameworks and puts them in relation to the security and privacy usability requirements that emerged in the context of the Cyber Security for Europe project. Then, it presents the most important research works about validation of usability in the security and privacy field, showing that there are many important choices and decisions to take while designing the validation process. Thus, in the end, the document presents some recommendations that ought to be considered while designing a security and privacy usability requirements validation process in general and in the specific context of the use cases related to CyberSec4Europe. Abstract CS4E20D3.7](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
![security](/pictures/icon/keyword/security.png)
![cs4e](/pictures/icon/project/cs4e.png)
- Koshutanski, H.; Frati, F.; Hildebrandt, T.; Hatzivasilis, G.; Fysarakis, K.; Smyrlis, M.; Spanoudakis, G.; Blinder, O.; Goeke, L.; Pape, S.; Leftheriotis, G.; Tsakirakis, G.; Bravos, G. and Kunc, M.: Initial Prototype of Integrated THREAT-ARREST Platform. Technical Report, Threat-Arrest, 2020.
![](/pictures/icon/blank.png)
![This document presents the first version of the integrated THREAT-ARREST platform. The THREAT-ARREST training is offered as a service to organizations through a Web-based GUI. The first version of the platform is released along three full-fledged training scenarios for Smart Energy, Smart Transportation, and Healthcare, each addressing trainees of different knowledge and skills. Credentials to access the platform are provided in the document to facilitate demonstration and validation in pilot activities. The first version successfully integrates and orchestrates the various training capabilities such as emulation, simulation, gamification, visualization, user scoring, and CTTP model creation. Abstract TA20D6.1](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![threat-arrest](/pictures/icon/project/threat-arrest.png)
- Koshutanski, H.; Frati, F.; Hildebrandt, T.; Hatzivasilis, G.; Fysarakis, K.; Smyrlis, M.; Spanoudaki, S.; Spanoudakis, G.; Blinder, O.; Goeke, L.; Quintanar, A.; Pape, S.; Tsakirakis, G. and Bravos, G.: Initial installation and usage guidelines for the THREAT-ARREST platform. Technical Report, Threat-Arrest, 2020.
![](/pictures/icon/blank.png)
![This document reports on the installation procedures and guidelines for the usage of the THREAT-ARREST platform first version. It overviews the installation necessary to deploy an instance of a THREAT-ARREST platform and guidelines for using the platform's GUI. The guidelines primarily address trainees, trainers, and those responsible for the creation of CTTP models. The platform training capabilities have been developed and provided as a service to end user (pilot) organisations. Abstract TA20D6.2](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![threat-arrest](/pictures/icon/project/threat-arrest.png)
- Frati, F. and Braghin, C., ed.: The Stakeholders' Engagement & Online Channels Report. Technical Report, Threat-Arrest, 2020.
![](/pictures/icon/blank.png)
![This deliverable provides a report of the communication activities executed by the consortium within the first half of the project and the engagement of stakeholders so far. These activities are performed under the task 'T8.1 - Communication and Engagement of Stakeholders'. Abstract TA20D8.4](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![threat-arrest](/pictures/icon/project/threat-arrest.png)
- Sofia, S.; Konstantina, K.; Tsantekidis, M.; Pape, S.; Leftheriotis, G.; Chieti, A.; Oikonomou, F. and Bravos, G.: The THREAT-ARREST dissemination and exploitation report v.1 1. Technical Report Deliverable 8.5, Threat-Arrest, 2020.
![](/pictures/icon/blank.png)
![This deliverable provides the 1 st version of the dissemination and exploitation report for the THREAT-ARREST project. Abstract TA20D8.5](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![threat-arrest](/pictures/icon/project/threat-arrest.png)
- Koshutanski, H.; Tsantekidis, M.; Damiani, E.; Frati, F.; Cimato, S.; Riccobene, E.; Hatzivasilis, G.; Fysarakis, K.; Spanoudakis, G.; Blinder, O.; Vinov, M.; Hildebrandt, T.; Wortmann, D.; Rompoti, V.; Bravos, G.; Chatzigiannakis, V.; Beckers, K.; Pape, S.; Kunc, M. and Bašta, P.: THREAT-ARREST platform's initial reference architecture. Technical Report Deliverable 1.3, Threat-Arrest, 2019.
![](/pictures/icon/blank.png)
![This deliverable presents the initial version for the THREAT-ARREST platform architecture, focusing on the Data Flow and Component Communication views between the underlying tools. It extends the architecture in DoA with relevant details on data dependence and communication among the tools, and provides initial specification of each main tool of the platform. As initial architecture, this document will serve as input to further project activities and developments. The work is developed under the task 'T1.3 - Initial Platform architecture'. Abstract TA19D1.3](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![threat-arrest](/pictures/icon/project/threat-arrest.png)
- Beckers, K.; Goeke, L.; Pape, S. and Bravos, G.: THREAT-ARREST THREAT serious games v1. Technical Report Deliverable 4.2, Threat-Arrest, 2019.
![](/pictures/icon/blank.png)
![This deliverable reports on the status of developing and interconnecting serious gaming tools to the THREAT- -ARREST ARREST training platform. The serious games to be developed will mainly be used to for training against social security threats and attacks and will be aimed at enhancing trainees' ability to resist and mitigate social security attacks in realistic cyber system environments. We provide an overview on the serious games, their integration into the THREAT-ARREST ARREST training platform and their current development status. Abstract TA19D4.2](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![serious game](/pictures/icon/keyword/serious game.png)
![social engineering](/pictures/icon/keyword/social engineering.png)
![threat-arrest](/pictures/icon/project/threat-arrest.png)
- Harborth, D. and Pape, S.: German Translation of the Concerns for Information Privacy (CFIP) Construct. Technical Report, SSRN, 2018.
![We present and validate a German translation of the construct Concerns for Information Privacy (CFIP). This construct, consisting of four sub-constructs, measures the privacy concerns of individuals with regard to organiziational privacy practices. With this scope, the construct has a wide applicability for quantitative research on privacy. We surveyed participants on the location-based mobile augmented reality game Pokémon Go. We conducted the translation with the help of two independent and certified translators and tested the validity and reliability of the constructs by conducting a confirmatory factor analysis (CFA). The analysis is based on a sample of 681 active players of the game. The participants were acquired with the help of a certified German panel provider. The results indicate the validity and reliability of the German translation of the CFIP construct for the case of Pokémon Go. Professional translations of existing constructs are necessary to apply established models and associated questionnaires in other countries. This holds in particular, because language may influence survey responses, especially with regard to attitudes. However, these translations are associated with high monetary costs and efforts and seldom published. Therefore, we provide opportunities for future work by making our valid and reliable German translation of the CFIP construct accessible to interested researchers. Abstract HP18ssrn_cfip](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
![anon](/pictures/icon/project/anon.png)
- Harborth, D. and Pape, S.: German Translation of the Unified Theory of Acceptance and Use of Technology 2 (UTAUT2) Questionnaire. Technical Report, SSRN, 2018.
![We present and validate a German translation of the questionnaire of the Unified Theory of Acceptance and Use of Technology 2 (UTAUT2). For this case, we surveyed participants on the location-based mobile augmented reality game Pokémon Go. We conducted the translation with the help of two independent and certified translators and tested the validity and reliability of the constructs by analysing a partial least squares structural equation model. The analysis is based on a sample of 681 active players of the game. The participants were acquired with the help of a certified German panel provider. The results indicate the validity and reliability of the German translation of the constructs for the case of Pokémon Go. Professional translations of existing constructs are necessary to apply established models and associated questionnaires in other countries. In particular, because language may influence survey responses, especially with regard to attitudes. However, these translations are associated with high monetary costs and efforts and seldom published. Therefore, with this work we provide opportunities for future work by making our valid and reliable German translation of the UTAUT2 questionnaire accessible to interested researchers. Abstract HP18ssrn_utaut](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![information systems](/pictures/icon/keyword/information systems.png)
![anon](/pictures/icon/project/anon.png)
- Pape, S.; Pipek, V.; Rannenberg, K.; Schmitz, C.; Sekulla, A. and Terhaag, F.: Stand zur IT-Sicherheit deutscher Stromnetzbetreiber : technischer Bericht. Technical Report, Universität Siegen, 2018.
![PDF](/pictures/icon/pdf.png)
![Innerhalb des Forschungsprojektes 'Sichere Informationsnetze bei kleinen und mittleren Energieversorgern' (SIDATE) wurde eine Umfrage zum Stand der IT-Sicherheit bei deutschen Stromnetzbetreibern durchgeführt. Das Projekt selbst beschäftigt sich mit der Informations-Sicherheit bei kleinen und mittleren Energieversorgern. Zur Durchführung der Umfrage wurden alle 890 im September 2018 bei der Bundesnetzagentur gelisteten Betreiber angeschrieben. Der Fragebogen ist eine Fortführung der im Herbst 2016 durchgeführten Umfrage zum Stand der IT-Sicherheit bei deutschen Stromnetzbetreibern 1 . In dem Umfragezeitraum vom 10. September 2018 bis zum 30. Oktober 2018 antworten 84 (9,4%) der Betreiber. Der Fragebogen fokussiert die Umsetzung der rechtlichen Anforderungen und die Implementierung eines Informationssicherheitsmanagementsystems (ISMS). Weiterhin wurden Fragen zu dem Leitsystem, Netzaufbau, Prozessen, organisatorischen Strukturen und der Büro-IT gestellt. Abstract PPRSST18tr](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![sidate](/pictures/icon/project/sidate.png)
- Dax, J.; Ivan, A.; Ley, B.; Pape, S.; Pipek, V.; Rannenberg, K.; Schmitz, C. and Sekulla, A.: IT Security Status of German Energy Providers. Technical Report, Cornell University, arXiv, 2017.
![PDF](/pictures/icon/pdf.png)
![As part of the research project 'Secure information networks of small- and medium-sized energy providers' (SIDATE), a survey about the IT security status of German energy providers was conducted. The project itself is focused on the IT security of small- and medium-sized energy providers. In August 2016, 881 companies listed by the Federal Network Agency were approached. Between, September 1 st 2016 and October 15 th 2016, 61 (6.9%) of the companies replied. The questionnaire focuses on the implementation of the regulatory requirements and on the implementation of an information security management system (ISMS). Additionally, questions about the energy control system, the network structure, processes, organisational structures, and the IT department were asked. Questions were asked in German, so all questions and answers are translated for this report. ----- Innerhalb des Forschungsprojektes 'Sichere Informationsnetze bei kleinen und mittleren Energieversorgern' (SIDATE) wurde eine Umfrage zum Stand der IT-Sicherheit bei deutschen Stromnetzbetreibern durchgeführt. Das Projekt selbst beschäftigt sich mit der nformations-Sicherheit bei kleinen und mittleren Energieversorgern. Zur Durchführung der Umfrage wurden alle 881 im August 2016 bei der Bundesnetzagentur gelisteten Betreiber angeschrieben. In dem Umfragezeitraum vom 1. September 2016 bis zum 15. Oktober 2016 antworten 61 (6.9%) der Betreiber. Der Fragebogen fokussiert die Umsetzung der rechtlichen Anforderungen und die Implementierung eines Informationssicherheitsmanagementsystems (ISMS). Weiterhin wurden Fragen zu dem Leitsystem, Netzaufbau, Prozessen, organisatorischen Strukturen und der Büro-IT gestellt. Abstract DILPPRSS17tr](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![sidate](/pictures/icon/project/sidate.png)
- Dax, J.; Ley, B.; Pape, S.; Pipek, V.; Rannenberg, K.; Schmitz, C. and Sekulla, A.: Stand zur IT-Sicherheit deutscher Stromnetzbetreiber : technischer Bericht. Technical Report, Universität Siegen, 2017.
![PDF](/pictures/icon/pdf.png)
![Innerhalb des Forschungsprojektes 'Sichere Informationsnetze bei kleinen und mittleren Energieversorgern' (SIDATE) wurde eine Umfrage zum Stand der IT-Sicherheit bei deutschen Stromnetzbetreibern durchgeführt. Das Projekt selbst beschäftigt sich mit der Informations-Sicherheit bei kleinen und mittleren Energieversorgern. Zur Durchführung der Umfrage wurden alle 881 im August 2016 bei der Bundesnetzagentur gelisteten Betreiber angeschrieben. In dem Umfragezeitraum vom 1. September 2016 bis zum 15. Oktober 2016 antworten 61 (6.9%) der Betreiber. Der Fragebogen fokussiert die Umsetzung der rechtlichen Anforderungen und die Implementierung eines Informationssicherheitsmanagementsystems (ISMS). Weiterhin wurden Fragen zu dem Leitsystem, Netzaufbau, Prozessen, organisatorischen Strukturen und der Büro-IT gestellt. Nachfolgend werden alle auswertbaren Ergebnisse der Umfrage präsentiert. Einige Fragen wurden nur ungenügend beantwortet, sodass auf eine Präsentation dieser Ergebnisse verzichtet worden ist. Abstract DLPPRSS17tr](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![sidate](/pictures/icon/project/sidate.png)
- Harborth, D.; Herrmann, D.; Köpsell, S.; Pape, S.; Roth, C.; Federrath, H.; Kesdogan, D. and Rannenberg, K.: Integrating Privacy-Enhancing Technologies into the Internet Infrastructure. Technical Report, Cornell University, arXiv, 2017.
![PDF](/pictures/icon/pdf.png)
![The AN.ON-Next project aims to integrate privacy-enhancing technologies into the internet's infrastructure and establish them in the consumer mass market. The technologies in focus include a basis protection at internet service provider level, an improved overlay network-based protection and a concept for privacy protection in the emerging 5G mobile network. A crucial success factor will be the viable adjustment and development of standards, business models and pricing strategies for those new technologies. Abstract HHKPRFKR17anon](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
![anon](/pictures/icon/project/anon.png)
- Ochoa, M.; Pape, S.; Ruhroth, T.; Sprick, B.; Stenzel, K. and Sudbrock, H.: Report on the RS3 Topic Workshop "Security Properties in Software Engineering". Technical Report, Universitätsbibliothek der Universität Augsburg, Universitätsstr. 22, 86159 Augsburg, 2012.
![PDF](/pictures/icon/pdf.png)
![This report is a compilation of results from the two workshops as well as discussions from the RS 3 annual meeting held at Karlsruhe Institute of Technology in September 2011. It includes approaches to formally model security requirements of a reviewing system; approaches to formally model confidentiality and integrity requirements for mobile applications; lessons learned, and a categorized collection of informal security requirements. Abstract OPRSSS12tr](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![security](/pictures/icon/keyword/security.png)
![software engineering](/pictures/icon/keyword/software engineering.png)
![modelsec](/pictures/icon/project/modelsec.png)
- Pape, S.; Schöch, C. and Wegner, L.: A Framework for TEI-Based Scholarly Text Editions. Technical Report, Universität Kassel, 2010.
![PDF](/pictures/icon/pdf.png)
![In this paper, we describe an interdisciplinary project in which visualization techniques were developed for and applied to scholarly work from literary studies. The aim was to bring Christof Schöch's electronic edition of Berardier de Bataut's Essai sur le recit (1776) to the web. This edition is based on the Text Encoding Initiative's XML-based encoding scheme (TEI P5, subset TEI-Lite). This now de facto standard applies to machine-readable texts used chiefly in the humanities and social sciences. The intention of this edition is to make the edited text freely available on the web, to allow for alternative text views (here original and modern/corrected text), to ensure reader-friendly annotation and navigation, to permit on-line collaboration in encoding and annotation as well as user comments, all in an open source, generically usable, lightweight package. These aims were attained by relying on a GPL-based, public domain CMS (Drupal) and combining it with XSL-Stylesheets and Java Script. Abstract PSW10tr](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![software engineering](/pictures/icon/keyword/software engineering.png)
![teichi](/pictures/icon/project/teichi.png)
- Wolf, C.; Pape, S. and Porada, L.: Leitfaden zur Gründung von GI - Studierendengruppen (GI-SG). , 2010.
![](/pictures/icon/blank.png)
![Link](/pictures/icon/link.png)
![Bibtex](/pictures/icon/bibtex.png)
- Pape, S.: Some Observations on Reusing One-Time Pads within Dice Codings (abstract). Technical Report, in Tagungsband zum 10. Kryptotag, Workshop der Fachgruppe Angewandte Kryptologie in der Gesellschaft für Informatik, 2009.
![](/pictures/icon/blank.png)
![](/pictures/icon/blank.png)
![Bibtex](/pictures/icon/bibtex.png)
![crypto](/pictures/icon/keyword/crypto.png)
- Pape, S.: Templateless Biometric-Enforced Non-Transferability of Anonymous Credentials (extended abstract). Technical Report, Weimar, in Book of Abstracts of the 2nd Weekend of Cryptography, 2008.
![](/pictures/icon/blank.png)
![Link](/pictures/icon/link.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)
- Pape, S.: Embedding Biometric Information into Anonymous Credentials. Technical Report 68, in Extended Abstracts of the Second Privacy Enhancing Technologies Convention (PET-CON 2008.1), 2008.
![](/pictures/icon/blank.png)
![Anonymous credentials allow people to authenticate to an organisation without being identified. While there are some approaches trying to ensure non-transferability we want to improve the methods relying on biometric authentication. In this working paper we present a first step of embedding biometric attributes into anonymous credentials. There are only slight changes to existing approaches, but the main purpose of this working paper is to establish a basis, which can be improved in the future to solve some of the problems addressed in the 'future work section'. Abstract pape08petcon](/pictures/icon/abstract.png)
![Bibtex](/pictures/icon/bibtex.png)
![privacy](/pictures/icon/keyword/privacy.png)