Health, fitness, and medical apps have become increasingly popular to help users manage their well-being. However, their widespread use raises significant concerns about data privacy, given the sensitive nature of the information they process. In this study, we evaluate the transparency and regulatory compliance of such apps by focusing on three key aspects: actual data transmission behavior, claims made in privacy policies-particularly concerning third-country recipients-and the presence of dark patterns in their user interfaces. We combine network traffic analysis with a systematic review of privacy policies to examine whether data is transmitted before consent and whether recipients align with disclosures. In addition, we analyze interface designs for manipulative elements that can hinder informed consent. Our results reveal discrepancies between stated and observed data flows, instances of pre-consent data transmission, and recurring dark patterns. These findings highlight critical transparency gaps and underscore the need for stronger enforcement and user-centered privacy design.

Gamification is increasingly applied in cybersecurity training to enhance engagement and support knowledge retention through elements such as points, challenges, and rewards. However, its effectiveness remains debated, as employees' experiences vary, and specific game elements may not be equally beneficial for all learners. This study explores employees' perceptions of engagement, learning outcomes, and challenges in gamified cybersecurity training through an online survey of 53 participants in Germany. Findings indicate that while game elements were generally engaging, participants valued real-world problem-solving tasks, story-based scenarios, and simulated cyber-attacks over leader-boards and competition-based mechanics. Challenges such as extended training duration and unclear game mechanics led to frustration and reduced perceived effectiveness for some participants. Additionally, participants emphasized the importance of training that balances engagement with practical relevance. These findings suggest that gamified strategies should prioritize realistic, problem-solving tasks over competitive elements and ensure clarity in-game elements to maximize training effectiveness in workplace cybersecurity programs.

Large Language Models (LLMs), such as ChatGPT and Google Bard, have performed interestingly well when assisting developers on computer programming tasks, a.k.a., coding, thus potentially resulting in convenient and faster software constructions. This new approach significantly enhances efficiency but also presents challenges in unsupervised code construction with limited security guarantees. LLMs excel in producing code with accurate grammar, yet they are not specifically trained to guarantee the security of the code. In this paper, we provide an initial exploration into using formal software specifications as a starting point for software construction, allowing developers to translate descriptions of security-related behavior into natural language instructions for LLMs, a.k.a., prompts. In addition, we leveraged automated verification tools to evaluate the code produced against the aforementioned specifications, following a modular, step-by-step software construction process. For our study, we leveraged Role-based Access Control (RBAC), a mature security model, and the Java Modeling Language (JML), a behavioral specification language for Java. We test our approach on different publicly-available LLMs, namely, OpenAI ChatGPT 4.0, Google Bard, and Microsoft CoPilot. We provide a description of two applications-a security-sensitive Banking application employing RBAC and an RBAC API module itself-, the corresponding JML specifications, as well as a description of the prompts, the generated code, the verification results, as well as a series of interesting insights for practitioners interested in further exploring the use of LLMs for securely constructing applications.

The basic primitives of access control models evolve together with the development of new technologies. The increased availability of computers in organizations brought the notion of roles in, the growing popularity of online social networks led to access control models based on relationships. The new era introduces new challenges. One of those is related to data management in collaborative platforms. Being involved in numerous collaborations, the users need convenient solutions to express their access control preferences. In this paper we address this problem by developing an access control model based on categorization. Relying on evidence from cognitive science, we employ categories as a natural primitive for expressing users’ access control preferences. We develop our model using a fragment of hybrid logic and evaluate its performance in a simulated environment.

Smartphones facilitate human needs such as communication, entertainment, and knowledge. These instruments simultaneously process and store user data, including email, messages, passwords, financial accounts, and health records. Mobile apps aggregate this data and may transmit it to clouds or third parties. Smartphone operating systems provide security settings and permission mechanisms, empowering users with control over personal data. However, users frequently overlook these, which often leads to data leaks. To prioritize users' attention, we have developed a User Data Access Profile (UDAP) interface to raise awareness and prompt them to evaluate the potential risks of the apps they are considering. We implemented a gamified environment and conducted a between-subjects design study, comparing the UDAP and Android App-Info screens. The findings show that participants were more adept at assessing the privacy risks associated with Android apps when provided with categorized information post-application setup. Additionally, this approach raised user awareness regarding permission grants and configured new apps with personal data.

In this paper, we summarize a novel method for machine learning-based static application security testing (SAST), which was devised as part of a larger study funded by Germany's Federal Office for Information Security (BSI). SAST describes the practice of applying static analysis techniques to program code on the premise of detecting security-critical software defects early during the development process. In the past, this was done by using rule-based approaches, where the program code is checked against a set of rules that define some pattern, representative of a defect. Recently, an increasing influx of publications can be observed that discuss the application of machine learning methods to this problem. Our method poses a lightweight approach to this concept, comprising two main contributions: Firstly, we present a novel control-flow based embedding method for program code. Embedding the code into a metric space is a necessity in order to apply machine learning techniques to the problem of SAST. Secondly, we describe how this method can be applied to generate expressive, yet simple, models of some unwanted behavior. We have implemented these methods in a prototype for the C and C++ programming languages. Using tenfold cross-validation, we show that our prototype is capable of effectively predicting the location and type of software defects in previously unseen code.

Die zunehmende Verbreitung von Smarthome-Geräten und ihre verschiedenen Fähigkeiten bieten viele Chancen. Allerdings sind mit dieser Entwicklung auch Risiken verbunden, die insbesondere die Privatsphäre der Nutzer betreffen. Im Folgenden wird ein Überblick über die Herausforderungen gegeben, die sich den Nutzern stellen, wenn sie den Datenschutz und die Informationssicherheit in ihrem Smarthome verstehen wollen. Es wird erläutert, wie wichtig es ist, fundierte Risikoentscheidungen zu treffen, und warum die Nutzer mit entsprechendem Wissen ausgestattet sein müssen. Um das Verständnis der Nutzer zu verbessern, werden Augmented Reality und Gamification, also Methoden der Mensch-Technik-Interaktion, eingesetzt. Es wird auch auf die Herausforderungen eingegangen, die bewältigt werden müssen, um die Akzeptanz einer solchen Lösung durch die Nutzer sicherzustellen.

With the proliferation of smart home devices, domains where users’ data is processed are becoming an important issue for data protection authorities. Regulations such as the EU-GDPR obligate smart home providers to inform users about the processing of personal data. However, due to the long and complex format of the privacy policies, users often overlook reading them. There have been attempts to make privacy policies more user-friendly. The one-pager approach has shown to be effective in gathering users’ attention. We present an empirical study of one-pager privacy policy templates in a smart home application. Three different versions are compared in a within-group study: a list, a tab-based, and a device-based. Our results show that the tab-based condition outperformed the others in terms of usability, workload, and user preference. Furthermore, we discuss the potentials and challenges of designing one-pager privacy policy representation formats in the context of smart home applications.

Metaphors are often considered to be a useful tool in user interface design. They teach a user new mechanics via transferring knowledge from one domain, where the user is experienced, to a new target domain. Specifically, this is helpful in areas with advanced technologies, such as security with its encryption and access control mechanisms. At the same time, some controversy exist on the efficacy of metaphors in user interface design. In this paper, we present our study results on the role of metaphors in a user interface for an access control decision mechanism. We performed our evaluation in a form of a web-based game, obtaining in total 143 responses. The study compared two interface metaphors along with a no-metaphor condition. Our main result suggests that metaphors in user interfaces of security applications can improve user performance, but the observed effect is limited.

Which parts of a software system can be accessed by an attacker is a common question in software security. The answer to this question defines where to look for input validation vulnerabilities, which parts of a system to respect during Microsoft’s Threat Modeling, or how to calculate security metrics. Identifying entry points of an application is, therefore, a frequently occurring problem. Additionally, identifying entry points is relevant when analysing many framework-based applications since they no longer have a simple main method.While different analyses implement entry point detection, the presented tool eNYPD explicitly focuses on answering this question for Java-based systems in an analysis-independent manner. It extracts information on entry points statically and persists this information to a separate file. Therefore, it allows reusing the information in different analyses, and researchers do not need to implement a custom entry point detection for each analysis.The presented tool is explained using Jakarta Server Faces, a user-interface technology for Web-based business applications implemented using Java. The paper presents the implemented extraction approach, the internal data model, and the results stored. Finally, in an evaluation, the statically assessed results of eNYPD are compared to a dynamically determined set of entry points. This comparison allows us to demonstrate the correctness of the extracted information.

The increased availability of portable devices with high computational power gave birth to such phenomenon as Bring Your Own Device (BYOD)—a situation when an employee uses his own device for accessing enterprise sensitive resources. This situation in turn created a new conflict—an employee wants to keep his data private, and an employer want to preserve the confidentiality of their sensitive resources. Since in case of BYOD both employees’ and employers’ data are stored on the employee’s device, a problem of distributed and collaborative access control appears. In this paper we propose a novel framework for distributed systems with multiparty data ownership. The underlying formal model is based on the notion of Category-Based Access Control (CBAC). It is expanded with a concept of categories, representing a remote third-party policy decision point. The model is designed and evaluated against requirements for collaborative systems.

Smart Home-Systeme finden eine immer weitere Verbreitung. Allerdings ergeben sich hieraus Fragen der IT-Sicherheit und des Datenschutzes für EndnutzerInnen. Oftmals ist nicht transparent, welche Daten wo verarbeitet werden und wie diese vor Missbrauch geschützt sind. Dieser Aufsatz beschreibt hierfür Lösungsansätze, die in dem Verbundprojekt UsableSec@Home erarbeitet werden.

Authorization is an intrinsic part of a software’s security. Determining whether a user is allowed to access a resource or not is crucial, not only in safety-critical applications but also in everyday applications to prevent misuse of data or software. There is plenty of research dealing with validating and verifying authorization policies in the security community. Still, an implemented authorization policy does not necessarily match the planned authorization policy, i.e., even a validated and verified authorization policy can pose security issues when implemented incorrectly. This gap between planned and implemented authorization policy poses the risk of unauthorized access to sensitive resources due to insufficient authorization checks. Therefore, it is essential to ensure a system’s security to validate the implemented authorization policy against the planned one. We, therefore, describe the authorization pattern and present an algorithm to extract authorization graphs from implemented authorization policies, which can then be used to compare against the planned authorization policy. To that end, we developed a configurable context-sensitive analysis tailored to Java-based software systems, where the context is the authorization facts that hold on each point. Using a configuration for Apache Shiro, a security library that supports authorization, we evaluated our implementation using an open-source repository system for the management and dissemination of digital content and a closed-source manufacturing execution system. We discuss additional usage scenarios of the analysis results and describe how to transfer the approach to other authorization policies and programming languages.

Today, many tools exist that attempt to find possible vulnerabilities in Android applications, e.g., FlowDroid, Fortify, or AppScan. However, all these tools aim to detect vulnerabilities or (sometimes) tainted flows and present the reviewer detected possible issues of an analyzed Android application. None of these tools supports the identification of implemented security features in code, although this aspect is also relevant to developers as well as reviewers. To address this open problem, we present a program comprehension approach based on connected object process graphs (COPGs) containing interacting objects described by security patterns in this paper. The feasibility of our approach is evaluated qualitatively with 25 security-critical Android applications from Google Play with almost 7 million lines of code. We currently support 17 security pattern variants with about 199 correctly detected pattern instances in the apps. We also define a benchmark of non-trivial, security-critical Android apps, which can also be used for other security analysis tasks based on the static analysis framework Soot. With this benchmark, our analysis yields a precision of 99% and a recall of 80%. Finally, we discussed our approach and the developed tool with six software security experts from the SAFECode organization to obtain additional feedback.

While smart home devices are spreading rapidly, the privacy and security of users are key concerns. Many users struggle in acquiring and applying security recommendations to protect against malicious behavior in smart home systems, which can cause users to lose interest in this topic. Game-based learning is a powerful practice to increase the motivation of users in an entertaining and intuitive way. In this paper, we explore the effect of game premise on user's motivation and performance in an educational game. We designed a game with the aim to enlighten users about smart home security challenges. We developed two versions of the game with opposing game premises, a good and an evil, and compared them in a between-group experiment. The results show high motivation ratings in both versions of the game towards solving smart home security problems. However, there are no significant differences between the opposing game premises.

Die STRIDE-Methodik von Microsoft ist ein bewährter Ansatz, um Security by Design im Rahmen desEntwicklungsprozesses von Software umzusetzen. Allerdings verlangt STRIDE viel Expertenwissen, das nichtimmer in kleinen und mittelständischen Softwareunternehmen vorhanden ist. In diesem Artikel werdenunsere praktischen Erfahrungen mit STRIDE und unsere Anpassungsvorschläge dieser Methodik behandelt.Insbesondere verbinden wir STRIDE mit agilen Softwareentwicklungsprozessen, diskutieren Werkzeuge zu ihrerUnterstützung und zeigen auf, wie auch Datenschutzaspekte mitberücksichtigt werden können.

Modern sea or inland ports rely on digital communication and systems to boost rapid turnover of trade. Stakeholders like shippers, shipping lines, container terminals and port authorities collaborate and compete using their own legacy applications. Many sea ports operate Port Community Systems (PCS) to orchestrate processes between the players. These software systems are potential targets of security threats that may lead to payment fraud, espionage of competitors, smuggling, theft, export control violations, up to disasters involving dangerous goods possibly effecting public mains. In our approach we apply modeling to the field of information security. We combine and focus on Role-Based Access Control (RBAC) with constraints and Attribute-Based Access Control (ABAC) for finer grained authorization constraints. In a concrete case study we model authorization policies within port communities that partly utilize dedicated PCS. The purpose is to increase the integrity of exchanged data and thus reduce the risks of attacks or failures. We employ the UML-based Specification Environment (USE) and its OCL support to validate specified security properties for a typical container shipping scenario.

Many existing software systems like logistics systems or enterprise applications employ data security in a more or less ad hoc fashion. Our approach focuses on access control such as permission-based discretionary access control (DAC), variants of role-based access control (RBAC) with delegation, and attribute-based access control (ABAC). Typically, software systems implement hybrid access control making an effective security analysis and assessment rather difficult. We propose an analysis methodology to reconstruct access control using a novel modular access control model. Our modular approach allows us to flexibly model exactly those access properties that are relevant for a given system. As formalism we use the Object Constraint Language (OCL) with Ecore from the Eclipse Modeling Framework (EMF). We demonstrate the suitability of our access control model for three software systems: a port community system (PCS), a clinical information system (CIS), and an identity management system (IdMS). For the PCS and CIS we model concrete roles and policies. For the IdMS we evaluate our analysis methodology in-depth by reconstructing access control policies from byte code using the Soot analysis framework as well as model transformation techniques (QVTo). The resulting model helped us to identify design deficiencies. Violated OCL invariants such as for mutually exclusive roles or cardinality constraints revealed non-trivial security vulnerabilities.