Correctness and regulatory compliance (e.g., with the EU General Data Protection Regulation) are core issues for every organization. Business process modeling is an appropriate method to make potential problems visible and thus improve compliance of the processes. Compliance is controlled at different levels. First, corporate management should clearly understand the company’s relevant data processing. Second, supervisory authorities have the legal obligation to monitor compliance. In either case, this control is typically performed manually using paper reports. An automated control (during design time and in the production phase) based on business process models is desirable to increase effectiveness and usability. The paper presents an approach for marking sensitive aspects in business process models with colored labels representing personal data categories. These new concepts provide a fast and comprehensible graphical annotation of business process models. They allow humans to assess critical parts of processes and support optimizations for better data protection and privacy.

When personal data is processed in a distributed manner by cooperating service providers, privacy risks may emerge solely from the choice of data processors included in the composition. For instance, different data processors may unknowingly rely on the same cloud provider, allowing for unintended linkability of personal data at that very provider. As such compositional risks to privacy are beyond the scope of each individual risk assessment, they are likely to be overseen when performing a data protection impact assessment. In this paper, we propose a novel protocol to detect and manage such compositional risks to privacy. Following an initial problem definition and requirements elicitation, we elaborate how our protocol identifies candidates for compositional risks and how this information may be used to improve the results of a data protection impact assessment over service compositions including multiple data processors.

As code generated by Large Language Models (LLMs) becomes more common, identifying the specific model behind each sample is increasingly important. This paper presents the first systematic study of LLM authorship attribution for C programs. We release CodeT5-Authorship, a novel LLM that uses only the encoder layers from the original CodeT5 encoder-decoder architecture. Our model's encoder output (first token) is passed through a two-layer classification head with GELU activation and dropout, producing a probability distribution over possible authors. To evaluate our approach, we introduce LLM-AuthorBench, a benchmark of 32,000 compilable C programs generated by eight state-of-the-art LLMs across diverse tasks. We compare our model to seven traditional ML classifiers and eight fine-tuned transformer models, including BERT, RoBERTa, CodeBERT, ModernBERT, DistilBERT, DeBERTa-V3, Longformer, and LoRA-fine-tuned Qwen2-1.5B. In binary classification, our model achieves 97.56 % accuracy in telling apart source code written by related models such as GPT-4.1 and GPT-4o, and 95.40 % accuracy for multi-class attribution among five leading LLMs (Gemini 2.5 Flash, Claude 3.5 Haiku, GPT-4.1, Llama 3.3, and DeepSeek-V3). To support open science, we release the CodeT5-Authorship architecture, the LLM-AuthorBench dataset, and all relevant Google Colab scripts on GitHub: https://github.com/LLMauthorbench/.

In this paper, we introduce a metadata-enriched generation framework (PhishFuzzer) that seeds real emails into Large Language Models (LLMs) to produce 23,100 diverse, structurally consistent email variants across controlled entity and length dimensions. Unlike prior corpora, our dataset features strict three-class labels (Phishing, Spam, Valid), provides full URL and attachment metadata, and annotates each email with attacker intent. Using this dataset, we benchmark two state-of-the-art LLMs (Qwen-2.5-72B and Gemini-3.1-Pro) under both Basic (body, subject) and Full (+URL, sender, attachment) settings. By applying formal confidence metrics (Task Success Rate and Confidence Index), we analyze model reliability, robustness against linguistic fuzzing, and the impact of structural metadata on detection accuracy. Our fully open-source framework and dataset provide a rigorous foundation for evaluating next-generation email security systems. To support open science, we make the PhishFuzzer Dataset, the generation scripts and prompts available on GitHub: https://github.com/DataPhish/PhishFuzzer

In recent years, typosquatting has become a significant threat to software supply chain systems, where malicious packages deceptively mimic legitimate ones. Attackers register these fraudulent packages with names strikingly similar to those of legitimate packages. As a result, developers can mistakenly download these malicious packages by mistyping the intended package name or selecting a package based on its convincing yet deceptive name. In this paper, we assess the effectiveness of string-matching algorithms in identifying potential typosquatting candidates. We construct an open dataset comprising 394 typosquatting packages and evaluate the performance of these algorithms based on their ability to detect typosquatting packages. In addition, we introduce a novel string-matching algorithm, an extension of the Damerau-Levenshtein distance, demonstrating a notably higher true-positive rate than existing methods. Since our dataset contains features not previously considered, we also investigate how these new features affect the assignment accuracy of ML-based classifiers. Our results show an overall accuracy rate of 98.4

Online services are integral to modern life, supporting activities such as communication, commerce, and travel. These services typically require user authentication, traditionally relying on user ID and password combinations. However, this approach is increasingly vulnerable to attacks such as phishing. Many services have adopted stronger authentication mechanisms, including multi-factor authentication, riskbased authentication, and passkeys. Despite extensive research on login procedures, limited attention has been given to these post-login authentication processes. This paper presents a first study investigating the interplay between multi-factor authentication and context-specific authentication for ten popular online services. The results indicate that various authentication methods and behaviors can be observed across different scenarios and services.

With passkeys, the FIDO Alliance introduces the ability to sync FIDO2 credentials across a user's devices through passkey providers. This aims to mitigate user concerns about losing their devices and promotes the shift toward password-less authentication. As a consequence, many major online services have adopted passkeys. However, credential syncing has also created a debate among experts about their security guarantees. In this paper, we categorize the different access levels of passkeys to show how syncing credentials impacts their security and availability. Moreover, we use the established framework from Bonneau et al.'s Quest to Replace Passwords and apply it to different types of device-bound and synced passkeys. By this, we reveal relevant differences, particularly in their usability and security, and show that the security of synced passkeys is mainly concentrated in the passkey provider. We further provide practical recommendations for end users, passkey providers, and relying parties.

The European General Data Protection Regulation (GDPR) grants European users the right to access their data processed and stored by organizations. Although the GDPR contains requirements for data processing organizations (e.g., understandable data provided within a month), it leaves much flexibility. In-depth research on how online services handle data subject access request is sparse. Specifically, it is unclear whether online services comply with the individual GDPR requirements, if the privacy policies and the data subject access responses are coherent, and how the responses change over time. To answer these questions, we perform a qualitative structured review of the processes and data exports of significant online services to (1) analyze the data received in 2023 in detail, (2) compare the data exports with the privacy policies, and (3) compare the data exports from November 2018 and November 2023. The study concludes that the quality of data subject access responses varies among the analyzed services, and none fulfills all requirements completely.

According to the European General Data Protection Regulation (GDPR), a Data Protection Impact Assessment (DPIA) is mandatory for all ongoing and planned processing of personal data if said processing is likely to affect the privacy and data protection rights and freedoms of the data subjects. However, upon examining the real-world implementation of this requirement, various approaches emerged, resulting in a heterogeneous landscape of DPIA processes. In this paper, we present the results of a survey that investigated the state of adoption of DPIA process methodologies in real-world organisations. Our survey reveals that handwritten DPIA reports and ad-hoc methods continue to dominate the DPIA landscape in Europe. Moreover, according to our data, processes involving multiple stakeholders are often not adequately assessed in terms of DPIA-related risks.

The European General Data Protection Regulation (GDPR) came into effect in May 2018. It requires organizations to give European users access to their data. Although several requirements are contained in the GDPR, such as machine-readable format and easily understandable information, these kinds of regulations leave flexibility on how to achieve them. In order to understand the past and the current practices emerging from the GDPR, we evaluate data exports from 2018 and 2023 of one reference account from the social media platform Twitter. We analyze the service’s compliance with the requirements of the GDPR, the changes within the time span, and the differences between accounts. To compare and verify the results, we incorporate the findings of data exports of four verification accounts. The results show that the information presented to the users is easier to understand with the present version. However, the data is not provided in a machine-readable format and additional files, such as more than 3,000 emoticons, are incorporated. In addition, not all practices are according to GDPR. Based on the results, the study suggests future research topics and practical improvements.

Risk-based authentication (RBA) is used in online services to protect user accounts from unauthorized takeover. RBA commonly uses contextual features that indicate a suspicious login attempt when the characteristic attributes of the login context deviate from known and thus expected values. Previous research on RBA and anomaly detection in authentication has mainly focused on the login process. However, recent attacks have revealed vulnerabilities in other parts of the authentication process, specifically in the account recovery function. Consequently, to ensure comprehensive authentication security, the use of anomaly detection in the context of account recovery must also be investigated. This paper presents the first study to investigate risk-based account recovery (RBAR) in the wild. We analyzed the adoption of RBAR by five prominent online services (that are known to use RBA). Our findings confirm the use of RBAR at Google, LinkedIn, and Amazon. Furthermore, we provide insights into the different RBAR mechanisms of these services and explore the impact of multi-factor authentication on them. Based on our findings, we create a first maturity model for RBAR challenges. The goal of our work is to help developers, administrators, and policy-makers gain an initial understanding of RBAR and to encourage further research in this direction.

Nowadays, most online services offer different authentication methods that users can set up for multi-factor authentication but also as a recovery method.This configuration must be done thoroughly to prevent an adversary's access while ensuring the legitimate user does not lose access to their account.This is particularly important for fundamental everyday services, where either failure would have severe consequences.Nevertheless, little research has been done on the authentication of actual users regarding security and the risk of being locked out of their accounts.To foster research in this direction, this paper presents a study on the account settings of Google and Apple users.Considering the multi-factor authentication configuration and recovery options, we analyzed the account security and lock-out risks.Our results provide insights into the usage of multi-factor authentication in practice, show significant security differences between Google and Apple accounts, and reveal that many users would miss access to their accounts when losing a single authentication device.

The current European data strategy foresees a novel ecosystem of data sharing and data trading among public and private sector organizations in the EU member states. The focus is on enabling and fostering data sharing among the stakeholders while maintaining compliance with existing EU and national data protection legislation, such as the European General Data Protection Regulation (GDPR). However, managing data sharing in such a compliant manner requires additional metadata to be exchanged amongst the actors in this ecosystem. Therefore, this paper proposes a novel data model for managing data sharing activities. This model takes current and planned regulations (e.g., the Data Governance Act) and the resulting data ecosystem architectures (e.g. data intermediaries) into account and is applicable to different actions that are necessary for compliant data exchange, like data subject rights requests or intellectual property enforcement.

FIDO authentication has many advantages over password-based authentication, since it relies on proof of possession of a security key. It eliminates the need to remember long passwords and, in particular, is resistant to phishing attacks. Beyond that, the FIDO protocols consider protocol extensions for more advanced use cases such as online transactions. FIDO extensions, however, are not well protected from Man-in-the-Middle (MitM) attacks. This is because the specifications require a secure transport between client and server, but there exists no end-to-end protection between server and authenticator. In this paper, we discuss MitM scenarios in which FIDO extensions may be intercepted. We further propose an application-layer security protocol based on the CBOR Object Signing and Encryption (COSE) standard to mitigate these threats. This protocol was verified in a formal security evaluation using ProVerif and, finally, implemented in a proof-of-concept.

Online services have difficulties to replace passwords with more secure user authentication mechanisms, such as Two-Factor Authentication (2FA). This is partly due to the fact that users tend to reject such mechanisms in use cases outside of online banking. Relying on password authentication alone, however, is not an option in light of recent attack patterns such as credential stuffing. Risk-Based Authentication (RBA) can serve as an interim solution to increase password-based account security until better methods are in place. Unfortunately, RBA is currently used by only a few major online services, even though it is recommended by various standards and has been shown to be effective in scientific studies. This paper contributes to the hypothesis that the low adoption of RBA in practice can be due to the complexity of implementing it. We provide an RBA implementation for the open source cloud management software OpenStack, which is the first fully functional open source RBA implementation based on the Freeman et al. algorithm, along with initial reference tests that can serve as a guiding example and blueprint for developers.

Our everyday life depends more and more on online services and, therefore, access to related user accounts. The security of user accounts, again, is tied to the security of the corresponding primary and fallback authentication methods. Accounts can be linked to each other - by fallback authentication, through SSO, or by using the same authentication devices - creating an account network. These account networks enhance login comfort and are needed in case of account recovery, but they also increase each account's attack surface. In addition, misconfigurations might result in account inaccessibility. However, these problems can only be detected by analyzing single accounts first and then the resulting account networks. Despite the importance to understand account security and accessibility, almost no analysis methods exist. To address this need, this article presents the Authentication Analysis Framework (AAF). AAF evaluates account types and primary and fallback authentication methods for each account, before analyzing the overall account network. By detecting transitive risks, weak links can be discovered and subsequently strengthened. We further propose maturity models to rank the primary and fallback authentication methods based on risks and a description language to exchange the required information. AAF is implemented as a plugin for the password manager KeePass to assist end users and as a standalone tool for researchers.

The General Data Protection Regulation (GDPR) has introduced various data subject rights, e.g., the right of access, the right to erasure, or the right to data portability. These rights empower European individuals, the data subjects, to exercise control over their personal data stored or processed by organizations, the data controllers, in multiple ways. However, in practice, the enforcement of those rights faces several issues, as especially small- and medium-sized enterprises often lack the resources or know-how to implement a sufficient data subject rights solution. This leads to incomplete results that are not easily comprehensible for the data subjects. To address these issues we introduce the concept of Data Subject Rights as a Service (DSRaaS). The goal of the DSRaaS provider is to act as a bridge between the data subjects and data controllers, by providing the five services data subject right enforcement, authentication, data model, data logbook, and consulting. In this context, we will also look at the role that data intermediaries, introduced by the Data Governance Act, can serve in DSRaaS.

User authentication is necessary for the majority of online services. If users fail to authenticate due to the loss of an authentication factor, fallback processes allow users to regain access to their accounts. However, most of the proposed and deployed fallback methods have substantial weaknesses that degrade security, e.g., guessable security questions. This is even more serious since through account dependencies (e.g., password reset via email), additional accounts can be compromised. On the other hand, misconfiguration of (fallback) authentication might result in locking a user out of an account. To help users to analyze their account security and accessibility risk, we present the multi-account dashboard (MAD). The MAD evaluates account types, applied primary and fallback authentication methods as well as the formed account network. By analyzing dependencies and transitive risks, weak links are discovered and indicated, and improvements are suggested. We further propose a service authentication description to collect the required information in an transparent way. The MAD is implemented as a plugin of the password manager KeePass. A following small-scale user study evaluates the usefulness and usability of the implementation.

From the very outset of the digital era, the protection of personal data against unauthorized usage and distribution has been one of the most significant challenges in distributed services. For this reason, new regulations such as the European Union's the General Data Protection Regulation grant users tight control over their data that is handled by service providers. Compliance with such regulations can take expensive refitting of the existing systems and manual work. We propose a formal language that can define properties like informed consent, data subject rights, and the lawfulness to capture data protection requirements. The language is designed to abstract ownership information to make data dependencies explicit. We formalise a notion of policy compliance. This can be useful in service architecture with various actors who necessarily do not trust each other and may have conflicting interests.

Globally, health information security and associated topics have received considerable attention from both professionals and the academic community. The literature on the threats and mitigations when it comes to developing countries is scarce, and tends to focus on issues such as cryptographic techniques for secure safe data transmission or patients’ perceptions of data confidentiality. However, investigation of health information threats in relation to the local context has received less attention. In this paper we reflect on a long-term and global action research project that presents different perspectives on information security. Operating in environments of absent or obsolete relevant jurisdiction, poor institutional capacity for adherence and oversight, and limited awareness of appropriate security and confidentiality issues, we note unique security and confidentiality threats “where there is no CISO”. We reflect on mitigations adopted over the years to counter rising threats, and provide recommendations for practice and further research in this regard.