As eIDAS 2.0 and the forthcoming European Digital Identity Wallet drive the evolution of digital identity, OpenID Federation (OIDFed) is emerging as a key technology for establishing trust in multilateral federations. Yet, little empirical evidence exists on how OIDFed performs at national scale and which operational pitfalls might emerge in practice. We conducted a longitudinal analysis of Italy’s public administration federation, the first production-grade deployment based on OIDFed. Through daily scans between May 2024 and July 2025, we retrieved all publicly available metadata, examining the federation’s topology, conformance, security posture, and evolution over time. Our analysis reveals an operational and mature deployment that experienced substantial growth, while also discovering topological irregularities, key material reuse, and conformance gaps. We disclosed all security issues to the respective stakeholders and publish our full dataset and tooling to support further research. Overall, our findings show that OIDFed can support a nation-scale production federation, while also identifying specification ambiguities and operational practices that must be addressed when deploying OIDFed in critical digital identity infrastructures.

Passkeys, the latest evolution of FIDO2 credentials, promise to combine enhanced security with improved usability. While passkeys are widely promoted as the long-awaited replacement for passwords, their real-world usability remains underexplored - particularly as a passwordless and usernameless Multi-Factor Authentication (MFA) method in complex, heterogeneous environments like universities. Addressing this gap, we conducted a between-groups lab study with 92 university participants, comparing passkeys against security keys and one-time passwords across students, faculty, and staff. Our results show that passkeys are perceived as the most usable and accepted MFA method while enabling faster authentication. However, we also identified critical barriers including personal device requirements, exam scenario conflicts, privacy concerns, and recovery fears. These findings suggest that while passkeys outperform traditional MFA methods, successful deployment in academic settings requires addressing institutional constraints and providing role-specific implementation strategies.

Modern cyber threats increasingly bypass traditional security controls, with attackers exploiting weakly secured identities instead of relying on sophisticated exploits. This shift has made identity-based threats a critical attack vector, necessitating specialized defense mechanisms. Identity Threat Detection and Response (ITDR) has emerged as a new security discipline designed to detect and mitigate these threats before they escalate. Despite its growing importance, ITDR lacks a structured, vendor-independent framework for understanding the threats it addresses. This paper aims to systematize knowledge on identity threats, examining how they impact different stages of the digital workforce identity lifecycle and identifying the methods available to detect and respond to them. To achieve this, we conducted a comprehensive analysis of identity threats within the MITRE ATT&CK framework. We identified 366 identity-related threats and developed a framework to categorize them based on their impact across the digital identity lifecycle, evaluating corresponding detection and response mechanisms. This research provides a foundational understanding of ITDR, contributing to its development as a formal security discipline and offering practical insights for organizations aiming to strengthen identity security in enterprise environments.

Continuous authentication enhances security by verifying users beyond their initial login. While it mitigates risks of one-time authentication, it often requires ongoing biometric data transmission, raising privacy concerns due to their sensitivity and non-revocability. To address this, we explore privacy-preserving continuous authentication using Zero-Knowledge Proofs (ZKP), which enable verification without revealing biometric data. We developed and evaluated two continuous authentication protocols: one using interactive ZKPs and another using Non-Interactive ZKPs (NIZKPs). Based on existing work, we selected and adapted a suitable one-time biometric authentication protocol, implemented a proof of concept, and tested different training sizes to optimize the trade-off between execution time and performance. With 30 training users, our system achieved a false acceptance rate of 0.0065, false rejection rate of 0.0048, and execution time of 0.1261 s. The NIZKP variant proved significantly faster due to reduced network overhead. Our approach demonstrates that continuous authentication can be made both secure and privacy-preserving, offering a scalable and highly adaptable alternative for existing systems.

In contrast to user authentication in the digital domain, device authentication entails distinct requirements and challenges. In the enterprise context, Internet-of-Things (IoT) devices must support strong identities to ensure secure and trusted operations. A critical first step in developing such systems is the secure bootstrapping of these devices. However, achieving trusted bootstrapping is challenging when Internet access is prohibited. In such environments, an identity must be provided to the device beforehand. The solution should also work with minimal human intervention in our scenario. To achieve this, we developed cBRSKI-PRM, a hybrid combination of BRSKI-PRM and cBRSKI. BRSKI-based communication between components is facilitated via Bluetooth Low Energy. We implemented the proposed solution on an ESP32 platform, ensuring reliable performance in both hardware and software while optimizing for low power consumption. Additionally, we identified and addressed several issues in the specifications of the employed protocols. We published all source code used in this project under the permissive MIT license. By combining and extending existing open protocols, we developed a highly assured bootstrapping process for IoT devices under minimal trust assumptions in constrained environments.

Memory forensics plays an important role in modern digital investigations in terms of detecting stealthy, fileless malware, and advanced persistent threats. Moreover, large language models (LLMs) have shown promise in different cybersecurity tasks. In this article, we integrate intelligence based on LLM into memory forensic workflows and evaluate multiple LLMs, including OpenAI GPT4o, OpenAI o1, Gemini 2.0 Flash, Gemini 2.0 Flash-Thinking, Grok 3, and Grok 3 with thinking mode enabled. We collect memory dumps encompassing a variety of attack scenarios such as process injection (using MSFVenom), a PowerShell Empire-based attack, and real-world malware such as Quasar RAT, MassLogger, DarkCloud, LockBit, and LockiBot. Our evaluation includes accuracy, precision, recall, and F1 score metrics and statistical analyses (ANOVA and correlation tests). The findings show that the reasoning-based ("thinking") LLM models outperform standard models. OpenAI o1 and Gemini Flash-Thinking excel at decoding base64 obfuscated payloads, while Grok3 leads in detecting network anomalies. All LLM-based approaches suffer from high false-positive (FP) rates, reflected in low precision (often < 20%). This tendency appears to stem from the precautionary principle in AI safety orientation, leading to models erring on the side of caution and occasionally hallucinating plausible threats when faced with ambiguous or incomplete evidence. The LockBit indicator of compromise (IoC) could not be detected with the LLM because the IoCs lie beyond the Volatility3 modules used. Due to this reason and the limited size of the context window from the LLM, it is essential to select appropriate data. Despite limitations, the study demonstrates the practical viability of integrating LLM-driven intelligence into a forensic system. The study lays the foundation for hybrid forensic systems combining symbolic analysis, domain-specific heuristics, and LLM-driven intelligence.

Incident response "playbooks" are structured sets of operational procedures organizations use to instruct humans or machines on performing countermeasures against cybersecurity threats. These playbooks generally combine information about a given threat and organizational aspects relevant within the context of an organization. Both types of information are crucial for using, maintaining, and sharing playbooks across organizations as they ensure effectiveness and confidentiality. While practitioners show great interest in playbooks, their characteristics have not yet been thoroughly investigated from a research perspective. For this reason, we explore the topic by analyzing what is inside a playbook. Our approach consists of a comprehensive empirical assessment of available data (1217 playbooks), an online study with 147 participants, and final indepth interviews with nine security professionals to consolidate and validate our findings. We notably find intrinsic ambiguities in the way practitioners and organizations define their playbooks. Furthermore, we notice that available playbooks cannot be used outright which might currently impair their wide use across different cybersecurity actors. As a result, we can conclude that organizations do "play it by the books" but individually define what is inside their playbooks and which areas of incident response they might address.

User authentication has evolved from simple password-based procedures to phishing-resistant biometric methods. NIST, in special publication 800-63, provides definitions and requirements for digital identities. However, there is a growing need to also identify and authenticate the device in use. Such information can be included in fine-grained policy decisions to further enhance an enterprise's security posture. In addition, device authentication has been described in the literature as a significant factor in zero trust architectures. Despite the adoption of this security architecture by major stakeholders, device authentication remains lacking. Therefore, we propose extensions to SP 800-63 that cover device identity aspects. In addition, we present a best-of-breed solution using FIDO2 and an extension for OpenID Connect. Our results demonstrate that the integration of device identity aspects is feasible and aligns well with the existing guidelines. The proposed scheme can pave the way for a future where device authentication will become the norm in enterprise networks.

The quality of Cyber Threat Intelligence (CTI) has a profound impact on the efficacy of an organization’s defense against cyber threats, directly influencing its ability to safeguard critical assets and sensitive data. Despite its critical importance, the domain of CTI quality remains a multifaceted and evolving field, often operating at the intersection of theory and practice. Many organizations recognize the need for high-quality intelligence but may struggle to establish systematic processes for assessing and enhancing its quality. To investigate these issues, our research, encompassing 25 interviews with experts in the field, enriches the understanding of CTI quality in the real world, contributing valuable insights for practitioners and organizations striving to fortify their cybersecurity defenses and information-sharing practices. By bridging the gap between theory and practice, this work aims to inform and inspire advancements in CTI quality measurement.

In today's enterprise landscape, effective risk management has emerged as a vital cornerstone. This importance has escalated significantly due to the widespread transition from traditional on-premise infrastructures to dynamic cloud environments. Many organizations rely on qualitative approaches for internal IT and cyber risk management; however, these approaches have notable drawbacks, such as a lack of accuracy and comparability. In this paper, we propose a novel approach to address these limitations by using the Factor Analysis of Information Risk (FAIR) methodology in conjunction with MITRE ATT&CK to model realistic cyberattacks on organizations and measure quantitative risk. We describe how this approach can be used to create an enterprise cyber threat model, providing a case study for a cloud scenario to demonstrate its usage and to illustrate its potential benefits. Our model has demonstrated its practical applicability in enterprise settings as we thoroughly evaluated its effectiveness within two prominent German companies. This allowed us to gain valuable insight into how our proposed approach can enhance an organization's risk management strategies. Our research demonstrates the value of using a quantitative approach like FAIR over qualitative risk assessment methods. Overall, our approach provides a more comprehensive understanding of the risks organizations are facing and offers guidance on implementing effective risk management strategies. This research can help organizations improve their risk management practices and reduce the potential negative impact of cyberattacks.

In increasingly dynamic enterprise systems, accessing resources such as data and APIs from a static context is no longer a given. It is also common for users to access multiple services simultaneously within a session over an extended period. For example, the security posture of the accessing device may change during a session. Is the device still authorized to access specific resources in such a case? Continuous Access Evaluation addresses these and other problems related to changing context within a session. The basic principle of this technology is as follows: After each event that affects the context of access authorization, all participants in a session are informed. They then can decide on the continued authorization of access within a session for a user, an application, or a device. In this paper, we discuss the current state of this concept, ongoing standardization efforts and initial usage in large enterprise systems. Our findings indicate that the concept is well-defined and understood, resulting in rising academic interest in the topic. We assess ongoing progress in current standardization efforts, and also see notable adoption by major stakeholders.

Special Issue Part 1 (Issue 3) and Part 2 (Issue 4) of AIEDAM are based on a workshop on Learning and Creativity held at the 2002 conference on Artificial Intelligence in Design, AID '02 (www.cad.strath.ac.uk/AID02_workshop/Workshop_webpage.html; Gero, ...

Determining the correct contact person for a particular system or organization is challenging in today’s Internet architecture. However, there are various stakeholders who will need to have such information, such as national security teams, security researchers, or Internet service providers, among others. To address this problem, RFC 9116, or better known as “security.txt,” was developed. If implemented correctly, then it can help these stakeholders in finding contact information to be used to notify an organization of any security issues. Further, there is another proposal called “dnssecuritytxt,” which uses DNS records for this purpose. In this research article, we evaluated the prevalence of websites that have implemented security.txt and their conformity with the standard. Through a longitudinal analysis of the top one million websites, we investigated the adoption and usage of this standard among organizations. Our results show that the overall adoption of security.txt remains low, especially among less popular websites. To drive its acceptance among organizations, security researchers, and developers, we derived several recommendations, including partnerships with vendors of browsers and content management systems.

There are many mysteries surrounding sharing communities, mainly due to their hidden workings and the complexity of joining. Nevertheless, these communities are critical to the security ecosystem, so a more profound understanding is necessary. In addition, they face challenges such as building trust, communicating effectively, and addressing social problems. This work aims to understand better the working methods, organizational structures, goals, benefits, and challenges of sharing communities to help improve their effectiveness and efficiency. To achieve this goal, we conducted video interviews with 25 experts from different countries worldwide who participate in various types of sharing communities. In addition, we applied socio-technical systems (STS) theory in our analysis process to elaborate on our findings from the interviews, identify correlations between them, and explore the interrelationships between social and technical elements of sharing communities. Our findings underscore the need for a holistic view of how sharing communities work. Instead of looking at individual aspects in isolation, considering the interrelationships between the different elements, especially the social, is crucial. This holistic perspective allows us to understand better the complexity and dynamics of sharing communities and how they can function effectively and efficiently. The findings of this study provide valuable impetus for the further development of sharing communities and can serve as a basis for future research.

Zero Trust Architecture (ZTA) is a security model based on the principle “never trust, always verify”. In such a system, trust must be established for both the user and the device for access to be granted. While industry adoption of commercial ZTA solutions is accelerating, the state of open-source implementations has yet to be explored. To that end, we survey open-source implementations of zero trust components and put forward a set of ZTA specific requirements to evaluate against. We also identify seven major challenges that hinder the adoption and deployment of open-source zero trust solutions. Our results show that implementations for individual components are much more mature compared to “all-in-one” ZTA solutions. The interoperability between solutions and the development of inter-component protocols are the main areas in which improvements can be made. Despite encouraging developments, we conclude that building ZTAs on top of open-source components is difficult.

Due to the increasing dependency on IT systems in both the private and industrial sectors, IT security training is becoming increasingly important. One way to teach IT security topics is through serious games, which besides being fun to play, impart knowledge on certain topics. As these games are more and more used in the industrial environment, this paper aims to develop a mapping between industrial roles and the games to show which game fits how well for the training of an industrial role. In doing so, an evaluation of the games was established that allows for comparability across the different roles. Thus, the research question which serious games is suitable for which industrial role could be addressed. Further results of the work are an ontology, which contains the essential characteristics of serious games for this work, a collection of industrial roles with their required IT-skills and a collection of serious games with an evaluation of the level of support of IT-skills.