Certificate transparency (CT) is a system that publishes all issued certificates so that they can be audited and monitored by any party. This allows to detect mis­issued certificates quickly and catch the misbehaving certificate authorities. CT makes the certificate ecosystem more transparent and less reliant on trust that trusted certificate authorities (CA) do not issue rogue certificates. Events such as the compromise of the CA DigiNotar in 2011 could be easily and quickly detected with CT. CT makes use of CT logs, where issued certificates from trusted CA are stored. CT logs are append­only ledger that can be accessed by anyone. The entire issue with trust and misissuance seems to be solved by this new technology, CT. But are there any downsides to this solution? Albeit, it helps to detect misissuance quickly, but at the same time introduces an additional source to exploit. CT logs are public ledgers of issued certificates. They can be used to discover new domain names, or to look up what domains exist. Given a domain, an attacker could harness the power of CT logs to look up all the subdomains. CT logs expose every domain, even internal ones that need a certificate but do not want to be known to the public. Furthermore, domains can be easily found without the need to guess domain names or exploiting other resources such as DNS, allowing attackers to generate lists of potential targets easily. In this paper, we analyze the security impact of CT on scanning traffic for domains hosted in IPv4 and IPv6. The domains’ certificates are appended to CT logs, to leak the embedded domain name, which is acting as a honeytoken, a lure. We conduct passive measurements on the domain hosts, the hosting webserver and the authoritative DNS server, perform data analysis on the measurements and evaluate the security impact of the certificate request.

Security misconfigurations and neglected updates commonly lead to systems being vulnerable. Ranging from default passwords to unpatched software, many systems, such as websites or databases, are being compromised due to these pitfalls. Often stemming from human error, it is difficult to avoid these misconfigurations, which is why they are repeatedly seen in the wild. Especially in the context of websites, we often find pages that were forgotten, that is, they were left online after they served their purpose and were never updated thereafter.
In this thesis, we introduce the first methodology to detect such forgotten or orphaned web pages, a type of misconfiguration that has seen little attention. We combine the historic data set of the Internet Archive with active measurements to identify pages that can no longer be reached via a path from the index page, yet remain accessible through their specific URL. We show the efficacy of our approach and the real-world relevance of the issue of orphaned web pages by applying it to a sample of 100,000 domains from the Tranco Top 1M. This particular type of misconfiguration can pose a serious threat, as they can lead to forgotten and unmaintained web pages, which may not have seen security updates.
In our measurements, we find 1,953 pages on 907 unique domains that are orphaned, some of which are 20 years old. In our subsequent security analysis, we find that these pages are significantly (p < 0.01 using χ 2 ) more likely to contain some vulnerabilities than maintained pages: 7.1% of orphaned pages suffer from simple XSS vulnerabilities, while only 0.9% of maintained pages are vulnerable against this type of attack. We encounter similar patterns for following best security practices, such as for the use of Content Security Policies (CSPs) and setting HTTP Security Headers. To allow researchers to reproduce our results and practitioners to scrutinize their own pages, we provide an implementation of our methodology as open source software.

In the past decade, the world has experienced numerous severe and impactful data breaches, without indications of this development slowing down. Even worse, research has shown data breaches are still waiting to happen. The occurrence of a data breach has consequences for several involved parties and for society in general. It is therefore only natural that there exists a pursuit to prevent data breaches from happening. Research claims that data breaches happen because of simple and preventable errors made by human, also known as security misconfigurations. This study aims to investigate whether the root causes of severe data breaches are frequently related to security misconfigurations, which would make most data breaches preventable. No such structured research had been done before. We conducted a multiple case study, wherein a number of data breaches was analysed based on publicly available case literature. Assessing the data breaches with the help of our developed framework was part of that analysis, resulting in a systematic characterization of each data breach. The results indicate that in breaches the data are mostly subject to unauthorized access by outsiders, which frequently is made possible by poor security. The organizations directly responsible for that data are large organizations which get breached especially in their storage facilities. Next to the organization which got breached, these sizeable data breaches always affect individuals since at least part of the compromised data is about them or linkable to them. Usually this is not even discovered by the breached organization itself and sometimes only after a long period of time. Ultimately, it can be concluded that data are frequently caused by security misconfigurations and therefore are mostly preventable. On this basis, it is recommended that organizations responsible for sensitive data should be more incentivized to thoroughly combat security misconfigurations, instead of treating IT security as only a technical endeavor.

Since the start of the 21st century, the amount of captured data has been continuously increasing in this digital age. With almost 2.5 quintillion bytes of data being generated and captured every day (Liang et al., 2018), researchers and companies have a strong interest in exploring the value that can be created with this data, called big data analysis. Also, since companies strive to be market leaders, they constantly evaluate methods/approaches to discover hidden trends/ potential opportunities. One method of finding hidden trends is through market segmentation, a process which can be defined as a division of a heterogeneous market into several smaller homogeneous markets to precisely understand the desires of consumers. Identifying and targeting the right consumers through market segmentation is highly dependent on the collected data. Due to the usage of obsolete data collection methods and privacy regulations, most often, companies only possess siloed data. If siloed data is used, then companies might not be effective with their segmentation strategies.
One way to ensure that data is complete and consistent might be through data sharing in a ‘data market’ between players to holistically understand the consumers. With this thought in mind, this thesis considers the telecom industry as an example and explores the effectiveness of market segmentation using shared data. The main research question of this thesis study is Before going deeply into the aim of the thesis, let’s first understand the current problems of the telecom industry. Traditionally, telecom firms have generated revenue via three streams i.e. voice, messaging and data. However, over the past decade, the market has witnessed an emergence of Over the top content players such as Netflix, YouTube, and Amazon Prime. These players do not need any association with the telecom firms to provide their services and thereby have impacted traditional telecom companies’ voice and messaging revenue streams. In addition to this with new content frequently being updated in these OTT services, customer preferences are constantly changing, and telecom firms are finding it hard to predict these varying needs with the siloed data present in their databases. This has therefore resulted in low average revenue per user (ARPU) levels for these telecom firms. As the first step in the thesis, we performed a literature review and identified four common segmentation techniques used by the telecom industry. The four techniques are customer value segmentation, customer behavior segmentation, customer lifecycle segmentation, and customer migration segmentation. These techniques are customer-centric and are heavily reliant on data for their effectiveness. To observe if these identified techniques are employed at the industry level and to contemplate the viewpoints of experts on data sharing in market segmentation, we interviewed market segmentation experts from the industry. The following subsections provide an overview of the interviews, questions asked in the interview and findings from the interviews.

The emergence of the Data Marketplaces is the latest iteration in the phenomenon of data-driven transformation of the world. Data marketplaces have emerged as a new form of data-driven business models which enable trading of data between the data owners/providers and data consumers by providing the necessary technological and non-technological infrastructure. These features present an alternative to the cumbersome logistics currently involved in searching, buying and selling data; thus, simplify the data supply chains between the data-driven business entities. However, they suffer to take off into mainstream success because of a myriad of reasons. Of all the reasons, 2 of them are focused in this thesis. Firstly, the difficulty involved in architecturally enabling a data marketplace platform as the prospective enabling technologies are still immature. Secondly, the uncertainty associated with the commodification of data which comprises of the intellectual property enforcement of data (data ownership), privacy and confidentiality breach (threats), regulatory ignorance (implication of GDPR), reluctance of businesses from participating because of the previous reasons et cetera. This reason is collectively referred as due to the uncertainty around the threat landscape of the data marketplaces. Multi-Party Computation (MPC) technology provide a solution to these problems. Through its capabilities to preserve the confidentiality of data architecturally and thereby securing the interests of the data actors with respect to the uncertainty of the threat landscape around data, MPC can enable safe and secure data sharing between data actors. This characteristic of MPC can help data marketplaces to overcome their challenges and foster their realisation. However, since MPC cannot handle the scale of real-life application, it is not mature enough yet to be incorporated into real-life data marketplaces. An EU funded project called SafeDEED: Safe Data-Enabled Economic Development, proposes to overcome the scalability issue and intends to achieve the maturation of MPC for real-life application. Building upon this forecast, a research was conducted to investigate the implication of the maturation of MPC technology towards the 2 problems faced by data marketplaces, architectural and threat landscape; and the same is documented in this thesis.

In this study, a analysis was performed to analyze why there are differences in port configuration between IPv4 and IPv6. For this, the current state of adoption and implantation processes of IPv6 were researched. Currently, 4,8% of all dual-stack hosts have a different configuration in open ports on IPv4 and IPv6. To discover the reasoning behind these differences, thirteen interviews were performed with owners of presumed misconfiguration or network security experts. Discovered was that most of the configurations were unintentional and because of unawareness and adequate knowledge of IPv6. Furthermore, an analyzes was performed about the reasons behind the lack of knowledge and awareness and discovered that at the moment, there is no compelling reason to migrate from IPv4 to IPv6 in most western countries. The lack of knowledge and awareness could be a reason why there is a 4,8% difference in IPv4, IPv6 configuration. Furthermore, noticed was that there is no clear solution to the problem and that there is no central actor that can solve this problem.

The Internet is a relatively new technology that the world has become immensely dependent on. It is a tool that makes it possible to simplify our lives and better our society. But as with many things, there are people who with to exploit this tool we have for their own malicious gain. One of the mechanisms that we can use for protection against these malicious actors is the intrusion detection system. Machine learning-based intrusion detection systems (IDS) have been heavily researched for a number of years now. Much of this research, though, appears to be conducted using improper methodologies and incorrect evaluation.
Such methodologies include training and testing IDSs with unrealistic data and using uninformative metrics to determine performance. In this research, we perform a case study using one such IDS. This IDS is trained and evaluated using real network traffic collected from a real-world network. Additionally, we test its performance on actual attack traffic. This research demonstrates that an IDS that is trained with unrealistic data performs nowhere near as well as is claimed by the author when trained using real network traffic. Finally, we propose CAML-IDS, a framework for the correct assessment of machine learning-based intrusion detection systems. This framework can assist future IDS research by preventing incorrect evaluation, in turn preventing the formulation of incorrect research.

Network measurments are mostly used to studynetwork topology, performance and security. The thesis uses network measurements in relation to large Internet corporations like Salesforce, Netflix and Snapchat. The thesis attempts to verify whether it is possible to predict company performance by monitoring network measurements. For the three corporations considered, the measurements provide insider information on the company, before it is made available to the public or released by the corporation itself. Network measurements can be used by managers effectively as a tool to understand and predict company perofrmance.