Vulnerability Identification Errors in Security Risk Assessments

At present, companies rely on information technology systems to achieve their business objectives, making them vulnerable to cybersecurity threats. Information security risk assessments help organisations to identify their risks and vulnerabilities. An accurate identification of risks and vulnerabilities is a challenge, because the input data is uncertain. So-called ’vulnerability identification errors‘ can occur if false positive vulnerabilities are identified, or if vulnerabilities remain unidentified (false negatives). ‘Accurate identification’ in this context means that all vulnerabilities identified do indeed pose a risk of a security breach for the organisation. An experiment performed with German IT security professionals in 2011 confirmed that vulnerability identification errors do occur in practice. In particular, false positive vulnerabilities were identified by participants. In information security (IS) risk assessments, security experts analyze the organisation’s assets in order to identify vulnerabilities. Methods such as brainstorming, checklists, scenario-analysis, impact-analysis, and cause-analysis (ISO, 2009b) are used to identify vulnerabilities. These methods use uncertain input data for vulnerability identification, because the probabilities, effects and losses of vulnerabilities cannot be determined exactly (Fenz and Ekelhart, 2011). Furthermore, business security needs are not considered properly; the security checklists and standards used to identify vulnerabilities do not consider company-specific security requirements (Siponen and Willison, 2009). In addition, the intentional behaviour of an attacker when exploiting vulnerabilities for malicious purposes further increases the uncertainty, because predicting human behaviour is not just about existing vulnerabilities and their consequences (Pieters and Consoli, 2009), rather than preparing for future attacks. As a result, current approaches determine risks and vulnerabilities under a high degree of uncertainty, which can lead to errors. This thesis proposes an approach to resolve vulnerability identification errors using security requirements and business process models. Security requirements represent the business security needs and determine whether any given vulnerability is a security risk for the business. Information assets’ security requirements are evaluated in the context of the business process model, in order to determine whether security functions are implemented and operating correctly. Systems, personnel and physical parts of business processes, as well as IT processes, are considered in the security requirement evaluation, and this approach is validated in three steps. Firstly, the systematic procedure is compared to two best-practice approaches. Secondly, the risk result accuracy is compared to a best-practice risk-assessment approach, as applied to several real-world examples within an insurance company. Thirdly, the capability to determine risk more accurately by using business processes and security requirements is tested in a quasi-experiment, using security professionals. This thesis demonstrates that risk assessment methods can benefit from explicit evaluation of security requirements in the business context during risk identification, in order to resolve vulnerability identification errors and to provide a criterion for security

The impact of Type Ia supernova explosions on helium companions in the Chandrasekhar-mass explosion scenario

In the version of the SD scenario of SNe Ia studied here, a CO WD explodes close to the Chandrasekhar limit after accreting material from a non-degenerate He companion. In the present study, we employ the Stellar GADGET code to perform 3D hydrodynamical simulations of the interaction of the SN Ia ejecta with the He companion taking into account its orbital motion and spin. It is found that only 2%--5% of the initial companion mass are stripped off from the outer layers of He companions due to the SN impact. The dependence of the unbound mass (or the kick velocity) on the orbital separation can be fitted in good approximation by a power law for a given companion model. After the SN impact, the outer layers of a He donor star are significantly enriched with heavy elements from the low-expansion-velocity tail of SN Ia ejecta. The total mass of accumulated SN-ejecta material on the companion surface reaches about > 10e-3 M_sun for different companion models. This enrichment with heavy elements provides a potential way to observationally identify the surviving companion star in SN remnants. Finally, by artificially adjusting the explosion energy of the W7 explosion model, we find that the total accumulation of SN ejecta on the companion surface is also dependent on the explosion energy with a power law relation in good approximation.Comment: 20 figures, 2 tables, accepted for publication in Ap

Supernova 2008bk and its red supergiant progenitor

Indexación: ISIHemos obtenido pocos datos fotométricos y espectroscópicos de supernova (SN) 2008bk en NGC 7793, principalmente a 150 días después de la explosión. Nos parece que se trata de un tipo II-Plateau (II-P) SN que más se asemeja a la de baja luminosidad SN 1999br en NGC 4900. Dada la similitud general entre las curvas de luz observadas y colores de SNs 2008bk y 1999br, inferimos que la extinción total visual a SN 2008bk ( A V = 0,065 mag) debe ser casi en su totalidad debido a un primer plano galáctico, similar a lo que ha supuesto para SN 1999br. Confirmamos la identificación de la supergigante roja putativo (RSG) estrella progenitora de SN en la alta calidad de g ' r ' i imágenes "que había obtenido en 2007 en el Gemini-Sur 8 telescopio m. Existe poca ambigüedad en esta identificación progenitor, calificándolo como el mejor ejemplo hasta la fecha, junto con la identificación de la estrella Sk -69 ° 202 como el progenitor de SN 1987A. A partir de una combinación de fotometría de las imágenes de Gemini con el de archivo, pre-SN, el Telescopio Muy Grande de JHK s imágenes, derivamos una precisa distribución observada energía espectral (SED) para el progenitor. Nos encontramos con índices de nebulares fuerte intensidad de emisiones de línea para varios H II regiones cercanas a la SN que la metalicidad en el medio ambiente es probable subsolar ( Z 0.6 Z ☉ ). El SED observado de la estrella concuerda bastante bien con SED sintéticos obtenidos a partir de modelos de atmósferas RSG eficaz con temperatura T eff = 3600 ± 50 K. Nos encontramos, por tanto, que la estrella tenía una luminosidad bolométrica con respecto al Sol de log ( L bol / L ☉ ) = 4,57 ± 0,06 y el radio R = 496 ± 34 R ☉ a ~ 6 meses antes de la explosión. Al comparar las propiedades del progenitor con teóricos masiva estrella modelos evolutivos, llegamos a la conclusión de que el progenitor RSG tenía una masa inicial en el rango de 8-8,5 M ☉ . Esta masa es consistente con, aunque en el extremo bajo de la gama inferido de masas iniciales para SN II-P progenitores. También es coherente con el límite superior estimado de la masa inicial de la progenitora de SN 1999br, y concuerda con las masas iniciales bajos encontrados para los progenitores RSG de otras supernovas de baja luminosidad II-P.http://www.sherpa.ac.uk/romeo/issn/0004-6256/es/http://iopscience.iop.org/1538-3881/143/1/19

Supernova 2008bk and Its Red Supergiant Progenitor

We have obtained limited photometric and spectroscopic data for supernova (SN) 2008bk in NGC 7793, primarily at ≳ 150 days after explosion. We find that it is a Type II-Plateau (II-P) SN that most closely resembles the low-luminosity SN 1999br in NGC 4900. Given the overall similarity between the observed light curves and colors of SNe 2008bk and 1999br, we infer that the total visual extinction to SN 2008bk (A_V = 0.065 mag) must be almost entirely due to the Galactic foreground, similar to what has been assumed for SN 1999br. We confirm the identification of the putative red supergiant (RSG) progenitor star of the SN in high-quality g'r'i' images we had obtained in 2007 at the Gemini-South 8 m telescope. Little ambiguity exists in this progenitor identification, qualifying it as the best example to date, next to the identification of the star Sk –69°202 as the progenitor of SN 1987A. From a combination of photometry of the Gemini images with that of archival, pre-SN, Very Large Telescope JHK_s images, we derive an accurate observed spectral energy distribution (SED) for the progenitor. We find from nebular strong-intensity emission-line indices for several H II regions near the SN that the metallicity in the environment is likely subsolar (Z ≈ 0.6 Z_☉). The observed SED of the star agrees quite well with synthetic SEDs obtained from model RSG atmospheres with effective temperature T_(eff) = 3600 ± 50 K. We find, therefore, that the star had a bolometric luminosity with respect to the Sun of log (L_(bol)/L_☉) = 4.57 ± 0.06 and radius R* = 496 ± 34 R_☉ at ~6 months prior to explosion. Comparing the progenitor's properties with theoretical massive-star evolutionary models, we conclude that the RSG progenitor had an initial mass in the range of 8-8.5 M_☉. This mass is consistent with, albeit at the low end of, the inferred range of initial masses for SN II-P progenitors. It is also consistent with the estimated upper limit on the initial mass of the progenitor of SN 1999br, and it agrees with the low initial masses found for the RSG progenitors of other low-luminosity SNe II-P

Three-dimensional simulations of gravitationally confined detonations compared to observations of SN 1991T

The gravitationally confined detonation (GCD) model has been proposed as a possible explosion mechanism for Type Ia supernovae in the single-degenerate evolution channel. Driven by buoyancy, a deflagration flame rises in a narrow cone towards the surface. For the most part, the flow of the expanding ashes remains radial, but upon reaching the outer, low-pressure layers of the white dwarf, an additional lateral component develops. This makes the deflagration ashes converge again at the opposite side, where the compression heats fuel and a detonation may be launched. To test the GCD explosion model, we perform a 3D simulation for a model with an ignition spot offset near the upper limit of what is still justifiable, 200 km. This simulation meets our deliberately optimistic detonation criteria and we initiate a detonation. The detonation burns through the white dwarf and leads to its complete disruption. We determine nucleosynthetic yields by post-processing 10^6 tracer particles with a 384 nuclide reaction network and we present multi-band light curves and time-dependent optical spectra. We find that our synthetic observables show a prominent viewing-angle sensitivity in UV and blue bands, which is in tension with observed SNe Ia. The strong dependence on viewing-angle is caused by the asymmetric distribution of the deflagration ashes in the outer ejecta layers. Finally, we perform a comparison of our model to SN 1991T. The overall flux-level of the model is slightly too low and the model predicts pre-maximum light spectral features due to Ca, S, and Si that are too strong. Furthermore, the model chemical abundance stratification qualitatively disagrees with recent abundance tomography results in two key areas: our model lacks low velocity stable Fe and instead has copious amounts of high-velocity 56Ni and stable Fe. We therefore do not find good agreement of the model with SN 1991T.Comment: 11 pages, accepted for publication in Astronomy & Astrophysic

Supernova 2010ev: A reddened high velocity gradient type Ia supernova

Aims. We present and study the spectroscopic and photometric evolution of the type Ia supernova (SN Ia) 2010ev. Methods. We obtain and analyze multi-band optical light curves and optical-near-infrared spectroscopy at low and medium resolution spanning from -7 days to +300 days from the B-band maximum. Results. A photometric analysis shows that SN 2010ev is a SN Ia of normal brightness with a light curve shape of $\Delta m_{15}(B)=1.12 \pm 0.02$ and a stretch s = $0.94 \pm 0.01$ suffering significant reddening. From photometric and spectroscopic analysis, we deduce a color excess of $E(B - V) = 0.25 \pm 0.05$ and a reddening law of $R_v = 1.54 \pm 0.65$. Spectroscopically, SN 2010ev belongs to the broad-line SN Ia group, showing stronger than average Si II {\lambda}6355 absorption features. We also find that SN 2010ev is a high-velocity gradient SN, with a value of $164 \pm 7$ km s$^{-1}$ d$^{-1}$. The photometric and spectral comparison with other supernovae shows that SN 2010ev has similar colors and velocities to SN 2002bo and SN 2002dj. The analysis of the nebular spectra indicates that the [Fe II] {\lambda}7155 and [Ni II] {\lambda}7378 lines are redshifted, as expected for a high velocity gradient supernova. All these common intrinsic and extrinsic properties of the high velocity gradient (HVG) group are different from the low velocity gradient (LVG) normal SN Ia population and suggest significant variety in SN Ia explosions.Comment: 16 pages, 13 figures, 7 tables. Accepted to A&

Spectropolarimetry of Galactic stars with anomalous extinction sightlines

Highly reddened type Ia Supernovae (SNe Ia) with low total-to-selective visual extinction ratio values, $R_V$, also show peculiar linear polarization wavelength dependencies with peak polarizations at short wavelengths ($\lambda_{max} \lesssim 0.4 \mu m$). It is not clear why sightlines to SNe Ia display such different continuum polarization profiles from interstellar sightlines in the Milky Way with similar $R_V$ values. We investigate polarization profiles of a sample of Galactic stars with low $R_V$ values, along anomalous extinction sightlines, with the aim to find similarities to the polarization profiles that we observe in SN Ia sightlines. We undertook spectropolarimetry of 14 stars, and used archival data for three additional stars, and run dust extinction and polarization simulations to infer a simple dust model that can reproduce the observed extinction and polarization curves. Our sample of Galactic stars with low $R_V$ values and anomalous extinction sightlines displays normal polarization profiles with an average $\lambda_{max} \sim 0.53 {\mu m}$, and is consistent within 3$\sigma$ to a larger coherent sample of Galactic stars from literature. Despite the low $R_V$ values of dust towards the stars in our sample, the polarization curves do not show any similarity to the continuum polarization curves observed towards SNe Ia with low $R_V$ values. There is a correlation between the best-fit Serkowski parameters $K$ and $\lambda_{max}$, but we did not find any significant correlation between $R_V$ and $\lambda_{max}$. Our simulations show that the $K-\lambda_{max}$ relationship is an intrinsic property of polarization. Furthermore, we have shown that in order to reproduce polarization curves with normal $\lambda_{max}$ and low $R_V$ values, a population of large (a $\geq 0.1 \mu m$) interstellar silicate grains must be contained in the dust's composition.Comment: accepted for publication in A&

ASASSN-14lp: two possible solutions for the observed ultraviolet suppression

We test the adequacy of ultraviolet (UV) spectra for characterizing the outer structure of Type Ia supernova (SN) ejecta. For this purpose, we perform spectroscopic analysis for ASASSN-14lp, a normal SN Ia showing low continuum in the mid-UV regime. To explain the strong UV suppression, two possible origins have been investigated by mapping the chemical profiles over a significant part of their ejecta. We fit the spectral time series with mid-UV coverage obtained before and around maximum light by HST, supplemented with ground-based optical observations for the earliest epochs. The synthetic spectra are calculated with the one-dimensional MC radiative transfer code TARDIS from self-consistent ejecta models. Among several physical parameters, we constrain the abundance profiles of nine chemical elements. We find that a distribution of 56Ni (and other iron-group elements) that extends towards the highest velocities reproduces the observed UV flux well. The presence of radioactive material in the outer layers of the ejecta, if confirmed, implies strong constraints on the possible explosion scenarios. We investigate the impact of the inferred 56Ni distribution on the early light curves with the radiative transfer code TURTLS, and confront the results with the observed light curves of ASASSN-14lp. The inferred abundances are not in conflict with the observed photometry. We also test whether the UV suppression can be reproduced if the radiation at the photosphere is significantly lower in the UV regime than the pure Planck function. In this case, solar metallicity might be sufficient enough at the highest velocities to reproduce the UV suppression

Family dispute: do Type IIP supernova siblings agree on their distance?

Context: Type II supernovae provide a direct way to estimate distances through the expanding photosphere method, which is independent of the cosmic distance ladder. A recently introduced Gaussian process-based method allows for a fast and precise modelling of spectral time series, which puts accurate and computationally cheap Type II-based absolute distance determinations within reach. Aims: The goal of the paper is to assess the internal consistency of this new modelling technique coupled with the distance estimation empirically, using the spectral time series of supernova siblings, i.e. supernovae that exploded in the same host galaxy. Methods: We use a recently developed spectral emulator code, which is trained on \textsc{Tardis} radiative transfer models and is capable of a fast maximum likelihood parameter estimation and spectral fitting. After calculating the relevant physical parameters of supernovae we apply the expanding photosphere method to estimate their distances. Finally, we test the consistency of the obtained values by applying the formalism of Bayes factors. Results: The distances to four different host galaxies were estimated based on two supernovae in each. The distance estimates are not only consistent within the errors for each of the supernova sibling pairs, but in the case of two hosts they are precise to better than 5\%. Conclusions: Even though the literature data we used was not tailored for the requirements of our analysis, the agreement of the final estimates shows that the method is robust and is capable of inferring both precise and consistent distances. By using high-quality spectral time series, this method can provide precise distance estimates independent of the distance ladder, which are of high value for cosmology.Comment: 20 pages, 20 figures, 6 tables, Accepted in A&