Search

Mobile devices (MDs) are used by mobile cloud computing (MCC) customers and by other users because of their portability, robust connectivity, and ability to house and operate third-party applications (apps). However, the apps installed on an MD may pose data security risks to the MD owner and to other MCC users, especially when the requested permissions include access to sensitive data (e.g., user's location and contacts). Calculating the risk score of an app or quantifying its potential harmfulness based on user input or on data gathered while the app is actually running may not provide reliable and sufficiently accurate results to avoid harmful consequences. This study develops and evaluates a risk assessment framework for Android-based MDs that does not depend on user input or on actual app behavior. Rather, an app risk evaluator assigns a risk category to each resident app based on the app's classification (benign or malicious) and the app's risk score. The app classifier (a trained machine learning model) evaluates the permissions and intents requested by the app. The app risk score is calculated by applying a probabilistic function based on the app's use of a set of selected dangerous permissions. The results from testing of the framework on an MD with real-life resident apps indicated that the proposed security solution was effective and feasible. [ABSTRACT FROM AUTHOR]

Depending on manual solutions for finding security vulnerabilities in web applications is time-consuming, error-prone, and requires high levels of expertise. This paper proposes a model for an automated extension-based penetration testing for web vulnerabilities that is compatible with any web application. It consists of three stages that start with information gathering, followed by a vulnerability assessment process to test for exploit. The results are then automatically generated as a report at the conclusion. To examine the model, a tool is developed based on the suggested model. Results demonstrate that the proposed technique has effectively and promptly identified application's vulnerabilities. [ABSTRACT FROM AUTHOR]

The growth of mobile devices coupled with advances in mobile technologies has resulted in the development and widespread use of a variety of mobile applications (apps). Mobile apps have been developed for social networking, banking, receiving daily news, maintaining fitness, and job-related tasks. The security of apps is an important concern. However, in some cases, app developers may be less interested in investing in the security of apps, if users are unwilling to pay for the added security. In this paper, we empirically examine whether consumers are less willing to pay for security features than for usability features. In addition, we examine whether a third-party certification of security features makes customers more willing to pay for security. Furthermore, we investigate the impact of risk perceptions on the willingness to pay for security. To explore these issues, we conducted a scenario-based experiment on mobile app users. Results from our analyses show that consumers are indeed less likely to pay for security features than usability features. However, the likelihood of paying for security features can be significantly increased by third-party certification of the features. Based on our analysis, we offer insights to producers of mobile apps to monetize the enhanced security features of their apps. [ABSTRACT FROM AUTHOR]

Mobile devices (MDs) are used by mobile cloud computing (MCC) customers and by other users because of their portability, robust connectivity, and ability to house and operate third-party applications (apps). However, the apps installed on an MD may pose data security risks to the MD owner and to other MCC users, especially when the requested permissions include access to sensitive data (e.g., user’s location and contacts). Calculating the risk score of an app or quantifying its potential harmfulness based on user input or on data gathered while the app is actually running may not provide reliable and sufficiently accurate results to avoid harmful consequences. This study develops and evaluates a risk assessment framework for Android-based MDs that does not depend on user input or on actual app behavior. Rather, an app risk evaluator assigns a risk category to each resident app based on the app’s classification (benign or malicious) and the app’s risk score. The app classifier (a trained machine learning model) evaluates the permissions and intents requested by the app. The app risk score is calculated by applying a probabilistic function based on the app’s use of a set of selected dangerous permissions. The results from testing of the framework on an MD with real-life resident apps indicated that the proposed security solution was effective and feasible.

With the rising trends and use of machine learning algorithms for classification and regression tasks, deep learning has been widely accepted in the Cyber and as well as non-Cyber Domain. Recent researches have shown that machine learning classifiers such as Deep Neural Networks (DNN) can be used to improve the detection against adversarial samples as well as to detect malware in the cyber security domain. However, a recent study in deep learning has found that DNN classifiers are highly vulnerable and can be evaded simply by either performing small modifications in the training model or training data. The work proposed a randomized defensive mechanism with the use of generative adversarial networks to construct more adversaries and then defend against them. Interestingly, we encountered some open challenges highlighting common difficulties faced by defensive mechanisms. We provide a general overview of adversarial attacks and proposed an Adaptive Randomized Algorithm to enhance the robustness of models. Moreover, this work aimed to ensure the security and transferability of deep learning classifiers. [ABSTRACT FROM AUTHOR]

This study evaluates mechanisms to secure relational databases against security vulnerabilities and utilized PostgreSQL and Microsoft SQL Server due to data breach incidences reported across the world. Emulation experiments with documentary review were employed to collect necessary study data. Identification of security features and vulnerabilities that are found to affect the data tier of the web applications were examined. The findings from the study have shown that Microsoft SQL Server is more security feature-rich in terms of Confidentiality, Integrity, and Availability compared to PostgreSQL and Microsoft SQL Server is more resilient to security attacks in its default behavior compared to PostgreSQL. [ABSTRACT FROM AUTHOR]

The utilization of cryptography in applications has assumed paramount importance with the escalating security standards for Android applications. The adept utilization of cryptographic APIs can significantly enhance application security; however, in practice, software developers frequently misuse these APIs due to their inadequate grasp of cryptography. A study reveals that a staggering 88% of Android applications exhibit some form of cryptographic misuse. Although certain tools have been proposed to detect such misuse, most of them rely on manually devised rules which are susceptible to errors and require researchers possessing an exhaustive comprehension of cryptography. In this study, we propose a research methodology founded on a neural network model to pinpoint code related to cryptography by employing program slices as a dataset. We subsequently employ active learning, rooted in clustering, to select the portion of the data harboring security issues for annotation in accordance with the Android cryptography usage guidelines. Ultimately, we feed the dataset into a transformer and multilayer perceptron (MLP) to derive the classification outcome. Comparative experiments are also conducted to assess the model's efficacy in comparison to other existing approaches. Furthermore, planned combination tests utilizing supplementary techniques aim to validate the model's generalizability. [ABSTRACT FROM AUTHOR]

As software applications continue to become more complex and attractive to cyber-attackers, enhancing resilience against cyber threats becomes essential. Aiming to provide more robust solutions, different approaches were proposed for vulnerability detection in different stages of the application life-cycle. This article explores three main approaches to application security: Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA). The analysis conducted in this work is focused on open-source solutions while considering commercial solutions to show contrast in the approaches taken and to better illustrate the different options available. It proposes a baseline comparison model to help evaluate and select the best solutions, using comparison criteria that are based on community standards. This work also identifies future opportunities for application security, highlighting some of the key challenges that still need to be addressed in order to fully protect against emerging threats, and proposes a workflow that combines the identified tools to be used for vulnerability assessments.

Different activities, artifacts, and roles can be found in the literature on the agile engineering of secure software (AESS). The purpose of this paper is to consolidate them and thus identify key activities, artifacts, and roles that can be employed in AESS. To gain initial sets of activities, artifacts, and roles, the literature was first extensively reviewed. Activities, artifacts, and roles were then cross-evaluated with similarity matrices. Finally, similarity matrices were converted into distance matrices, enabling the use of Ward's hierarchical clustering method for consolidating activities, artifacts, and roles into clusters. Clusters of activities, artifacts, and roles were then named as key activities, artifacts, and roles. We identified seven key activities (i.e., security auditing, security analysis and testing, security training, security prioritization and monitoring, risk management, security planning and threat modeling; and security requirements engineering), five key artifacts (i.e., security requirement artifacts, security repositories, security reports, security tags, and security policies), and four key roles (i.e., security guru, security developer, penetration tester, and security team) in AESS. The identified key activities, artifacts, and roles can be used by software development teams to improve their software engineering processes in terms of software security. [ABSTRACT FROM AUTHOR]

Software is widely deployed and used for managing critical daily domestic, social, and economic activities. Due to software’s economic value, software is a high-value target of malicious actors and a primary source of many information security vulnerabilities. Software must be engineered to be secure because of its value. Traditional approaches to software security treat software as an addon and have been proven inadequate at producing secure software. Practicing the secure software development lifecycle (SSDLC) is recommended in academic literature. Software SMEs must adopt and practice the SSDLC for increased security of published software. This paper explores the SSDLC and makes a case for its adoption with the goal of informing security decision-makers of Software SMEs. [ABSTRACT FROM AUTHOR]

The application layer in the Internet protocol suite offers a significant degree of freedom regarding the orchestration of distributed denial-of-service attacks due to many different and unstandardized protocols. The primary focus of defending against application-layer distributed denial-of-service attacks has traditionally been Hypertext Transfer Protocols oriented while observing individual users' actions independently from one another. In this paper, we present and analyze a novel application-layer DDoS attack in massively multiplayer online games that utilize the cooperative efforts of the attackers to deplete the server's or players' bandwidth. The attack exploits in-game dependencies between players to cause a massive spike in bandwidth while the attackers' traffic remains legitimate. We introduce a multiplayer-relations graph to model user behavior on a game server. Additionally, we demonstrate the attack's devastating capabilities on an emulated World of Warcraft server. Lastly, we discuss flaws of the existing defense mechanisms and possible approaches for the detection of these attacks using graph theory and multiplayer-relations graphs. [ABSTRACT FROM AUTHOR]

The basic requirements of online shopping applications include providing quality information and application security for its users. Technological innovations are currently using mobile phones or called mobile commerce (M-Commerce) for access to online shopping. Shopee as one of the leading M-Commerce strives to provide a variety of access to information and increase the level of application security to maintain user satisfaction. Satisfaction with the services provided by M-Commerce can trigger user repeat purchases. This study aims to examine the relationship between information quality or application security on Shopee users' repurchase intentions with a mediator of consumer satisfaction. Survey quantitative research method with 272 Shopee consumer subjects selected using an accidental sampling technique. The data were analyzed using the Process Hayes model 4. The results showed that consumer satisfaction mediated the relationship between information quality and repurchase intention (β = 0.0596; CI = 0.03, 0.09). Meanwhile, the consumer satisfaction mediator mediates the relationship between application security and repurchase intention (β = 0.2408; CI = 0.16, 0.34). It can be concluded that feelings of satisfaction with relevant information services and application security can shape consumer intentions to buy the same application. [ABSTRACT FROM AUTHOR]

Security Socket Layer (SSL) / Transport Layer Security (TLS) protocols are utilized to secure network communication (e.g., transmitting user data). Failing to properly implement SSL/TLS configuration during the app development results in security risks. The weak implementations include trusting all host names, trusting all certificates, ignoring certificate verification errors, even lack of SSL public key pinning usage. These unsecured implementations may cause ManIn-The-Middle (MITM) attacks. The major aim of this research is to detect configuration errors of SSL/TLS implementation in Android apps. It consists of the common use of existing open source tools in the static analysis phase and the combination of manual method in the dynamic analysis phase. During the static analysis phase, dynamic analysis of the findings obtained by scanning four types of vulnerabilities is used to verify the abuse status of SSL/TLS by testing. The dynamic analysis is essential for eliminating false positives generated at the static analysis stage. We analyze 109 apps from Google Play Store and the experimental results show that 45 (41.28%) apps contain potential security errors in the application of SSL/TLS. We verify that 19 (17.43%) out of 109 apps are vulnerable to MITM attacks.

With the advent of the 5G network era, the convenience of mobile smartphones has become increasingly prominent, the use of mobile applications has become wider, and the number of mobile applications has increased. However, the privacy of mobile applications and the security of users' private information are worrying. This article aims to study the ratings of data and machine learning on the privacy security of mobile applications and uses the experiments in this article to conduct data collection, data analysis, and summary research. This paper experimentally establishes a machine learning model to realize the prediction of privacy scores of Android applications. The establishment of this model is based on the intent of using sensitive permissions in the application and related metadata. It is to create a regression function that can implement the mapping of applications to score. Experimental data shows that the feature vector prediction model can uniquely be used to represent the actual usage and scheme of a system's specific permissions for the application. [ABSTRACT FROM AUTHOR]

With the increase in the number of internet users, web applications, user data there is an increase in the number of hackers all over the world. It is becoming challenging for organizations to ensure the security of the data of their employees and their customers around the world. Any cyber-attack on the organization will drastically affect the reputation of the organization as well as the loss of trust from the users or customers. Customers will not invest in these organizations who have encountered a cyber threat or attack. Hence, enabling regular security testing and checks by the penetration testers or security analysts help in preparing the organization from any security threat by testing network and applications. Even after performing the Vulnerability Assessment and Penetration Testing (VAPT) of the applications, it is extremely necessary to follow up the security patches to mitigate all the existing flaws and security vulnerabilities in the web applications under the organization. To this end, this paper presents the common web application security vulnerabilities, prior requirements for performing any security assessment of the web application along with the do's and don'ts of the assessment in accordance with each vulnerability. This paper also discusses various types of security testing and how VAPT is essential in every organization. [ABSTRACT FROM AUTHOR]

The integration of security aspects into software development is an open topic, especially in highly regulated industries where standards are accompanied by a high degree of complexity. The research question of this paper relates to the misconception of industry standards compliance and security in the field of software development. Cyber attackers are constantly inventing new tools to penetrate systems and exploit even the most minor flaws, and adherence to an industry standard is not a solution. In this study, an empirical investigation is conducted over a six-month period to observe various customer relationship management (CRM) systems. To analyze and anticipate the vulnerabilities of various CRMs, penetration testing methodologies and cross-project prediction approaches are employed. Classification using multiple machine learning approaches is utilized in the study to increase the discovery of vulnerable components in each CRM. The Student t -test is also used to assess if the mean values of the two CRM datasets are substantially different from each other in order to evaluate the efficacy of overall security and its features. The results show that security best practices during application development have a significant influence on applications created in regulated environments. The action research approach used to validate this study provided positive results and its feasibility in practice to optimize security throughout the application development. This study adds to the literature on information security management systems (ISMS) and best practices in application development in terms of creating and implementing opportunities based on broader information security management measures. [ABSTRACT FROM AUTHOR]

Research-based on user behavior analysis for authentication is the motivation for this research. We move ahead using a behavioral approach to identify malicious users and legitimate users. In this paper, we have explained how we have applied big data analytics to application-layer logs and predicted malicious users by employing a Machine Learning algorithm based on certain metrics explained later in the paper. Machine Learning would present a list of IP addresses or user identification tokens (UIT),deduced from live data which would be performing a malicious activity or are suspected of malicious activity based on their browsing behavior. We have created an e-commerce web application and induced vulnerabilities intentionally for this purpose. We have hosted our setup on LAMP [1] stack based on AWS cloud [2]. This method has a huge potential as any organization can imply this to monitor probable attackers thus narrowing down on their efforts to safeguard their infrastructure. The idea is based on the fact that the browsing pattern, as well as the access pattern of a genuine user,varies widely with that of a hacker. These patterns would be used to sort out the incoming traffic from and list out IP addresses and UIT that are the most probable cases of hack attempts.

The author looks at 25 years of industrial application security through a lens of a code review document released in 1996, examines the progress that's been made and what those trends imply for the future. [ABSTRACT FROM AUTHOR]

Предметом дослідження в статті є методологія розробки і захисту програмного забезпечення в рамках DevSecOps. Дана методологія змінила підхід до забезпечення безпеки з реактивного на проактивний, а також підкреслює важливість забезпечення безпеки на всіх рівнях організації. DevSecOps означає забезпечення безпеки в розробці додатків від самих ранніх етапів до самого кінця, а також включає в себе ав томатизацію деяких шлюзів безпеки, щоб запобігти уповільнення робочого процесу DevOps. Необхідно підтримувати короткі і часто повторювані цикли розробки програмного продукту, а також інтегрувати заходи безпеки. Вибір правильних інструментів для безперервної інтеграції безпеки може допомогти в досягненні цих цілей. Сучасні інструменти автоматизації допомогли організаціям впровадити більш гнучкі методи розробки, а також зіграли свою роль в розробці нових заходів безпеки. Для ефективного захисту DevOps потрібні не тільки нові інструменти, а й зміни в самій організації процесів DevOps, щоб швидше інтегрувати роботу груп фахівців з безпеки з іншими спеціалістами, що призведе до покращення якості продукту. Стаття присвячена детальному аналізу сучасних підходів і методологій систематизації розробки та захисту програмного забезпечення, серед яких SDLC, BSIMM і OpenSAMM. Мета роботи – класифікація підходів до побудови процесів DevSecOps, а також розгляд методологій систематизації існуючих засобів захисту програмного забезпечення, що забезпечують взаємодію команди розробників і фахівців із захисту інформації в рамках одного життєвого циклу розробки. У статті вирішуються наступні завдання: розгляд і аналіз підходів побудови процесів DevSecOps і розгляд методологій систематизації засобів захисту програмного забезпечення. Отримані наступні результати: проаналізовано необхідні складові для побудови DevSecOps процесів. Висновки: проведений аналіз дозволяє класифікувати процес розробки і захисту програмного забезпечення за допомогою методології DevSecOps.

Millennials have a lifestyle that is different from previous generations. Millennial Generation lives and grows together with rapid technological growth and currently dominates the population in Indonesia. The purpose of this study is to empirically determine the factors that influence the millennial generation’s loyalty to mobile banking applications. Elements used to analyze the millennial generation’s loyalty are corporate image, application security, word of mouth (WoM), and trust. Data collected through questionnaires from a sample of 395mobile banking users in Indonesia. The study uses structural equation modeling (SEM) to test the hypotheses with Amos 24 as the analysis tool. The results of the study proved that all predictions are proven significant. The trust in mobile banking mediates the effects of corporate image, application security, and word of mouth on millennial’s loyalty. The respondent of the research was millennial mobile banking users in Indonesia. Therefore, the model should be replicated among other mobile banking users in other countries. Banks have to maintain an excellent corporate image and get a positive transmission because, in this digitalization era, information can spread very quickly between friends, relatives, family, or through the internet, digital media, and social media. Banking also needs to include a guaranteed level of application security in the mobile banking application provided to gain the trust of users and be able to foster and increase their loyalty. However, there are still other factors that can influence millennial’s loyalty to a mobile banking application.

Insecure cloud-native applications (CNAs) will continue to experience security compromises including data breaches due to their dynamic, complex, and varied threat landscape. We review current application security techniques, examine their benefits and shortcomings in the context of CNAs, and point out future research opportunities. [ABSTRACT FROM AUTHOR]

Cloud computing is currently becoming a well-known buzzword in which business titans, such as Microsoft, Amazon, and Google, among others, are at the forefront in developing and providing sophisticated cloud computing systems to their users in a cost-effective manner. Security is the biggest concern for cloud computing and is a major obstacle to users adopting cloud computing systems. Maintaining the security of cloud computing is important, especially for the infrastructure. Several research works have been conducted in the cloud infrastructure security area; however, some gaps have not been completely addressed, while new challenges continue to arise. This paper presents a comprehensive survey of the security issues at different cloud infrastructure levels (e.g., application, network, host, and data). It investigates the most prominent issues that may affect the cloud computing business model with regard to infrastructure. It further discusses the current solutions proposed in the literature to mitigate the different security issues at each level. To assist in solving the issues, the challenges that are still unsolved are summarized. Based on the exploration of the current challenges, some cloud features such as flexibility, elasticity and the multi-tenancy are found to pose new challenges at each infrastructure level. More specifically, the multi-tenancy is found to have the most impact at all infrastructure levels, as it can lead to several security problems such as unavailability, abuse, data loss and privacy breach. This survey concludes by giving some recommendations for future research. [ABSTRACT FROM AUTHOR]

The application layer in the Internet protocol suite offers a significant degree of freedom regarding the orchestration of distributed denial-of-service attacks due to many different and unstandardized protocols. The primary focus of defending against application-layer distributed denial-of-service attacks has traditionally been Hypertext Transfer Protocols oriented while observing individual users’ actions independently from one another. In this paper, we present and analyze a novel application-layer DDoS attack in massively multiplayer online games that utilize the cooperative efforts of the attackers to deplete the server’s or players’ bandwidth. The attack exploits in-game dependencies between players to cause a massive spike in bandwidth while the attackers’ traffic remains legitimate. We introduce a multiplayer-relations graph to model user behavior on a game server. Additionally, we demonstrate the attack’s devastating capabilities on an emulated World of Warcraft server. Lastly, we discuss flaws of the existing defense mechanisms and possible approaches for the detection of these attacks using graph theory and multiplayer-relations graphs.

Ensuring sustainable-security of web applications for minimizing security breaches and enhancing users' trust and satisfaction is the foremost priority of all security experts and web developers. However, sustainable-security is multidimensional, emergent, and an irreducible concept. Also, designing sustainable-security of web application is a complex process because it is a multi-attribute approach which is based on the users' needs and organization's policies. In this context, the decision making process could be an effective means to quantitatively evaluate sustainable-security of web application design. In this research study, the authors have used a technique that involves integrating Fuzzy Analytic Hierarchy Process (Fuzzy AHP) and Fuzzy Technique for Order of Preference by Similarity to Ideal Solution (Fuzzy TOPSIS) approaches for the assessment of sustainable-security of web applications. The efficacy of this technique has then been tested on a web application designed specifically to cater to the requisites of an academic institution, Babasaheb Bhimrao Ambedkar University in India. Given the sensitivity of web application, this paper has used different versions of a University web application. The results thus obtained and the approach employed in this study would definitely aid the future researchers and developers in designing web applications with higher sustainable-security.

Security Socket Layer (SSL) / Transport Layer Security (TLS) protocols are utilized to secure network communication (e.g., transmitting user data). Failing to properly implement SSL/TLS configuration during the app development results in security risks. The weak implementations include trusting all host names, trusting all certificates, ignoring certificate verification errors, even lack of SSL public key pinning usage. These unsecured implementations may cause Man-In-The-Middle (MITM) attacks. The major aim of this research is to detect configuration errors of SSL/TLS implementation in Android apps. It consists of the common use of existing open source tools in the static analysis phase and the combination of manual method in the dynamic analysis phase. During the static analysis phase, dynamic analysis of the findings obtained by scanning four types of vulnerabilities is used to verify the abuse status of SSL/TLS by testing. The dynamic analysis is essential for eliminating false positives generated at the static analysis stage. We analyze 109 apps from Google Play Store and the experimental results show that 45 (41.28%) apps contain potential security errors in the application of SSL/TLS. We verify that 19 (17.43%) out of 109 apps are vulnerable to MITM attacks. [ABSTRACT FROM AUTHOR]

Copyright of B&H Electrical Engineering is the property of Sciendo and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Recent advances in hardware and telecommunications have enabled the development of low cost mobile devices equipped with a variety of sensors. As a result, new functionalities, empowered by emerging mobile platforms, allow millions of applications to take advantage of vast amounts of data. Following this trend, mobile health applications collect users health-related information to help them better comprehend their health status and to promote their overall wellbeing. Nevertheless, health-related information is by nature and by law deemed sensitive and, therefore, its adequate protection is of substantial importance. In this paper we provide an in-depth security and privacy analysis of some of the most popular freeware mobile health applications. We have performed both static and dynamic analysis of selected mobile health applications, along with tailored testing of each application's functionalities. Long term analyses of the life cycle of the reviewed apps and our general data protection regulation compliance auditing procedure are unique features of the present paper. Our findings reveal that the majority of the analyzed applications do not follow well-known practices and guidelines, not even legal restrictions imposed by contemporary data protection regulations, thus jeopardizing the privacy of millions of users.

Cybersecurity comprised all the technologies and practices that protect data as well as computer and network systems. In this article, we develop four course modules on critical cybersecurity topics that can be adopted in college-level cybersecurity courses in which these topics are covered. Our goal for developing these course modules with the hands-on labs is to increase students' understanding and hands-on experiences on these critical topics that support cyber skills development for college students. The hands-on labs are designed to enhance students' engagement and provide them hands-on experiences with real-world cyber activities to augment their cyber education of both foundational and advanced skills. We also conduct research surveys on the most-recent significant research in these critical cybersecurity fields. These cybersecurity course modules with the labs are also designed to help college/university professors enhance and update their cybersecurity course content, activities, hands-on lab exercises, and pedagogical methods, as well as emphasize the cyber skills to meet today's pressing cybersecurity education needs for college students. Our proposed cybersecurity modules with hands-on labs will also help building the nation's cybersecurity workforce. [ABSTRACT FROM AUTHOR]

According to a series of the national cyber security level protection and risk assessment standards and the characteristics of electric power information systems, a risk assessment model for application security of state grid edge computing is proposed. Then, the vulnerability scanning tools AW VS and AppScan are used to target security vulnerability evaluation and risk assessment experiments on the open source web application target software BWAPP that integrates the latest security vulnerabilities. Finally，the fuzzy analytic hierarchy method is used to comprehensively evaluate the security of Web application security. Based on the test results of the application security, the security assessment data are compiled to realize the verification of the application security risk assessment of the state grid edge computing. [ABSTRACT FROM AUTHOR]

As a consequence to factors such as progress made by the attackers, release of new technologies and use of increasingly complex systems, and threats to applications security have been continuously evolving. Security of code and privacy of data must be implemented in both design and programming practice to face such scenarios. In such a context, this paper proposes a software development approach, Privacy Oriented Software Development (POSD), that complements traditional development processes by integrating the activities needed for addressing security and privacy management in software systems. The approach is based on 5 key elements (Privacy by Design, Privacy Design Strategies, Privacy Pattern, Vulnerabilities, Context). The approach can be applied in two directions forward and backward, for developing new software systems or re-engineering an existing one. This paper presents the POSD approach in the backward mode together with an application in the context of an industrial project. Results show that POSD is able to discover software vulnerabilities, identify the remediation patterns needed for addressing them in the source code, and design the target architecture to be used for guiding privacy-oriented system re-engineering. [ABSTRACT FROM AUTHOR]

Millennials have a lifestyle that is different from previous generations. Millennial Generation lives and grows together with rapid technological growth and currently dominates the population in Indonesia. The purpose of this study is to empirically determine the factors that influence the millennial generation's loyalty to mobile banking applications. Elements used to analyze the millennial generation's loyalty are corporate image, application security, word of mouth (WoM), and trust. Data collected through questionnaires from a sample of 395mobile banking users in Indonesia. The study uses structural equation modeling (SEM) to test the hypotheses with Amos 24 as the analysis tool. The results of the study proved that all predictions are proven significant. The trust in mobile banking mediates the effects of corporate image, application security, and word of mouth on millennial's loyalty. The respondent of the research was millennial mobile banking users in Indonesia. Therefore, the model should be replicated among other mobile banking users in other countries. Banks have to maintain an excellent corporate image and get a positive transmission because, in this digitalization era, information can spread very quickly between friends, relatives, family, or through the internet, digital media, and social media. Banking also needs to include a guaranteed level of application security in the mobile banking application provided to gain the trust of users and be able to foster and increase their loyalty. However, there are still other factors that can influence millennial's loyalty to a mobile banking application. [ABSTRACT FROM AUTHOR]