Gencer Erdogan

• Erdogan, Gencer; Gillette, Morgan; Tverdal, Simeon & Halvorsrud, Ragnhild (2026). From Manual to Automated Cyber Risk Assessment: LLM- and RAG-Driven Multi-Agent Threat Modeling with CORAS in Healthcare Case Studies. In Wong, W. Eric; Zualkernan, Imran & Ding, Junhua (Ed.), Proceedings of the 2025 12th International Conference on Dependable Systems and Their Applications (DSA), Sharjah, United Arab Emirates, 24-26 Nov. 2025. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781665477697. p. 55–64. doi: 10.1109/DSA66321.2025.00018. Full text in Research Archive Show summary

  Cyber risk assessment is a cornerstone of cybersecurity management, yet current practices remain largely manual, static, and resource intensive. This paper presents the CORAS Threat Modeler, an open-source tool that leverages large language models (LLMs), retrieval-augmented generation (RAG), and multi-agent orchestration to automate the generation of structured risk information and threat models directly from natural-language system descriptions. The tool was developed with three success criteria in mind: automating threat model creation, enabling dynamic risk assessment through context-aware retrieval and generation, and supporting accessibility for both experts and non-experts. We present the architecture of the tool and its integration with CAPEC and CWE repositories, and report on an evaluation across three healthcare case studies: one hospital and two medical device manufacturers. Results show that the tool successfully produced syntactically correct and interpretable threat models, generated contextually relevant risks and mitigations, and lowered the entry barrier for non-experts. However, improvements for broader risk coverage, treatment flexibility, and enhanced usability are needed to fully realize its potential.

• Carmichael, Laura; Taylor, Steve; Senior, Samuel; Surridge, Mike; Erdogan, Gencer & Tverdal, Simeon (2025). Systematisation of Security Risk Knowledge Across Different Domains: A Case Study of Security Implications of Medical Devices. In Pietro, Roberto Di; Renaud, Karen & Mori, Paolo (Ed.), Proceedings of the 11th International Conference on Information Systems Security and Privacy - (Volume 1), February 20-22, 2025, in Porto, Portugal. SciTePress. ISSN 9789897587351. doi: 10.5220/0013306100003899. Full text in Research Archive Show summary

  Shared terminology and understanding are vital for effective cybersecurity risk management for connected medical and in vitro diagnostic device systems, given that such processes are collaborative and require cross-domain expertise particularly, e.g., in the areas of patient safety, cyber-physical security, and privacy. However, fostering effective, interdisciplinary risk communication can be challenging — especially where, e.g., different terms are used with the same meaning, or the same risk management terms are interpreted differently across domains. In this paper, we focus on the systematisation of security risk knowledge across different domains related to the cybersecurity of connected medical and in vitro diagnostic device systems. This work relates to knowledge base extensions for a specified cybersecurity risk assessment tool—Spyderisk—as part of the NEMECYS project.

• Stelkens-Kobsch, Tim H.; Hagl, Maria; Meland, Per HÃ¥kon; Gaba, Gurjot Singh; Bernsmed, Karin & Dambra, Carlo [Show all 11 contributors for this article] (2025). Air Traffic Management Security in the Digital Age: A Proactive Risk Management Strategy. In VanderLeest, Steve & Durling, Michael (Ed.), Proceedings of the 2025 AIAA DATC/IEEE 44th Digital Avionics Systems Conference (DASC), Montreal, Canada, September 14-18, 2025. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9798331525194. doi: 10.1109/dasc66011.2025.11257275. Full text in Research Archive Show summary

  The security risk management discipline has historically been less developed than safety management systems, but the rapid digitalization of industries creates an urgent need for more proactive approaches. Current methods often rely on outdated lists and paper-based processes, leading to overlooked vulnerabilities and delayed responses to emerging threats. This paper presents a possible enhancement of the existing cyber and physical Security Risk Assessment Methodology (SecRAM). The enhanced SecRAM is currently validated through dedicated exercises and expert input. The approach considers cascading effects for attack and impact propagation, and is embedded within a system framework that recognizes interconnections and dependencies between services, systems, procedures, roles, and functions. With its web-based tool and user-friendly interface, the enhanced SecRAM proves its general applicability and shows potential for broader adoption across sectors, particularly aviation. Future work will focus on integrating automation and AI to improve efficiency and accuracy in risk assessments.

• Tverdal, Simeon; Erdogan, Gencer; Skytterholm, Andrea Neverdal; Senior, Samuel M.; Taylor, Steve & Carmichael, Laura (2025). Cyber-Risk Indicators for Connected Medical Devices. In Praça, Isabel; Bernardi, Simona & Inácio, Pedro R.M. (Ed.), Cybersecurity: 9th European Interdisciplinary Cybersecurity Conference, EICC 2025, Rennes, France, June 18–19, 2025, Proceedings. Springer Nature. ISSN 9783031948558. p. 288–306. doi: 10.1007/978-3-031-94855-8_19. Full text in Research Archive Show summary

  Connected Medical Devices (CMDs) play a crucial role in modern healthcare, enabling real-time monitoring, automated decision making, and remote patient care. However, increasing reliance on digital connectivity introduces significant cybersecurity risks. As CMDs are used in increasingly diverse contexts, traditional risk assessment approaches may fail to capture the nuances of each use case. The increased attack surface and additional lack of cybersecurity experience among daily users further highlight the need for accurate and comprehensible risk management information. Cyber-risk indicators are additional pieces of information that can connect the risk assessment to its dynamic context, enabling risk assessors to estimate risk values more precisely and accurately. In this article, we define and present domain-specific cyber-risk indicators to facilitate dynamic risk assessment in the CMD domain and demonstrate how they can be used in the risk assessment process. Preliminary results from four real-world industry case studies are promising and validate the feasibility of our approach.

• Erdogan, Gencer; Omerovic, Aida; Solvang, Eivind; Killingberg, Andreas; Kvinnesland, Are & Abrahamsen, Inge (2025). Lessons Learned from a Cybersecurity Risk Assessment of OpenADR in Smart Grid Planning. In Kolokotronis, Nicholas; Shiaeles, Stavros & Bellini, Emanuele (Ed.), Proceedings of the 2025 IEEE International Conference on Cyber Security and Resilience (CSR), August 4–6, 2025, Chania, Crete, Greece. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9798331535919. p. 652–659. doi: 10.1109/csr64739.2025.11130051. Full text in Research Archive Show summary

  Integrating OpenADR in smart grids enhances demand-response but introduces cybersecurity risks that must be addressed early in the planning phase. This paper presents a cybersecurity risk assessment case study for Lnett, a Norwegian DSO planning OpenADR implementation. Using a six-step, lightweight method, we identified 10 key cybersecurity risks. Stakeholder feedback highlighted the method’s structured approach, iterative process, and external expertise, while also noting challenges in defining the analysis object and tracking documentation. We derived six lessons and practical recommendations for DSOs implementing OpenADR or similar protocols, contributing to stronger cybersecurity resilience in demand-response systems and informing future smart grid risk assessments.

• Nguyen, Phu Hong; Goknil, Arda; Erdogan, Gencer; Tokas, Shukun; Ferry, Nicolas & Tran, Thanh Thao Thi (2024). Advances in Secure IoT Data Sharing. Foundations and Trends® in Privacy and Security. ISSN 2474-1558. 7(1), p. 1–73. doi: 10.1561/3300000042. Full text in Research Archive Show summary

  The proliferation of IoT devices on the Internet is currently in the billions, and projections anticipate that there will be 50 billion connected IoT devices in the IoT market by 2030. This rapid expansion will result in a substantial increase in data, which includes personal data, generated by these IoT devices. It is estimated that the data volume will reach 73.1 zettabytes by 2025. To fully realize the substantial benefits of the IoT, it is imperative to facilitate the responsible utilization and sharing of this data among various stakeholders. However, it is crucial to establish robust security and trust mechanisms to ensure data integrity and privacy during data sharing. Our objective is to summarize and assess the research efforts that address secure IoT data sharing. We systematically review the state-of-the-art techniques ensuring and preserving security in the IoT data-sharing environment through a systematic literature review (SLR) study. We pose three research questions, define selection and exclusion criteria for primary studies, and extract and synthesize data from these studies to answer our research questions. Our SLR results can help readers to obtain (i) an overview of existing secure IoT data-sharing approaches and related issues, (ii) a deep-dive into Edge-focused secure IoT data sharing solutions, and (iii) research directions that require attention from the research community for follow-up work.

• Erdogan, Gencer; Carmichael, Laura; Taylor, Steve; Tverdal, Simeon & Skytterholm, Andrea Neverdal (2024). Dynamic Cyber Risk Assessment for Connected Medical Devices: the NEMECYS Approach. In Araujo, Joao; Vara, Jose Luis de la; Condori-Fernández, Nelly; Bruel, Jean-Michel; Santos, Maribel Yasmina; Assar, Saïd; Moor, Katrien Rachel W De; Gharib, Mohamad; Li, Tong; Barros, João Paulo; Brito, Isabel Sofia; Machado, Ivan; Karagiannis, Dimitris; Sales, Tiago Prince & Salinesi, Camille (Ed.), Joint Proceedings of RCIS 2024 Workshops and Research Projects Track co-located with the 18th International Conferecence on Research Challenges in Information Science (RCIS 2024). CEUR Workshop Proceedings. ISSN 9783031594649. Full text in Research Archive Show summary

  Connected Medical Devices (CMDs) face many critical cybersecurity challenges. Cybersecurity risk assessment is the industry de facto standard process to assess and mitigate potential cybersecurity risks. However, current cybersecurity risk assessments in the CMD domain are typically static, and many situations are highly dynamic involving changing circumstances of patient care priorities or new vulnerabilities detected at runtime. Thus, there is a clear need to support dynamic, runtime cybersecurity risk assessment where new events are reflected automatically in risk levels, and appropriate controls are recommended for unacceptable risks to return the residual risk to an acceptable level. In the EU project NEMECYS, we are developing an approach to dynamic cyber risk assessment for CMDs. The objective of this paper is to provide a high-level introduction to the NEMECYS project, and then explain in more detail our proposed dynamic cyber risk assessment approach for CMDs.

• Erdogan, Gencer; Zerihun, Tesfaye Amare; Sperstad, Iver Bakken & Gjerde, Oddbjørn (2024). A Light-Weight Tool-Supported Method for Cyber Risk Assessment in the Planning of Cyber-Physical Smart Grids. In 2024, . SmartGridComm (Eds.), 2024 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids-SmartGridComm. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9798350318555. p. 314–320. doi: 10.1109/SmartGridComm60555.2024.10738053. Full text in Research Archive Show summary

  A major challenge during grid planning is the identification of cybersecurity threats potentially introduced by active digital measures. This challenge arises because grid planning occurs at an early, conceptual stage, typically years ahead of realization, and often lacks concrete information about the active digital measures at this early phase. This highlights the need for simple, user-friendly cyber risk assessment methods that grid planners can use, even without detailed information about the final solutions. To address this need, we propose a lightweight, tool-supported, six-step method. This method employs the Customer Journey Modeling Language (CJML), which is comprehensible to various professional backgrounds, and which we have adapted to include the necessary cybersecurity concepts to help grid planners identify cybersecurity threats. The method is supported by our freely available, open-source risk modeling tool. Using a case based on a real-world electricity distribution grid, we demonstrate how our method supports grid planners in performing cyber-risk assessments with limited information about the final solutions and their vulnerabilities to cyber threats. Preliminary results indicate that our method is effective in enabling grid planners to assess potential cybersecurity risks during the planning phase, thereby enhancing the reliability and security of future electricity distribution systems.

• Erdogan, Gencer; Halvorsrud, Ragnhild; Boletsis, Costas; Tverdal, Simeon & Pickering, J. Brian (2023). Cybersecurity Awareness and Capacities of SMEs. ICISSP. p. 296–304. doi: 10.5220/0011609600003405. Full text in Research Archive Show summary

  Small and Medium Enterprises (SMEs) are increasingly exposed to cyber risks. Some of the main reasons include budget constraints, the employees’ lack of cybersecurity awareness, cross-sectoral cyber risks, lack of security practices at organizational level, and so on. To equip SMEs with appropriate tools and guidelines that help mitigate their exposure to cyber risk, we must better understand the SMEs’ context and their needs. Thus, the contribution of this paper is a survey based on responses collected from 141 SMEs based in the UK, where the objective is to obtain information to better understand their level of cybersecurity awareness and practices they apply to protect against cyber risks. Our results indicate that although SMEs do apply some basic cybersecurity measures to mitigate cyber risks, there is a general lack of cybersecurity awareness and lack of processes and tools to improve cybersecurity practices. Our findings provide to the cybersecurity community a better understanding of the SME context in terms of cybersecurity awareness and cybersecurity practices, and may be used as a foundation to further develop appropriate tools and processes to strengthen the cybersecurity of SMEs.

• Tokas, Shukun & Erdogan, Gencer (2023). A Need for Privacy-Assistive Technology in Notice and Consent Paradigm in IoT. In Skarmeta, Antonio F.; Canavese, Daniele; Lioy, Antonio & Matheu, Sara (Ed.), Digital Sovereignty in Cyber Security: New Challenges in Future Vision. Springer. ISSN 9783031360961. p. 35–49. doi: 10.1007/978-3-031-36096-1_3. Full text in Research Archive Show summary

  A privacy notice is a document/notification that is addressed to consumers, describing how their personal information will be handled. While browsing the Internet, installing an app on smartphone, setting up a smart sensor or IoT devices in personal spaces, consumers are often asked to consent to privacy notices. Ideally, the consumer is expected to read and understand the notice and give an informed consent. These notices are often lengthy and complicated, containing legal-technical jargons and ambiguous statements describing commercial use of personal data. Most people reflexively choose “I consent”, unknowingly agreeing to unfair-deceptive practices. Given the ubiquity of IoT and thus ubiquity of (personal) data collection, the reliance on notice and consent is inappropriate. In this article, we present the challenges of the notice and consent paradigm, and explore the idea of privacy-assistive solutions to enhance consumer privacy awareness and control in IoT.

• Pickering, Brian; Phillips, Stephen C. & Erdogan, Gencer (2023). I Just Want to Help: SMEs Engaging with Cybersecurity Technology. In Moallem, Abbas (Eds.), HCI for Cybersecurity, Privacy and Trust: 5th International Conference, HCI-CPT 2023, Held as Part of the 25th HCI International Conference, HCII 2023, Copenhagen, Denmark, July 23–28, 2023, Proceedings. Springer. ISSN 9783031358227. p. 338–352. doi: 10.1007/978-3-031-35822-7_23. Full text in Research Archive Show summary

  The cybersecurity landscape is particularly challenging for SMEs. On the one hand, they must comply with regulation or face legal sanction. But on the other, they may not have the resource or expertise to ensure regulatory compliance, especially since this is not their core business. At the same time, it is also well-attested in the literature that individuals (human actors in the ecosystem) are often targeted for cyber attacks. So, SMEs must also consider their employees but also their clients as potential risks regarding cybersecurity. Finally, it is also known that SMEs working together as part of a single supply chain are reluctant to share cybersecurity status and information. Given all of these challenges, assuming SMEs recognise their responsibility for security, they may be overwhelmed in trying to meet all the associated requirements. There are tools to help support them, of course, assuming they are motivated to engage with such tooling. This paper looks at the following aspects of this overall situation. In a set of four studies, we assess private citizen understanding of cybersecurity and who they believe to be responsible. On that basis, we then consider their attitude to sharing data with service providers. Moving to SMEs, we provide a general overview of their response to the cybersecurity landscape. Finally, we ask four SMEs across different sectors how they respond to cybersecurity tooling. As well as providing an increased understanding of private citizen and SME attitudes to cybersecurity, we conclude that SMEs need not be overwhelmed by their responsibilities. On the contrary, they can take the opportunity to innovate based on their experience with cybersecurity tools.

• Tran, Thanh Thao Thi; Nguyen, Phu Hong & Erdogan, Gencer (2023). A Systematic Review of Secure IoT Data Sharing. In Mori, Paolo; Lenzini, Gabriele & Furnell, Steven (Ed.), Proceedings of the 9th International Conference on Information Systems Security and Privacy ICISSP 2023. SciTePress. ISSN 9789897586248. p. 95–105. doi: 10.5220/0011674200003405. Full text in Research Archive Show summary

  The Internet of Things (IoT) is more and more omnipresent. The greater values of the IoT can be realized by enabling data sharing between different stakeholders. However, one of the biggest challenges is ensuring security and enabling trust for IoT data sharing. In this paper, we identify state-of-the-art (SotA) approaches and techniques for secure IoT data sharing. We present high-level results emphasizing the SotA trend and revealing the most addressed domains, as well as more in-depth details such as procedures and methods used to preserve security in the data sharing environment. The blockchain technology, smart contracts, and InterPlanetary File System (IPFS) are among the most widely used approaches. As today’s solutions explore a more decentralized approach to data sharing, there are several aspects to consider. Based on the findings, we have identified potential research directions for future work, including the differences between public and private blockchains, the combinat (More)

• Tokas, Shukun; Erdogan, Gencer & Stølen, Ketil (2023). Privacy-Aware IoT: State-of-the-Art and Challenges. In Mori, Paolo; Lenzini, Gabriele & Furnell, Steven (Ed.), Proceedings of the 9th International Conference on Information Systems Security and Privacy ICISSP 2023. SciTePress. ISSN 9789897586248. p. 450–461. doi: 10.5220/0011656400003405. Full text in Research Archive Show summary

  The consumer IoT is now prevalent and creates an enormous amount of fine-grained, detailed information about consumers’ everyday actions, personalities, and preferences. Such detailed information brings new and unique privacy challenges. The consumers are not aware of devices that surround them. There is a lack of transparency and absence of support for consumers to control the collection and processing of their personal and sensitive data. This paper reports on a review of state-of-the-art on privacy protection in IoT, with respect to privacy enhancing technologies (PETs) and GDPR-specific privacy principles. Drawing on a thorough analysis of 36 full papers, we identify key privacy challenges in IoT that need to be addressed to provide consumers with transparency and control over their personal data. The privacy challenges we have identified are (1) the lack of technical expertise in privacy notice comprehension, (2) the lack of transparency and control of personal data, and (3) the lack of personalized privacy recommendations.

• Erdogan, Gencer; Sperstad, Iver Bakken; Garau, Michele; Gjerde, Oddbjørn; Tøndel, Inger Anne & Tokas, Shukun [Show all 7 contributors for this article] (2023). Adapting Cyber-Risk Assessment for the Planning of Cyber-Physical Smart Grids Based on Industrial Needs. In Fill, Hans-Georg; Sinderen, Marten Van & Maciaszek, Leszek A (Ed.), Software Technologies : 17th International Conference, ICSOFT 2022, Lisbon, Portugal, July 11–13, 2022, Revised Selected Papers. Springer. ISSN 9783031372315. p. 98–121. doi: 10.1007/978-3-031-37231-5_5. Full text in Research Archive Show summary

  Home Software Technologies Conference paper Adapting Cyber-Risk Assessment for the Planning of Cyber-Physical Smart Grids Based on Industrial Needs Gencer Erdogan, Iver Bakken Sperstad, Michele Garau, Oddbjørn Gjerde, Inger Anne Tøndel, Shukun Tokas & Martin Gilje Jaatun Conference paper First Online: 19 July 2023 19 Accesses Part of the Communications in Computer and Information Science book series (CCIS,volume 1859) Abstract During the grid planning process, electric power grid companies evaluate different options for the long-term grid development to address the expected future demands. The options can be passive measures, e.g., traditional reinforcement or building new lines, or active measures, e.g., support from ICT-solutions during operation to increase the power transfer capability. The ongoing digitalization of the electric power grid inevitably push the grid companies to assess potential cyber risks as part of the grid planning process. This applies especially for active measures which to a greater extent rely on support from ICT-solutions to operate the system closer to its limits. However, current grid planning approaches do not adequately provide the support needed in practice, and the industry is struggling to adopt and execute cyber-risk assessments. The contribution of this paper is threefold. First, we interview six companies from the energy sector, and based on the interviews we identify seven success criteria that cyber-risk assessment methods for the electric power sector need to fulfil to provide adequate support. Second, we present four risk assessment methods and evaluate the extent to which they fulfil the identified success criteria. Third, we address the specific need for approaches that are easy to use and comprehend, especially for grid planning purposes, and propose a low-threshold approach to support high-level cyber-risk assessment in an electric power grid planning process. Based on our findings, we provide lessons learned in terms of gaps that need to be addressed to improve cyber-risk assessment in the context of smart grids.

• Erdogan, Gencer; Tøndel, Inger Anne; Tokas, Shukun; Garau, Michele & Jaatun, Martin Gilje (2022). Needs and Challenges Concerning Cyber-Risk Assessment in the Cyber-Physical Smart Grid. In Fill, Hans-Georg; Sinderen, Marten van & Maciaszek, Leszek A. (Ed.), Proceedings of the 17th International Conference on Software Technologies (ICSOFT 2022). SciTePress. ISSN 9789897585883. p. 21–32. doi: 10.5220/0011137100003266. Full text in Research Archive Show summary

  Cyber-risk assessment methods are used by energy companies to manage security risks in smart grids. However, current standards, methods and tools do not adequately provide the support needed in practice and the industry is struggling to adopt and carry out cyber-risk assessments. The contribution of this paper is twofold. First, we interview six companies from the energy sector to better understand their needs and challenges. Based on the interviews, we identify seven success criteria cyber-risk assessment methods for the energy sector need to fulfill to provide adequate support. Second, we present the methods CORAS, VAF, TM-STRIDE, and DA-SAN and evaluate the extent to which they fulfill the identified success criteria. Based on the evaluation, we provide lessons learned in terms of gaps that need to be addressed in general to improve cyber-risk assessment in the context of smart grids. Our results indicate the need for the following improvements: 1) ease of use and comprehensible m ethods, 2) support to determine whether a method is a good match for a given context, 3) adequate preparation to conduct cyber-risk assessment, 4) manage complexity, 5) adequate support for risk estimation, 6) support for trustworthiness and uncertainty handling, and 7) support for maintaining risk assessments.

• Phillips, Stephen C.; Fair, Nicholas; Erdogan, Gencer & Tverdal, Simeon (2022). Information Security and Risk Management: Trustworthiness and Human Interaction. In Guizzardi, Renata; Ralyte, Jolita & Franch, Xavier (Ed.), Research Challenges in Information Science: 16th International Conference, RCIS 2022, Barcelona, Spain, May 17–20, 2022, Proceedings. Springer. ISSN 9783031057595. p. 821–822. doi: 10.1007/978-3-031-05760-1. Full text in Research Archive
• Erdogan, Gencer; Garcia-Ceja, Enrique; Hugo, Åsmund Pedersen; Nguyen, Phu Hong & Sen, Sagar (2021). A Systematic Mapping Study on Approaches for AI-Supported Security Risk Assessment. In Chan, W. K.; Claycomb, Bill; Takakura, Hiroki; Yang, Ji-Jiang; Teranishi, Yuuichi; Towey, Dave; Segura, Sergio; Shahriar, Hossain; Reisman, Sorel & Ahamed, Sheikh Iqbal (Ed.), Proceedings of 2021 IEEE 45th Annual Computers, Software, and Applications Conference (COMPSAC). IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781665424639. p. 755–760. doi: 10.1109/COMPSAC51774.2021.00107. Full text in Research Archive Show summary

  Effective assessment of cyber risks in the increasingly dynamic threat landscape must be supported by artificial intelligence techniques due to their ability to dynamically scale and adapt. This article provides the state of the art of AI-supported security risk assessment approaches in terms of a systematic mapping study. The overall goal is to obtain an overview of security risk assessment approaches that use AI techniques to identify, estimate, and/or evaluate cyber risks. We carried out the systematic mapping study following standard processes and identified in total 33 relevant primary studies that we included in our mapping study. The results of our study show that on average, the number of papers about AI-supported security risk assessment has been increasing since 2010 with the growth rate of 133% between 2010 and 2020. The risk assessment approaches reported have mainly been used to assess cyber risks related to intrusion detection, malware detection, and industrial systems. The approaches focus mostly on identifying and/or estimating security risks, and primarily make use of Bayesian networks and neural networks as supporting AI methods/techniques.

• Erdogan, Gencer; Romero, Antonio; Zazzeri, Niccolò; Žitnik, Anže; Basile, Mariano & Aprile, Giorgio [Show all 9 contributors for this article] (2021). Developing Cyber-risk Centric Courses and Training Material for Cyber Ranges: A Systematic Approach. In Mori, Paolo; Lenzini, Gabriele & Furnell, Steven (Ed.), Proceedings of the 7th International Conference on Information Systems Security and Privacy. SciTePress. ISSN 9789897584916. p. 702–713. doi: 10.5220/0010393107020713. Full text in Research Archive Show summary

  The use of cyber ranges to train and develop cybersecurity skills and awareness is attracting more attention, both in public and private organizations. However, cyber ranges typically focus mainly on hands-on exercises and do not consider aspects such as courses, learning goals and learning objectives, specific skills to train and develop, etc. We address this gap by proposing a method for developing courses and training material based on identified roles and skills to be trained in cyber ranges. Our method has been used by people with different background grouped in academia, critical infrastructure, research, and service providers who have developed 22 courses including hands-on exercises. The developed courses have been tried out in pilot studies by SMEs. Our assessment shows that the method is feasible and that it considers learning and educational aspects by facilitating the development of courses and training material for specific cybersecurity roles and skills.

• Meland, Per Håkon; Tokas, Shukun; Erdogan, Gencer; Bernsmed, Karin & Omerovic, Aida (2021). A Systematic Mapping Study on Cyber Security Indicator Data. Electronics (Basel). 10(9). doi: 10.3390/electronics10091092. Full text in Research Archive Show summary

  A security indicator is a sign that shows us what something is like or how a situation is changing and can aid us in making informed estimations on cyber risks. There are many different breeds of security indicators, but, unfortunately, they are not always easy to apply due to a lack of available or credible sources of data. This paper undertakes a systematic mapping study on the academic literature related to cyber security indicator data. We identified 117 primary studies from the past five years as relevant to answer our research questions. They were classified according to a set of categories related to research type, domain, data openness, usage, source, type and content. Our results show a linear growth of publications per year, where most indicators are based on free or internal technical data that are domain independent. While these indicators can give valuable information about the contemporary cyber risk, the increasing usage of unconventional data sources and threat intelligence feeds of more strategic and tactical nature represent a more forward-looking trend. In addition, there is a need to take methods and techniques developed by the research community from the conceptual plane and make them practical enough for real-world application

• Erdogan, Gencer; Hugo, Åsmund Pedersen; Romero, Antonio Alvarez; Varano, Dario; Zazzeri, Niccolò & Žitnik, Anže (2020). An Approach to Train and Evaluate the Cybersecurity Skills of Participants in Cyber Ranges based on Cyber-Risk Models, Proceedings of the 15th International Conference on Software Technologies. Springer. ISSN 9789897584435. p. 509–520. doi: 10.5220/0009892105090520. Full text in Research Archive
• Thompson, Andreas & Erdogan, Gencer (2020). Tool Support for Risk-driven Planning of Trustworthy Smart IoT Systems within DevOps. In Furnell, Steven; Paolo, Mori; Weippl, Edgar & Camp, Olivier (Ed.), Proceedings of the 6th International Conference on Information Systems Security and Privacy. SciTePress. ISSN 9789897583995. p. 742–753. doi: 10.5220/0009189307420753. Full text in Research Archive Show summary

  There is a serious lack of support for trustworthy smart IoT systems within DevOps. Security and privacy are often overlooked in DevOps cultures and almost absent in the context of IoT. In this paper, we focus on the planning stage of DevOps and propose a tool-supported method for risk-driven planning considering security and privacy risks. Our method consists of five steps: establish context, analyse dataflow, model privacy and security risk, develop risk assessment algorithm based on risk model, and execute risk assessment algorithm. Our tool supports this method in the first and the last step and facilitates dynamic risk assessment based on input provided by the user or collected from the monitoring stage into predefined risk models. The output of the tool is a risk assessment which the end users, e.g. developers, can use as decision support to prioritize certain parts of the target under analysis in the next cycle of DevOps. The tool and the method are evaluated in a real-world sm art home case. Our initial evaluation indicates that the approach is comprehensible for our intended users, supports the planning stage in terms of security and privacy risk assessment, and feasible for use in the DevOps practice

• Nguyen, Phu Hong; Ferry, Nicolas; Erdogan, Gencer; Song, Hui; Lavirotte, Stephane & Tigli, Jean-Yves [Show all 7 contributors for this article] (2019). A Systematic Mapping Study of Deployment and Orchestration Approaches for IoT. In Ramachandran, Muthu; Walters, Robert; Wills, Gary; Munoz, Victor Mendez & Chang, Victor (Ed.), Proceedings of the 4th International Conference on Internet of Things, Big Data and Security. SciTePress. ISSN 9789897583698. p. 69–82. doi: 10.5220/0007675700690082. Full text in Research Archive
• Nguyen, Phu Hong; Ferry, Nicolas; Erdogan, Gencer; Song, Hui; Lavirotte, Stephane & Tigli, Jean-Yves [Show all 7 contributors for this article] (2019). The preliminary results of a mapping study of deployment and orchestration for IoT. In Hung, Chih-Cheng & Papadopoulos, George A. (Ed.), Proceedings of the 34th ACM/SIGAPP Symposium on Applied Computing. ACM Digital Library. ISSN 9781450359337. doi: 10.1145/3297280.3297617. Full text in Research Archive
• Nguyen, Phu Hong; Ferry, Nicolas; Erdogan, Gencer; Song, Hui; Lavirotte, Stephane & Tigli, Jean-Yves [Show all 7 contributors for this article] (2019). Advances in deployment and orchestration approaches for IoT - A systematic review. In Dustdar, Schahram; Parashar, Manish; Nepal, Surya & Kim, Dong Seong (Ed.), IEEE International Congress on Internet of Things. IEEE Computer Society Digital Library. ISSN 9781728127149. p. 53–60. doi: 10.1109/ICIOT.2019.00021. Full text in Research Archive
• Erdogan, Gencer; Nguyen, Phu Hong; Seehusen, Fredrik; Stølen, Ketil; Hofstad, Jon & Aagedal, Jan Øyvind (2019). An Evaluation of a Test-Driven Security Risk Analysis Approach Based on Two Industrial Case Studies. In Felderer, Michael & Scandariato, Riccardo (Ed.), Exploring Security in Software Architecture and Design. IGI Global. ISSN 9781522563136. p. 69–103. doi: 10.4018/978-1-5225-6313-6.ch004. Full text in Research Archive Show summary

  Risk-driven testing and test-driven risk assessment are two strongly related approaches, though the latter is less explored. This chapter presents an evaluation of a test-driven security risk assessment approach to assess how useful testing is for validating and correcting security risk models. Based on the guidelines for case study research, two industrial case studies were analyzed: a multilingual financial web application and a mobile financial application. In both case studies, the testing yielded new information, which was not found in the risk assessment phase. In the first case study, new vulnerabilities were found that resulted in an update of the likelihood values of threat scenarios and risks in the risk model. New vulnerabilities were also identified and added to the risk model in the second case study. These updates led to more accurate risk models, which indicate that the testing was indeed useful for validating and correcting the risk models.

• Volden-Freberg, Vetle & Erdogan, Gencer (2019). An Empirical Study on the Comprehensibility of Graphical Security Risk Models Based on Sequence Diagrams. Lecture Notes in Computer Science (LNCS). ISSN 0302-9743. 11391, p. 1–17. doi: 10.1007/978-3-030-12143-3_1. Full text in Research Archive Show summary

  We report on an empirical study in which we evaluate the comprehensibility of graphical versus textual risk annotations in threat models based on sequence diagrams. The experiment was carried out on two separate groups where each group solved tasks related to either graphical or textual annotations. We also examined the efficiency of using these two annotations in terms of the average time each group spent per task. Our study reports that threat models with textual risk annotations are equally comprehensible to corresponding threat models with graphical risk annotations. With respect to efficiency, however, we found out that participants solving tasks related to the graphical annotations spent on average 23% less time per task.

• Omerovic, Aida; Vefsnmo, Hanne; Erdogan, Gencer; Gjerde, Oddbjørn; Gramme, Eivind & Simonsen, Stig (2019). A Feasibility Study of a Method for Identification and Modelling of Cybersecurity Risks in the Context of Smart Power Grids, COMPLEXIS 2019 - Proceedings of the 4th International Conference on Complexity, Future Information Systems and Risk 2019. SciTePress. ISSN 9789897583667. p. 39–51. doi: 10.5220/0007697800390051. Full text in Research Archive Show summary

  Power grids are undergoing a digital transformation are therefore becoming increasingly complex. As a result of this they are also becoming vulnerable in new ways. With this development come also numerous risks. Cybersecurity is therefore becoming crucial for ensuring resilience of this infrastructure which is critical to safety of humans and societies. Risk analysis of cybersecurity in the context of smart power grids is, however, particularly demanding due to its interdisciplinary nature, including domains such as digital security, the energy domain, power networks, the numerous control systems involved, and the human in the loop. This poses special requirements to cybersecurity risk identification within smart power grids, which challenge the existing state-of-the-art. This paper proposes a customized four-step approach to identification and modelling of cybersecurity risks in the context of smart power grids. The aim is that the risk model can be presented to decision makers in a suitable interface, thereby serving as a useful support for planning, design and operation of smart power grids. The approach applied in this study is based on parts of the "CORAS" method for model-based risk analysis. The paper also reports on results and experiences from applying the approach in a realistic industrial case with a distribution system operator (DSO) responsible for hosting a pilot installation of the self-healing functionality within a power distribution grid. The evaluation indicates that the approach can be applied in a realistic setting to identify cybersecurity risks. The experiences from the case study moreover show that the presented approach is, to a large degree, well suited for its intended purpose, but it also points to areas in need for improvement and further evaluation.

• Erdogan, Gencer; Refsdal, Atle; Nygård, Bjørn; Rosland, Ole Petter & Randeberg, Bernt Kvam (2018). Risk-Based Decision Support Model for Offshore Installations. Business Systems Research Journal. ISSN 1847-8344. 9(2), p. 55–68. doi: 10.2478/bsrj-2018-0019. Full text in Research Archive Show summary

  Background: During major maintenance projects on offshore installations, flotels are often used to accommodate the personnel. A gangway connects the flotel to the installation. If the offshore conditions are unfavorable, the responsible operatives need to decide whether to lift (disconnect) the gangway from the installation. If this is not done, there is a risk that an uncontrolled autolift (disconnection) occurs, causing harm to personnel and equipment. Objectives: We present a decision support model, developed using the DEXi tool for multi-criteria decision making, which produces advice on whether to disconnect/connect the gangway from/to the installation. Moreover, we report on our development method and experiences from the process, including the efforts invested. An evaluation of the resulting model is also offered, primarily based on feedback from a small group of offshore operatives and domain experts representing the end user target group. Methods/Approach: The decision support model was developed systematically in four steps: establish context, develop the model, tune the model, and collect feedback on the model. Results: The results indicate that the decision support model provides advice that corresponds with expert expectations, captures all aspects that are important for the assessment, is comprehensible to domain experts, and that the expected benefit justifies the effort for developing the model. Conclusions: We find the results promising, and believe that the approach can be fruitful in a wider range of risk-based decision support scenarios. Moreover, this paper can help other decision support developers decide whether a similar approach can suit them.

• Černivec, Aleš; Erdogan, Gencer; Gonzalez, Alejandra; Refsdal, Atle & Romero, Antonio Alvarez (2018). Employing Graphical Risk Models to Facilitate Cyber-Risk Monitoring - the WISER Approach. Lecture Notes in Computer Science (LNCS). ISSN 0302-9743. 10744, p. 127–146. doi: 10.1007/978-3-319-74860-3_10. Full text in Research Archive Show summary

  We present a method for developing machine-readable cyber-risk assessment algorithms based on graphical risk models, along with a framework that can automatically collect the input, execute the algorithms, and present the assessment results to a decision maker. This facilitates continuous monitoring of cyber-risk. The intended users of the method are professionals and practitioners interested in developing new algorithms for a specific organization, system or attack type, such as consultants or dedicated cyber-risk experts in larger organizations. For the assessment results, the intended users are decision makers in charge of countermeasure selection from an overall business perspective.

• Erdogan, Gencer & Refsdal, Atle (2018). A Method for Developing Qualitative Security Risk Assessment Algorithms. Lecture Notes in Computer Science (LNCS). ISSN 0302-9743. LNCS 10694, p. 244–259. doi: 10.1007/978-3-319-76687-4_17. Full text in Research Archive Show summary

  We present a method for developing qualitative security risk assessment algorithms where the input captures the dynamic state of the target of analysis. This facilitates continuous monitoring. The intended users of the method are security and risk practitioners interested in developing assessment algorithms for their own or their client’s organization. Managers and decision makers will typically be end users of the assessments provided by the algorithms. To promote stakeholder involvement, the method is designed to ensure that the algorithm and the underlying risk model are simple to understand. We have employed the method to create assessment algorithms for 10 common cyber attacks, and use one of these to demonstrate the approach.

• Erdogan, Gencer; Refsdal, Atle; Nygård, Bjørn; Randeberg, Bernt Kvam & Rosland, Ole Petter (2017). Experiences from Developing an Algorithm to Support Risk-Based Decisions for Offshore Installations. In Stirn, L. Zadnik; Borstnar, M. Klajic; Zerovnik, J. & Drobne, S. (Ed.), Proceedings of the 14th International Symposium on Operational Research. Slovenian Society Informatika - Section for Operational Research. ISSN 9789616165501. p. 167–173. doi: 10.2478/bsrj-2018-0019. Full text in Research Archive Show summary

  We present our experiences from developing a decision model to support risk-based decisions on offshore installations. The model was developed using the DEXi tool for multi- criteria decision modeling. We report on the method we employed, the efforts spent, and the evaluation of the resulting model, including feedback from domain experts representing the target group. In our view the results are promising, and we believe that the approach can be fruitful in a wider range of risk-based decision support scenarios.

• Erdogan, Gencer; Omerovic, Aida; Natvig, Marit Kjøsnes & Tardy, Isabelle (2017). Towards Transparent Real-Time Privacy Risk Assessment of Intelligent Transport Systems. Lecture Notes in Computer Science (LNCS). ISSN 0302-9743. 10224 LNCS, p. 11–18. doi: 10.1007/978-3-319-57858-3_2. Full text in Research Archive Show summary

  There are many privacy concerns within Intelligent Transport Systems (ITS). On the one hand, end-users are concerned about their privacy risk exposure, while on the other hand, ITS providers need to claim privacy awareness and document compliance with regulations or otherwise face devastating fines. One approach to address these concerns is to use methods specifically developed to assess privacy risks of ITS. The literature lacks such methods, and the complex and dynamic nature of ITS introduces challenges that need to be properly addressed when assessing privacy risks. The main challenges are related to real-time assessment of privacy risks to (1) inform end-users about exposed privacy risks, and (2) help providers asses privacy-compliance risks. We propose a method to privacy risk assessment addressing these challenges. The method is exemplified on an ITS-example. The initial results indicate feasibility of the method and propose directions for future work.

• Erdogan, Gencer; Refsdal, Atle; Seehusen, Fredrik & Gonzalez, Alejandra (2017). A Method for Developing Algorithms for Assessing Cyber-Risk Cost. In Nunez, Manuel; Dohi, Tadashi & Bai, Xiaoying (Ed.), 17th IEEE International Conference on Software Quality, Reliability and Security (QRS 2017), Prague, 25-29 July, 2017. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781538605929. p. 192–199. doi: 10.1109/QRS.2017.29. Full text in Research Archive Show summary

  We present a method for developing executable algorithms for quantitative cyber-risk assessment. Exploiting techniques from security risk modeling and actuarial approaches, the method pragmatically combines use of available empirical data and expert judgments. The input to the algorithms are indicators providing information about the target of analysis, such as suspicious events observed in the network. Automated execution of the algorithms facilitates continuous assessment.

• Erdogan, Gencer & Stølen, Ketil (2017). Design decisions in the development of a graphical language for risk-driven security testing. Lecture Notes in Computer Science (LNCS). ISSN 0302-9743. 10224, p. 99–114. doi: 10.1007/978-3-319-57858-3_8. Full text in Research Archive Show summary

  We have developed a domain-specific modeling language named CORAL that employs risk assessment to help security testers select and design test cases based on the available risk picture. In this paper, we present CORAL and then discuss why the language is designed the way it is, and what we could have done differently.

• Erdogan, Gencer; Stølen, Ketil & Aagedal, Jan Øyvind (2016). Evaluation of the CORAL Approach for Risk-driven Security Testing based on an Industrial Case Study. In Camp, Olivier; Furnell, Steven & Mori, Paolo (Ed.), Proceedings of the 2nd International Conference on Information Systems Security and Privacy, ICISSP 2016, February 19-21, 2016, in Rome, Italy. SciTePress. ISSN 9789897581670. p. 219–226. doi: 10.5220/0005650902190226. Full text in Research Archive Show summary

  The CORAL approach is a model-based method to security testing employing risk assessment to help security testers select and design test cases based on the available risk picture. In this paper we present experiences from using CORAL in an industrial case. The results indicate that CORAL supports security testers in producing risk models that are valid and threat scenarios that are directly testable. This, in turn, helps testers to select and design test cases according to the most severe security risks posed on the system under test.

• Erdogan, Gencer; Seehusen, Fredrik; Stølen, Ketil; Hofstad, Jon & Aagedal, Jan Øyvind (2015). Assessing the usefulness of testing for validating and correcting security risk models based on two industrial case studies. International Journal of Secure Software Engineering (IJSSE). ISSN 1947-3036. 6(2), p. 90–112. doi: 10.4018/IJSSE.2015040105. Full text in Research Archive Show summary

  The authors present the results of an evaluation in which the objective was to assess how useful testing is for validating and correcting security risk models. The evaluation is based on two industrial case studies. In the first case study the authors analyzed a multilingual financial Web application, while in the second case study they analyzed a mobile financial application. In both case studies, the testing yielded new information which was not found in the risk assessment phase. In particular, in the first case study, new vulnerabilities were found which resulted in an update of the likelihood values of threat scenarios and risks in the risk model. New vulnerabilities were also identified and added to the risk model in the second case study. These updates led to more accurate risk models, which indicate that the testing was indeed useful for validating and correcting the risk models.

• Erdogan, Gencer; Seehusen, Fredrik; Stølen, Ketil; Hofstad, Jon & Aagedal, Jan Øyvind (2015). Assessing the Usefulness of Testing for Validating and Correcting Security Risk Models Based on Two Industrial Case Studies. In Khosrow-Pour, Mehdi (Eds.), Business Intelligence: Concepts, Methodologies, Tools, and Applications. IGI Global. ISSN 9781466695627. doi: 10.4018/978-1-4666-9562-7.ch053. Full text in Research Archive Show summary

  The authors present the results of an evaluation in which the objective was to assess how useful testing is for validating and correcting security risk models. The evaluation is based on two industrial case studies. In the first case study the authors analyzed a multilingual financial Web application, while in the second case study they analyzed a mobile financial application. In both case studies, the testing yielded new information which was not found in the risk assessment phase. In particular, in the first case study, new vulnerabilities were found which resulted in an update of the likelihood values of threat scenarios and risks in the risk model. New vulnerabilities were also identified and added to the risk model in the second case study. These updates led to more accurate risk models, which indicate that the testing was indeed useful for validating and correcting the risk models.

• Erdogan, Gencer; Li, Yan; Runde, Ragnhild Kobro; Seehusen, Fredrik & Stølen, Ketil (2014). Approaches for the combined use of risk analysis and testing: A systematic literature review. International Journal on Software Tools for Technology Transfer (STTT). ISSN 1433-2779. 16(5), p. 627–642. doi: 10.1007/s10009-014-0330-5. Full text in Research Archive Show summary

  Risk analysis and testing are conducted for different purposes. Risk analysis and testing nevertheless involve processes that may be combined to the benefit of both. We may use testing to support risk analysis and risk analysis to support testing. This paper surveys literature on the combined use of risk analysis and testing. First, the existing approaches are identified through a systematic literature review. The identified approaches are then classified and discussed with respect to main goal, context of use and maturity level. The survey highlights the need for more structure and rigor in the definition and presentation of approaches. Evaluations are missing in most cases. The paper may serve as a basis for examining approaches for the combined use of risk analysis and testing, or as a resource for identifying the adequate approach to use.

• Erdogan, Gencer; Refsdal, Atle & Stølen, Ketil (2014). Schematic Generation of English-prose Semantics for a Risk Analysis Language Based on UML Interactions. In O'Conner, Lisa (Eds.), Proceedings IEEE 25th International Symposium on Software Reliability Engineering Workshops ISSREW 2014, 3-6 November, 2014, Naples, Italy. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781479973774. p. 305–310. doi: 10.1109/ISSREW.2014.73. Full text in Research Archive Show summary

  To support risk-driven testing, we have developed CORAL, a language for risk analysis based on UML interactions. In this paper, we present its semantics as a translation of CORAL diagrams into English prose. The CORAL semantics is developed to help software testers to clearly and consistently document, communicate and analyze risks in a risk-driven testing process. We first provide an abstract syntax and a translation algorithm. Then, we evaluate the approach based on some examples. We argue that the resulting English prose is comprehensible by testers, is consistent with the semantics of UML interactions, and has a complexity that is linear to the complexity of CORAL diagrams in terms of size.

• Erdogan, Gencer; Refsdal, Atle & Stølen, Ketil (2014). A Systematic Method for Risk-Driven Test Case Design Using Annotated Sequence Diagrams. In Bauer, Thomas; Grossman, Jürgen; Seehusen, Fredrik; Stølen, Ketil & Wendland, Marc-Florian (Ed.), Risk Assessment and Risk-Driven Testing. First International Workshop, RISK 2013. Held in Conjunction with ICTSS 2013, Istanbul, Turkey, November 12, 2013. Revised Selected Papers. Springer. ISSN 9783319070759. p. 93–108. doi: 10.1007/978-3-319-07076-6_7. Full text in Research Archive Show summary

  Risk-driven testing is a testing approach that aims at focusing the testing process on the aspects or features of the system under test that are most exposed to risk. Current risk-driven testing approaches succeed in identifying the aspects or features that are most exposed to risks, and thereby support testers in planning the testing process accordingly. However, they fail in supporting testers to employ risk analysis to systematically design test cases. Because of this, there exists a gap between risks, which are often described and understood at a high level of abstraction, and test cases, which are often defined at a low level of abstraction. In this paper, we bridge this gap. We give an example-driven presentation of a novel method, intended to assist testers, for systematically designing test cases by making use of risk analysis.

• Erdogan, Gencer & Stølen, Ketil (2012). Risk-driven Security Testing versus Test-driven Security Risk Analysis. CEUR Workshop Proceedings. 834, p. 5–10. Full text in Research Archive Show summary

  It is important to clearly distinguish the combinations of security testing and security risk analysis depending on whether it is viewed from a security testing perspective or a security risk analysis perspective. The main focus in the former view is security testing in which test objectives are to be achieved, while the main focus in the latter view is security risk analysis with the aim to fulfill risk acceptance criteria. The literature’s lack of addressing this distinction is accompanied with the lack of addressing two immediate problems within this context, namely the gap between high-level security risk analysis models and low-level security test cases, and the consideration of investable effort. We present initial ideas for methods that address these problems followed by an industrial case study evaluation in which we have gathered interesting results.

View all works in NVA

• Erdogan, Gencer (2025). Tillit til kunstig intelligens. Full text in Research Archive
• Erdogan, Gencer (2025). Cybersecurity Risk Assessment of Connected Medical Devices. Full text in Research Archive
• Erdogan, Gencer (2025). Cybersecurity of Connected Medical Devices. Full text in Research Archive
• Erdogan, Gencer (2025). Lessons Learned from a Cybersecurity Risk Assessment of OpenADR in Smart Grid Planning. Full text in Research Archive
• Erdogan, Gencer (2024). New Medical Cybersecurity and Design Solutions (NEMECYS). Full text in Research Archive
• Erdogan, Gencer (2024). Dynamic Cyber Risk Assessment for Connected Medical Devices: the NEMECYS Approach. Full text in Research Archive
• Erdogan, Gencer (2024). A Light-Weight Tool-Supported Method for Cyber-Risk Assessment in the Planning of Cyber-Physical Smart Grids. Full text in Research Archive
• Erdogan, Gencer (2024). Using LLMs in the context of security risk assessment. Full text in Research Archive
• Erdogan, Gencer (2024). Human and Organizational Risk Modelling in Cybersecurity. Full text in Research Archive
• Erdogan, Gencer (2024). Kunstig intelligens for cybersikkerhet & cybersikkerhet for kunstig intelligens. Full text in Research Archive
• Erdogan, Gencer (2024). Security Risk Assessment of Connected Medical Devices. Full text in Research Archive
• Erdogan, Gencer (2024). Guided Understanding and Assessment of Cybersecurity Risks with an LLM-enabled Navigator. Full text in Research Archive
• Tokas, Shukun; Erdogan, Gencer & Stølen, Ketil (2023). Privacy-Aware IoT: State-of-the-Art and Challenges. Full text in Research Archive Show summary

  The consumer IoT is now prevalent and creates an enormous amount of fine-grained, detailed information about consumers’ everyday actions, personalities, and preferences. Such detailed information brings new and unique privacy challenges. The consumers are not aware of devices that surround them. There is a lack of transparency and absence of support for consumers to control the collection and processing of their personal and sensitive data. This paper reports on a review of state-of-the-art on privacy protection in IoT, with respect to privacy enhancing technologies (PETs) and GDPR-specific privacy principles. Drawing on a thorough analysis of 36 full papers, we identify key privacy challenges in IoT that need to be addressed to provide consumers with transparency and control over their personal data. The privacy challenges we have identified are (1) the lack of technical expertise in privacy notice comprehension, (2) the lack of transparency and control of personal data, and (3) the lack of personalized privacy recommendations.

• Erdogan, Gencer (2023). "Hvilke behov har energisektoren for å vurdere cyber-risiko?". Full text in Research Archive
• Erdogan, Gencer (2023). Cybersecurity Awareness and Capacities of SMEs. Full text in Research Archive
• Erdogan, Gencer (2023). Cyber security consequences for security of electricity supply and cyber security considerations in grid planning. Full text in Research Archive
• Erdogan, Gencer (2023). Needs and Challenges Concerning Cyber-risk Assessment in the Cyber-physical Smart Grid. Full text in Research Archive
• Phillips, Stephen C.; Fair, Nicholas; Erdogan, Gencer & Tverdal, Simeon (2022). Information Security and Risk Management: Trustworthiness and Human Interaction. Full text in Research Archive
• Erdogan, Gencer (2022). Centre for Intelligent Electricity Distribution (CINELDI). Full text in Research Archive
• Erdogan, Gencer (2022). Needs and Challenges Concerning Cyber-Risk Assessment in the Cyber-Physical Smart Grid. Full text in Research Archive
• Erdogan, Gencer & Tøndel, Inger Anne (2022). Flere må mobiliseres i kampen mot hackerne. Full text in Research Archive
• Tokas, Shukun & Erdogan, Gencer (2022). A Need for Privacy Assistive Technology in Notice and Consent Paradigm. Full text in Research Archive Show summary

  A privacy notice is a document/notification that is addressed to consumers, describing how their personal information will be handled. While browsing the Internet, installing an app on smartphone, setting up a smart sensor or IoT devices in personal spaces, consumers are often asked to consent to privacy notices. Ideally, the consumer is expected to read and understand the notice and give an informed consent. These notices are often lengthy and complicated, containing legal-technical jargons and ambiguous statements describing commercial use of personal data. Most people reflexively choose “I consent”, unknowingly agreeing to unfair-deceptive practices. Given the ubiquity of IoT and thus ubiquity of (personal) data collection, the reliance on notice and consent is inappropriate. In this article, we present the challenges of the notice and consent paradigm, and explore the idea of privacy-assistive solutions to enhance consumer privacy awareness and control in IoT.

• Erdogan, Gencer (2022). Vurdering av cyberrisiko for planlegging av smarte distribusjonsnett. Full text in Research Archive
• Midtun, Birthe; Meland, Per Håkon; Bartnes, Maria; JAATUN, Martin Gilje; Borgaonkar, Ravishankar Bhaskarrao & Erdogan, Gencer [Show all 7 contributors for this article] (2021). Dette må du må vite om cybersikkerhet. [Internet]. Gemini. Full text in Research Archive Show summary

  Risikoen for cyberangrep mot norske virksomheter har økt i løpet av koronapandemien. Her er 12 ting du må vite om cybersikkerhet og hacking.

• Erdogan, Gencer (2021). A Systematic Mapping Study on Approaches for AI-Supported Security Risk Assessment. Full text in Research Archive Show summary

  Effective assessment of cyber risks in the increasingly dynamic threat landscape must be supported by artificial intelligence techniques due to their ability to dynamically scale and adapt. This article provides the state of the art of AI-supported security risk assessment approaches in terms of a systematic mapping study. The overall goal is to obtain an overview of security risk assessment approaches that use AI techniques to identify, estimate, and/or evaluate cyber risks. We carried out the systematic mapping study following standard processes and identified in total 33 relevant primary studies that we included in our mapping study. The results of our study show that on average, the number of papers about AI-supported security risk assessment has been increasing since 2010 with the growth rate of 133% between 2010 and 2020. The risk assessment approaches reported have mainly been used to assess cyber risks related to intrusion detection, malware detection, and industrial systems. The approaches focus mostly on identifying and/or estimating security risks, and primarily make use of Bayesian networks and neural networks as supporting AI methods/techniques.

• Erdogan, Gencer (2021). Developing Cyber-risk Centric Courses and Training Material for Cyber Ranges: A Systematic Approach. Full text in Research Archive
• Erdogan, Gencer (2020). CYBERWISER.eu - Cyber Range & Capacity Building in Cybersecurity. Full text in Research Archive
• Erdogan, Gencer (2020). An Approach to Train and Evaluate the Cybersecurity Skills of Participants in Cyber Ranges Based on Cyber-Risk Models. Full text in Research Archive
• Jøsang, Audun; Buer, Veronica Jarnskjold; Omerovic, Aida & Erdogan, Gencer (2020). Tingenes Internett: En kjempeutfordring for sikkerhet og personvern. Full text in Research Archive
• Omerovic, Aida; Vefsnmo, Hanne; Erdogan, Gencer; Gjerde, Oddbjørn; Gramme, Eivind & Simonsen, Stig (2019). A Feasibility Study of a Method for Identification and Modelling of Cybersecurity Risks in the Context of Smart Power Grids. Full text in Research Archive
• Erdogan, Gencer (2019). The learning path in CYBERWISER.eu. Full text in Research Archive
• Erdogan, Gencer (2017). CORAL: A Model-Based Approach to Risk-Driven Security Testing. Full text in Research Archive
• Erdogan, Gencer (2017). A Method for Developing Qualitative Security Risk Assessment Algorithms. Full text in Research Archive
• Erdogan, Gencer (2016). Poster presentation of the WISER project. Full text in Research Archive
• Erdogan, Gencer (2016). Design Decisions in the Development of a Graphical Language for Risk-Driven Security Testing. Full text in Research Archive
• Erdogan, Gencer (2016). Towards Transparent Real-Time Privacy Risk Assessment of Intelligent Transport Systems. Full text in Research Archive
• Erdogan, Gencer (2016). Evaluation of the CORAL Approach for Risk-driven Security Testing based on an Industrial Case Study. Full text in Research Archive
• Erdogan, Gencer (2016). Analysemetoder. Full text in Research Archive
• Erdogan, Gencer (2014). Schematic Generation of English-prose Semantics for a Risk Analysis Language Based on UML Interactions. Full text in Research Archive
• Erdogan, Gencer (2014). Risikobasert testdesign. Full text in Research Archive
• Erdogan, Gencer (2013). A Systematic Method for Risk-driven Test Case Design Using Annotated Sequence Diagrams. Full text in Research Archive
• Erdogan, Gencer (2012). Assessing the usefulness of testing for validating the correctness of security risk models based on an industrial case study. Full text in Research Archive
• Erdogan, Gencer; Omerovic, Aida; Natvig, Marit Kjøsnes & Tardy, Isabelle (2016). Needs and challenges concerning privacy risk managementwithin Intelligent Transport Systems. SINTEF Digital. ISSN 9788214059182. Full text in Research Archive Show summary

  There are many privacy concerns within Intelligent Transport Systems (ITS). On the one hand, end-users are concerned about their privacy-risk exposure when using ITS, while on the other hand, ITS providers need to claim privacy awareness and document compliance with regulations or face devastating fines. One approach to address these concerns is to use methods specifically developed to assess privacy risks of ITS. The literature lacks such methods, and the complex and dynamic nature of ITS introduces challenges that need to be properly addressed when assessing privacy risks. In this report, we carry out an empirical study in order to identify needs and challenges concerning privacy risk assessment of ITS. Broadly speaking, the main challenges are related to real-time assessment of privacy risks to (1) inform end-users about exposed privacy risks, and (2) help ITS providers asses privacy-compliance risks, as well as to identify privacy risks at an implementation level. Oppdragsgiver: SINTEF ICT

• Erdogan, Gencer; Stølen, Ketil & Aagedal, Jan Øyvind (2015). Evaluation of the CORAL Approach for Risk-Driven Security Testing Based on an Industrial Case Study. SINTEF AS. ISSN 9788214059076. Full text in Research Archive Show summary

  The CORAL approach is a model‐based method to security testing employing risk assessment to help security testers select and design test cases based on the available risk picture. In this report we present experiences from using CORAL in an industrial case. The results indicate that CORAL supports security testers in producing risk models that are valid and threat scenarios that are directly testable. This, in turn, helps testers to select and design test cases according to the most severe security risks posed on the system under test. Oppdragsgiver: Norwegian Research Council

• Erdogan, Gencer; Refsdal, Atle & Stølen, Ketil (2014). Schematic Generation of English-prose Semantics for a Risk Analysis Language Based on UML Interactions. SINTEF Digital. ISSN 9788214053678. Full text in Research Archive Show summary

  To support risk-driven testing, we have developed CORAL, a language for risk analysis based on UML interactions. In this paper, we present its semantics as a translation of CORAL diagrams into English prose. The CORAL semantics is developed to help software testers to clearly and consistently document, communicate and analyze risks in a risk-driven testing process. We first provide an abstract syntax and a translation algorithm. Then, we evaluate the approach based on some examples. We argue that the resulting English prose is comprehensible by testers, is consistent with the semantics of UML interactions, and has a complexity that is linear to the complexity of CORAL diagrams in terms of size. Oppdragsgiver: Norwegian Research Council

• Erdogan, Gencer; Refsdal, Atle & Stølen, Ketil (2014). A Systematic Method for Risk-driven Test Case Design Using Annotated Sequence Diagrams. SINTEF Digital. ISSN 9788214053494. Full text in Research Archive Show summary

  Risk-driven testing is a testing approach that aims at focusing the testing on the aspects or features of the system under test that are most exposed to risk. Current risk-driven testing approaches succeed in identifying the aspects or features that are most exposed to risks, and thereby support testers in planning the testing process accordingly. However, they fail in supporting testers to employ risk analysis to systematically design test cases. Because of this, there exists a gap between risks, which are often described and understood at a high level of abstraction, and test cases, which are often defined at a low level of abstraction. In this report, we bridge this gap. We give an example-driven presentation of a novel method, intended to assist testers, for systematically designing test cases by making use of risk analysis. Oppdragsgiver: Norwegian Research Council

• Erdogan, Gencer; Seehusen, Fredrik; Stølen, Ketil & Aagedal, Jan Øyvind (2014). Assessing the Usefulness of Testing for Validating the Correctness of Security Risk Models Based on an Industrial Case Study. SINTEF Digital. ISSN 9788214053555. Full text in Research Archive Show summary

  We present the results of an evaluation in which the objective was to assess how useful testing is for validating and gaining confidence in the correctness of security risk models. The evaluation is based on a case study where the target system analyzed was a web-based application. The evaluation suggests that the testing was useful in the sense that it yielded new information which resulted in an update of the security risk model after testing. Oppdragsgiver: Norwegian Research Council

• Erdogan, Gencer; Seehusen, Fredrik & Li, Yan (2013). An Evaluation of a Test-driven Security Risk Analysis Method Based on an Industrial Case Study. SINTEF Digital. ISSN 9788214053371. Full text in Research Archive Show summary

  This report is an evaluation describing the experiences obtained from a case study, carried out in a period of eight months from June 2012 to January 2013, in which we conducted a test-driven security risk analysis. Test-driven security risk analysis is a method for carrying out security risk analysis in which security testing is used to support the security risk analysis. The method consists of three main phases. In Phase 1, a security risk analysis is carried out. In Phase 2, security testing is carried out with respect to the security risk analysis. In the 3rd and final phase, the results obtained from the security risk analysis are validated and updated with respect to the test results. Our objective with the case study was to assess how useful testing is for gaining confidence in the correctness of the risk models produced in the risk analysis. To make the evaluation precise, we analysed the difference between the risk model produced before testing and the updated risk model after testing. The results obtained from the case study shows that testing contributes in gaining higher confidence of the correctness of the risk models. Oppdragsgiver: Norwegian Research Council

• Erdogan, Gencer; Li, Yan; Runde, Ragnhild Kobro; Seehusen, Fredrik & Stølen, Ketil (2012). Conceptual Framework for the DIAMONDS Project. SINTEF Digital. ISSN 9788214052886. Full text in Research Archive Show summary

  DIAMONDS is a research project addressing the combination of security testing and risk analysis. The main objective is to develop guidelines and a supporting framework to help businesses find a balanced approach within the three-dimensional space of invested effort, security testing, and risk analysis. This report documents the conceptual framework for DIAMONDS by clarifying the notions of security testing, risk analysis, and related notions, as well as defining the relations among them. Oppdragsgiver: The DIAMONDS project supported by the Research Council of Norway

View all works in NVA