65 citations · 489 across the 70 of their papers we have counts for
21 papers · 1 filter
A Bird's-Eye View on Security Considerations in RFCs
Jukka Ruohonen, Qusai Ramadan
Request for comments (RFCs) are Internet standards, memorandums, and related technical documents about core Internet protocols made via and released by the Internet Engineering Tas…
An Alignment Between the CRA's Essential Requirements and the ATT&CK's Mitigations
Jukka Ruohonen, Eun-Young Kang, Qusai Ramadan
The paper presents an alignment evaluation between the mitigations present in the MITRE's ATT&CK framework and the essential cyber security requirements of the recently introduced…
A Time Series Analysis of Malware Uploads to Programming Language Ecosystems
Jukka Ruohonen, Mubashrah Saddiqa
Software ecosystems built around programming languages have greatly facilitated software development. At the same time, their security has increasingly been acknowledged as a probl…
From Cyber Security Incident Management to Cyber Security Crisis Management in the European Union
Jukka Ruohonen, Kalle Rindell, Simone Busetti
Incident management is a classical topic in cyber security. Recently, the European Union (EU) has started to consider also the relation between cyber security incidents and cyber s…
SoK: The Design Paradigm of Safe and Secure Defaults
Jukka Ruohonen
In security engineering, including software security engineering, there is a well-known design paradigm telling to prefer safe and secure defaults. The paper presents a systematiza…
A Systematic Literature Review on the NIS2 Directive
Jukka Ruohonen
The second network and information security (NIS2) directive was enacted in the European Union (EU) in late 2022. It deals particularly with European critical infrastructures, enla…
Vulnerability Coordination Under the Cyber Resilience Act
Jukka Ruohonen, Paul Timmers
The Cyber Resilience Act (CRA) of the European Union (EU) imposes many new cyber security requirements practically to all network-enabled information technology products, whether h…
An Overview of Cyber Security Funding for Open Source Software
Jukka Ruohonen, Gaurav Choudhary, Adam Alami
Many open source software (OSS) projects need more human resources for maintenance, improvements, and sometimes even their survival. These needs allegedly apply even to vital OSS p…
An Empirical Study of Vulnerability Handling Times in CPython
Jukka Ruohonen
The paper examines the handling times of software vulnerabilities in CPython, the reference implementation and interpreter for the today's likely most popular programming language,…
What Do We Know About the Psychology of Insider Threats?
Jukka Ruohonen, Mubashrah Saddiqa
Insider threats refer to threats originating from people inside organizations. Although such threats are a classical research topic, the systematization of existing knowledge is st…
Crisis Communication in the Face of Data Breaches
Jukka Ruohonen, Kalle Hjerppe, Katleena Kortesuo
Data breaches refer to unauthorized accesses to data. Typically but not always, data breaches are about cyber crime. An organization facing such a crime is often also in a crisis s…
The Incoherency Risk in the EU's New Cyber Security Policies
Jukka Ruohonen
The European Union (EU) has been pursuing new cyber security policies in recent years. This paper presents a short reflection of four such policies. The focus is on potential incoh…
An Exploratory Case Study on Data Breach Journalism
Jukka Ruohonen, Kalle Hjerppe, Maximilian von Zastrow
This paper explores the novel topic of data breach journalism and data breach news through the case of databreaches.net, a news outlet dedicated to data breaches and related cyber…
Crossing Cross-Domain Paths in the Current Web
Jukka Ruohonen, Joonas Salovaara, Ville Leppänen
The loading of resources from third-parties has evoked new security and privacy concerns about the current world wide web. Building on the concepts of forced and implicit trust, th…
On the Integrity of Cross-Origin JavaScripts
Jukka Ruohonen, Joonas Salovaara, Ville Leppänen
The same-origin policy is a fundamental part of the Web. Despite the restrictions imposed by the policy, embedding of third-party JavaScript code is allowed and commonly used. Noth…
A Bug Bounty Perspective on the Disclosure of Web Vulnerabilities
Jukka Ruohonen, Luca Allodi
Bug bounties have become increasingly popular in recent years. This paper discusses bug bounties by framing these theoretically against so-called platform economy. Empirically the…
Investigating the Agility Bias in DNS Graph Mining
Jukka Ruohonen, Ville Leppänen
The concept of agile domain name system (DNS) refers to dynamic and rapidly changing mappings between domain names and their Internet protocol (IP) addresses. This empirical paper…
An Empirical Survey on the Early Adoption of DNS Certification Authority Authorization
Jukka Ruohonen
A new certification authority authorization (CAA) resource record for the domain name system (DNS) was standardized in 2013. Motivated by the later 2017 decision to enforce mandato…
Whose Hands Are in the Finnish Cookie Jar?
Jukka Ruohonen, Ville Leppänen
Web cookies are ubiquitously used to track and profile the behavior of users. Although there is a solid empirical foundation for understanding the use of cookies in the global worl…
A Look at the Time Delays in CVSS Vulnerability Scoring
Jukka Ruohonen
This empirical paper examines the time delays that occur between the publication of Common Vulnerabilities and Exposures (CVEs) in the National Vulnerability Database (NVD) and the…
Classifying Web Exploits with Topic Modeling
Jukka Ruohonen
This short empirical paper investigates how well topic modeling and database meta-data characteristics can classify web and other proof-of-concept (PoC) exploits for publicly discl…