Mass Soldal Lund

• Sætren, Gunhild Birgitte; Lund-Kordahl, Inger; Vaag, Jonas Rennemo; Lund, Mass Soldal & Badu, James (2025). Safety in the High-Arctic. I Abrahamsen, Eirik Bjorheim; Aven, Terje; Bouder, Frederic Emmanuel; Flage, Roger & Ylönen, Marja Katariina (Red.), Stavanger ESREL SRA-E 2025 Proceedings: 35th European Safety and Reliability Conference and the 33rd Society for Risk Analysis Europe Conference, 15 - 19 June 2025, Norway. Research Publishing Services. ISSN 9789819432813. s. 1965–1972. doi: 10.3850/978-981-94-3281-3_ESREL-SRA-E2025-P2680-cd. Fulltekst i vitenarkiv Vis sammendrag

  Longyearbyen, the northernmost city in the world located in Svalbard, experiences the highest global impact of climate change. The city’s population is diverse, comprising approximately 40% non-Norwegian and 60% Norwegian inhabitants. Despite extreme weather conditions and significant seasonal variations, residents maintain their daily lives in this remote area. This study explored the sense of safety among Longyearbyen’s population through qualitative interviews and grounded theory analysis. We identified a core category: sense of vulnerability, and two main categories: social safety and physical safety. Social safety was influenced by strong community bonds yet threatened by new regulations that create divisions between Norwegian and non-Norwegian residents, fostering an in-group and out-group dynamic. Physical safety concerned arise from increasing natural hazards and the vulnerability of the city’s infrastructure. Overall, while residents generally feel safe and enjoy living in Longyearbyen, there is a growing awareness of both social and physical safety hazards.

• Lund, Mass Soldal (2024). Hybrid Threats in Cyberspace. What do Russia’s cyberspace operations in Ukraine tell us? I Borch, Odd Jarl & Heier, Tormod (Red.), Preparing for Hybrid Threats to Security: Collaborative Preparedness and Response. Routledge. ISSN 9781032617916. s. 69–83. doi: 10.4324/9781032617916-7. Fulltekst i vitenarkiv
• Haugli-Sandvik, Marie; Lund, Mass Soldal & Bjørneseth, Frøy Birte (2024). Maritime decision-makers and cyber security: deck officers’ perception of cyber risks towards IT and OT systems. International Journal of Information Security. ISSN 1615-5262. doi: 10.1007/s10207-023-00810-y. Fulltekst i vitenarkiv Vis sammendrag

  Through a quantitative study of deck officers’ cyber risk perceptions towards information (IT) and operational (OT) systems, this paper contributes to substantiate the importance of considering human behaviour within maritime cyber security. Using survey data from 293 deck officers working on offshore vessels, statistical analyses were conducted to measure and predict the participants cyber risk perceptions towards IT and OT systems. Performing a Wilcoxon signed-rank test revealed a significant discrepancy in the levels of cyber risk perception between the system categories. Hierarchical regression analyses were conducted to develop statistical models, considering multiple independent variables, including perceived benefit, cyber security training, experience with cyber-attacks, and trust towards various stakeholders. Key findings revealed distinct results for IT and OT systems, and the regression models varied in both predictive power and significance of the independent variables. Perceived benefit positively predicts deck officers cyber risk perception for both IT and OT systems, while trust, which included measures of social trust and confidence, was not found to be significant. Cyber security training and experience with cyber-attacks only influence deck officers’ perception of cyber risks related to operational technology. Practical implications of this work provide actionable recommendations for the maritime industry, including tailored risk communication tools, training programs, reporting systems, and holistic policies.

• Sætren, Gunhild Birgitte; Vaag, Jonas Rennemo & Lund, Mass Soldal (2024). What and how to train for strategic crisis management: A systematic literature review. Journal of Contingencies and Crisis Management. ISSN 0966-0879. 32(2). doi: 10.1111/1468-5973.12568. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2024). Kva kan Forsvaret gjere i ei nasjonal cyberkrise? I Larssen, Ann-Karin & Heier, Tormod (Red.), Militærmaktens rolle i norsk krisehåndtering. Cappelen Damm Akademisk. ISSN 9788202833312. s. 380–402. Fulltekst i vitenarkiv Vis sammendrag

  Militærmaktens rolle i norsk krisehåndtering har til hensikt å bidra med økt kunnskap om Forsvarets rolle i norsk krisehåndtering. Hovedfokuset er intenderte kriser, under terskelen for væpnet konflikt/krig. Dette er kriser forårsaket av en aktør, gjerne ukjent, med vilje og evne til å skade norsk sikkerhet. Under terskelen for væpnet konflikt vil Forsvaret først og fremst ha en bistandsrolle i krisehåndteringen, men boken vil også bidra til å belyse Forsvarets selvstendige plikt og rett til å handle under denne terskelen. Boken er organisert i fire deler. I første del tar for seg endringer i det globale og regionale trusselbildet og mulige konsekvenser for norsk-amerikansk krisehåndtering i nord og for Arktis generelt. Den andre delen ser nærmere på krisehåndteringssystemet på strategisk nivå og på noen av Forsvarets mest sentrale bistandsressurser. Bokens tredje del tar for seg noen av de juridiske rammene for bruken av Forsvaret i krisehåndtering og hvordan bistandsanmodninger håndtere av Forsvaret. Denne delen av boken vil også problematisere om det nødvendigvis er lurt å bruke Forsvaret selv om det er lov. Den fjerde delen av boken problematisere ‘sammensatte trusler’ og hvordan Forsvaret kan forholde seg til disse.

• Lund, Mass Soldal (2024). Russiske tenestenektåtak (DDoS) som politisk verkemiddel i Estland og Georgia. I Berrefjord, Vivi Ringnes & Lund, Mass Soldal (Red.), Cybermakt. En tverrfaglig innføring. Universitetsforlaget. ISSN 9788215057071. s. 61–79. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2024). Operasjon Dempa Melodi - bruk av cyberåtak i ein luftoperasjon? I Berrefjord, Vivi Ringnes & Lund, Mass Soldal (Red.), Cybermakt. En tverrfaglig innføring. Universitetsforlaget. ISSN 9788215057071. s. 47–60. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2023). Autonomi i cyberoperasjonar. I Cooper, Camilla Guldahl & Henriksen, Dag (Red.), Autonomi i militære operasjoner. Cappelen Damm Akademisk. ISSN 9788202791445. s. 139–160. Fulltekst i vitenarkiv
• Erstad, Erlend; Lund, Mass Soldal & Ostnes, Runar (2022). Navigating through Cyber Threats, A Maritime Navigator’s Experience. Applied Human Factors and Ergonomics International (AHFE International). 53, s. 84–91. doi: 10.54941/ahfe1002205. Fulltekst i vitenarkiv Vis sammendrag

  Cyber threats are emerging as a risk in the maritime industry. If the navigational systems on board a ship somehow fail to function because of a cyber incident, the navigator is an important asset who is expected to handle the problem and provide a solution to maintain the safety of the crew, the vessel, and the environment. The International Maritime Organization (IMO) urges the shipping industry to be resilient towards cyber threats. To facilitate for enhanced operational maritime cyber resilience, there is a need to understand how navigators interpret cyber threats, which can be essential to safely conduct nautical operations. This paper presents a qualitative study of navigators’ understanding of cyber threats based on interviews with ten navigators, and further provides recommendations for how use of this knowledge can contribute to enhanced maritime cyber resilience.

• Larsen, Marie Haugli; Lund, Mass Soldal & Bjørneseth, Frøy Birte (2022). A model of factors influencing deck officers’ cyber risk perception in offshore operations. Maritime Transport Research. 3. doi: 10.1016/j.martra.2022.100065. Fulltekst i vitenarkiv Vis sammendrag

  Offshore operations onboard vessels are increasingly reliant on digitalization, integration, automation, and networked-based systems, which creates new dimensions of cyber risks. The causes of cyber incidents often include complex relationships between humans and technology, and in offshore operations, the onboard crew can be both a cyber security risk and a vital resource in strengthening the cyber security. This makes the behaviour of the decisionmakers onboard important in both preventing and handling cyber risks at sea. By use of in-depth interviews and the constant comparative analysis (CCA), this paper investigates factors influencing deck officers’ cyber risk perception in offshore operations and presents a contextual model of these factors. The model indicates that deck officers’ cyber risk perception can be affected by a feeling of distance towards cyber risks, being more restricted in their working environment because of digitalization, and trust in their reliable cyber-physical systems and suppliers. Further, targeted cyber risk mitigation measures should be implemented on multiple levels in shipping companies. The measures may benefit from focusing on increased risk communication, operational training, awareness campaigns, vessel-specific procedures, and policies, in addition to increased communication from management regarding the demand for digitalization. With this approach, the contextual model can contribute to the ongoing work of developing targeted measures for cyber risk mitigation in the maritime domain and can be used as a point of departure for further studies to discover additional nuances and factors within cyber risk perception in this domain.

• Lund, Mass Soldal (2022). Øving på cybersikkerheit: Ein casestudie av ei cybersikkerheitsøving. Scandinavian Journal of Military Studies. 5(1), s. 244–256. doi: 10.31374/sjms.119. Fulltekst i vitenarkiv Vis sammendrag

  Denne artikkelen presenterer ein casestudie av ei cybersikkerheitsøving i militær utdanning, og nyttar denne casestudien til å drøfte nokre utfordringar med cybersikkerheitsøvingar til utdanningsføremål. Casestudien gjer greie for sentrale avgjerder i designet av øvinga, evaluering av øvinga og utfordringar i øvingskonseptet. Gjennom ein litteraturgjennomgang samanliknar vi øvinga med liknande øvingar, og ser på korleis desse øvingane har blitt evaluert. Avslutningsvis nyttar vi casestudien og litteraturgjennomgangen til å gjere betraktningar om vidare undersøkingar av cybersikkerheitsøvingar.

• Wilhelmsen, Vivi Cathrine Ringnes; Larsen, Thea K.; Lund, Mass Soldal; Svenungsen, Bjørn & Aannø, Stig Tore (2021). Jakten på Norges militære cyberstrategi. I Heier, Tormod (Red.), Militærmakt i nord. Universitetsforlaget. ISSN 9788215057064. s. 242–260. Fulltekst i vitenarkiv
• Erstad, Erlend; Ostnes, Runar & Lund, Mass Soldal (2021). An Operational Approach to Maritime Cyber Resilience. TransNav, International Journal on Marine Navigation and Safety of Sea Transportation. ISSN 2083-6473. 15(1), s. 27–34. doi: 10.12716/1001.15.01.01. Fulltekst i vitenarkiv Vis sammendrag

  ABSTRACT: As a result of the last decades development of technology and increased connectivity of maritime vessels, the need for maritime cyber security is undoubtedly present. In 2017, IMO officially recognized “… the urgent need to raise awareness on cyber threats and vulnerabilities to support safe and secure shipping, which is operationally resilient to cyber risks”. Thus, Maritime Cyber Resilience is seen as key by IMO in the improvement of the maritime cyber security. It is assumed that human error is the cause of more than half successful cyber-attacks. If technology somehow fails, in example because of a cyber threat, the human is expected to handle the problem and provide a solution. It is therefore necessary to focus on the human aspect when considering maritime cyber threats. This paper aims to provide a working definition of “Maritime Cyber Resilience”. Further, the paper argues why the human should be a focus of study, as the human is at the sharp edge in a potential maritime cyber emergency.

• Lund, Mass Soldal (2021). Kommunikasjonssystemer for beredskap og krisehåndtering – teknologi og utfordringer. I Larssen, Ann Karin (Red.), Beredskap og krisehåndtering. Utfordringer på sentralt, regionalt og lokalt nivå. Cappelen Damm Akademisk. ISSN 9788202695088. s. 86–108. Fulltekst i vitenarkiv
• Larsen, Marie Haugli & Lund, Mass Soldal (2021). Cyber Risk Perception in the Maritime Domain: A Systematic Literature Review. IEEE Access. 9, s. 144895–144905. doi: 10.1109/ACCESS.2021.3122433. Fulltekst i vitenarkiv Vis sammendrag

  This paper aims to present an approach to investigate cyber risk perception with use of recognized psychological models, and to give an overview of state-of-the-art research within the field of cyber risk perception in general and in the context of the maritime domain. The focus will be on determinative dimensions within the psychometric paradigm and cognitive biases, and to give recommendations on further research within these fields. Okoli and Schabram’s eight-step guide to plan, select, extract, and execute a systematic literature review is used as guidance. The search process resulted in 25 relevant articles which describes 24 dimensions of cyber risk perception in different online environments. Research within the area of maritime cyber security is increasing, however, no studies relevant for our literature review were found within the maritime domain. The nine dimensions in the psychometric model, perceived benefit and the optimistic bias is presented and discussed in a maritime context. Cyber risk perception is a complex research-area where both determinative factors and other cognitive processes can be influenced by each other. This can indicate that the dimensions differ across populations and professions, creating grounds for why context-specific studies are important. Further research may benefit from more multidisciplinary, descriptive, and inductive approaches, and contextual studies within maritime cyber risk perception can contribute to develop targeted tools for risk mitigation to enhance safety at sea.

• Fongen, Anders; Helkala, Kirsi Marjaana & Lund, Mass Soldal (2020). Trust Through Origin and Integrity: Protection of Client Code for Improved Cloud Security. International Conference on Emerging Security Information, Systems and Technologies. s. 16–21. Fulltekst i vitenarkiv
• Fongen, Anders & Lund, Mass Soldal (2020). Integration of Network Services in Tactical Coalition SDN Networks. International Conference on Emerging Security Information, Systems and Technologies. s. 22–28. Fulltekst i vitenarkiv Vis sammendrag

  In order for Software Defined Network (SDN) technology to work in a military network, several identified problems need to be solved. This paper reports from experimental efforts to extend the application of SDN to a multi-domain, coalition, mobile network with wireless links and with end systems belonging to several Communities Of Interest (COI). The paper also demonstrates how SDN technology allows different network services to be integrated with a single class of Network Elements (NE). Considerations related to authentication, COI separation and intrusion prevention is given special attention during the discussions.

• Lund, Mass Soldal; Gulland, Jørgen Emil; Hareide, Odd Sveinung; Jøsok, Øyvind & Weum, Karl Olav Carlsson (2018). Integrity of Integrated Navigation Systems. I Jiwu, Jing; Loukas, Lazos & Liu, Peng (Red.), 2018 IEEE Conference on Communications and Network Security (CNS). IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781538645864. doi: 10.1109/CNS.2018.8433151. Fulltekst i vitenarkiv Vis sammendrag

  Computerized systems are revolutionizing modern ships' bridges and maritime operations. Central components in this are Integrated Navigation Systems (INS) and Electronic Chart Display and Information Systems (ECDIS) which provide the maritime navigator with the ship's position and displays it in electronic charts. The integrity of these systems if of great importance for the safety and security of maritime operations, but is a little studied topic. In this paper we investigate the integrity of navigation systems, though a survey of INS's on the market (n=22), a survey of known cyber incidents and attacks targeting the integrity of navigation systems, and a discussion of cryptographical measures to ensure the integrity of navigation data in INS's

• Hareide, Odd Sveinung; Jøsok, Øyvind; Lund, Mass Soldal; Ostnes, Runar & Helkala, Kirsi Marjaana (2018). Enhancing Navigator Competence by Demonstrating Maritime Cyber Security. Journal of navigation. ISSN 0373-4633. 71(5), s. 1025–1039. doi: 10.1017/S0373463318000164. Fulltekst i vitenarkiv Vis sammendrag

  As technology continues to develop, information and communication technology and operational technology on board ships are increasingly being networked, and more frequently connected to the Internet. The introduction of cyber systems changes the work environment with the aim of decreasing the workload for the navigator, but at the same time introduces more complexity and vulnerabilities that in turn may alter the competencies needed to perform safe and efficient navigation. Contemporary examples of how cyber-attacks can distort situational awareness and interfere with operations are needed to enhance the navigator's competence through increased system awareness. This paper demonstrates some of the possible attack vectors that a cyber-attack can present to a ship, as well as discussing the plausibility and consequences of such attacks. In this study we provide a practical example to better understand how one can demystify cyber threats in order to enhance the navigators' competence.

• Lund, Mass Soldal; Hareide, Odd Sveinung & Jøsok, Øyvind (2018). An Attack on an Integrated Navigation System. Necesse. ISSN 2464-353X. 3(2), s. 149–163. doi: 10.21339/2464-353x.3.2.149. Fulltekst i vitenarkiv
• Helkala, Kirsi Marjaana; Knox, Benjamin James; Jøsok, Øyvind; Knox, Silje & Lund, Mass Soldal (2016). Factors to affect improvement in cyber officer performance. Information and Computer Security. 24(2), s. 152–163. doi: 10.1108/ICS-01-2016-0001. Fulltekst i vitenarkiv
• Helkala, Kirsi Marjaana; Knox, Silje & Lund, Mass Soldal (2015). Effect of Motivation and Physical Fitness on Cyber Tasks. I Furnell, Steve M & Clarke, Nathan (Red.), Proceedings of the Ninth International Symposium on Human Aspects of Information Security & Assurance (HAISA 2015). Center for Security, Communications & Network Research, Plymouth University. ISSN 9781841023885. s. 108–119. Fulltekst i vitenarkiv
• Lund, Mass Soldal; Knox, Benjamin James & Røislien, Hanne Eggen (2014). What do Cyber Soldiers Need to Know? I Liles, Sam (Red.), Proceedings of the 9th International Conference on Cyber Warfare and Security ICCWS-2014. Purdue University, West Lafayette, Indiana, USA. 24-25 March 2014. Academic Conferences & Publishing International (ACPI). ISSN 9781909507050. s. 371–372. Fulltekst i vitenarkiv
• Røislien, Hanne Eggen; Lund, Mass Soldal & Knox, Benjamin James (2014). Mapping the "Cyber Warrior": What Skill-Set Does the Cyber Warrior Need? I Liles, Sam (Red.), Proceedings of the 9th International Conference on Cyber Warfare and Security ICCWS-2014. Purdue University, West Lafayette, Indiana, USA. 24-25 March 2014. Academic Conferences & Publishing International (ACPI). ISSN 9781909507050. s. 373–376. Fulltekst i vitenarkiv
• Flåten, Ola & Lund, Mass Soldal (2014). How Good are Attack Trees for Modelling Advanced Cyber Threats? Norsk Informasjonssikkerhetskonferanse (NISK). ISSN 1893-6563. Fulltekst i vitenarkiv
• Lund, Mass Soldal & Refsdal, Atle (2012). BRIDGE Risk Analyzer: A Collaborative Tool for Enhanced Risk Analysis in Crisis Situations. CEUR Workshop Proceedings. 953. Fulltekst i vitenarkiv Vis sammendrag

  When a crisis occurs, such as a fire in a chemical facility, difficult decisions need to be made based on assessment of risk. Is it safe enough for re-sponders to enter the area? Do we need to evacuate the public from the nearby area? Assessing risks may require information from a number of different sources, as well as collaboration across organizations and management levels. In this paper we present ongoing work to develop a collaborative tool to support risk analysis in crisis situations. The tool will be tightly integrated with a com-plementary tool to make coordinated situation assessments, planning, decision making, information gathering and sharing, thereby providing a unified and in-tegrated crisis management support facility.

• Ligaarden, Olav Skjelkvåle; Lund, Mass Soldal; Seehusen, Fredrik; Refsdal, Atle & Stølen, Ketil (2011). An Architectural Pattern for Enterprise Level Monitoring Tools. I Lewis, Grace A. (Red.), 2011 International Workshop on the Maintenance and Evolution of Service-Oriented and Cloud-Based Systems (MESOCA 2011). IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781457706455. s. 1–10. doi: 10.1109/mesoca.2011.6049035. Fulltekst i vitenarkiv Vis sammendrag

  Requirements from laws and regulations, as well as internal business objectives and policies, motivate enterprises to implement advanced monitoring tools. For example, a company may want a dynamic picture of its operational risk level, its performance, or the extent to which it achieves its business objectives. The widespread use of information and communication technology (ICT) supported business processes means there is great potential for enterprise level monitoring tools. In this paper we present an architectural pattern to serve as a basis for building such monitoring tools that collect relevant data from the ICT infrastructure, aggregate this data into useful information, and present this in a way that is understandable to users.

• Grøndahl, Ida Hogganvik; Lund, Mass Soldal & Stølen, Ketil (2011). Reducing the effort to comprehend risk models: text labels are often preferred over graphical means. Risk Analysis. ISSN 0272-4332. 31(11), s. 1813–1831. doi: 10.1111/j.1539-6924.2011.01636.x. Fulltekst i vitenarkiv Vis sammendrag

  Risk analysis involves people with different roles and competences. The validity of the outcome depends on that they are able to communicate; ideally between themselves, but at least with or via a risk analyst. The CORAS risk modeling language has been developed to facilitate communication between stakeholders involved in the various stages of risk analysis. This article reports the results from an empirical investigation among professionals, where the purpose was to investigate how graphical effects (size, color, shape) and text labels introduced in the CORAS risk modeling language affected the understanding. The results indicate that if graphical effects are used to illustrate important information, they should also be accompanied by informative textual labels.

• Massacci, Fabio; Bouquet, Fabrice; Fourneret, Elizabeta; Jurjens, Jan; Lund, Mass Soldal & Madelénat, Sébastien [Vis alle 12 forfattere av denne artikkelen] (2011). Orchestrating Security and System Engineering for Evolving Systems. Lecture Notes in Computer Science (LNCS). ISSN 0302-9743. 6994, s. 134–143. doi: 10.1007/978-3-642-24755-2_12. Fulltekst i vitenarkiv Vis sammendrag

  How to design a security engineering process that can cope with the dynamic evolution of Future Internet scenarios and the rigidity of existing system engineering processes? The SecureChange approach is to orchestrate (as opposed to integrate) security and system engineering concerns by two types of relations between engineering processes: (i) vertical relations between successive security-related processes; and (ii) horizontal relations between mainstream system engineering processes and concurrent security-related processes. This approach can be extended to cover the complete system/ software lifecycle, from early security requirement elicitation to runtime configuration and monitoring, via high-level architecting, detailed design, development, integration and design-time testing. In this paper we illustrate the high-level scientific principles of the approach.

• Lund, Mass Soldal; Solhaug, Bjørnar & Stølen, Ketil (2011). Risk Analysis of Changing and Evolving Systems Using CORAS. Lecture Notes in Computer Science (LNCS). ISSN 0302-9743. 6858, s. 231–274. doi: 10.1007/978-3-642-23082-0_9. Fulltekst i vitenarkiv Vis sammendrag

  Risk analysis is the identification and documentation of risks with respect to an organisation or a target system. Established risk analysis methods and guidelines typically focus on a particular system configuration at a particular point in time. The resulting risk picture is then valid only at that point in time and under the assumptions made when it was derived. However, systems and their environments tend to change and evolve over time. In order to appropriately handle change, risk analysis must be supported with specialised techniques and guidelines for modelling, analysing and reasoning about changing risks. In this paper we introduce general techniques and guidelines for managing risk in changing systems, and then instantiate these in the CORAS approach to model-driven risk analysis. The approach is demonstrated by a practical example based on a case study from the Air Traffic Management (ATM) domain.

• Lund, Mass Soldal; Solhaug, Bjørnar & Stølen, Ketil (2010). EVOLUTION IN RELATION TO RISK AND TRUST MANAGEMENT. Computer. ISSN 0018-9162. 43(5), s. 49–55. Fulltekst i vitenarkiv
• den, Braber Folker; Lund, Mass Soldal; Stølen, Ketil & Vraalsen, Fredrik (2007). Integrating security in the development process with UML. I Nemati, Hamid R. (Red.), Information security and ethics: Concepts, methodologies, tools and applications. Information Science Reference. ISSN 9781599049373. s. 704–712. Fulltekst i vitenarkiv
• den, Braber Folker; Hogganvik, Ida; Lund, Mass Soldal; Stølen, Ketil & Vraalsen, Fredrik (2007). Model-based security analysis in seven steps – a guided tour to the CORAS method. BT technology journal. ISSN 1358-3948. 25(1), s. 101–117. Fulltekst i vitenarkiv Vis sammendrag

  This paper presents the CORAS method for model-based security analysis. The presentation is case-driven. We follow two analysts in their interaction with an organisation by which they have been hired to carry out a security risk analysis. The analysis is divided into seven main steps, and the paper devotes a separate section to each of them. The paper focuses in particular on the use of the CORAS security risk modelling language as a means for communication and interaction during the seven steps.

• Vraalsen, Fredrik; Mahler, Tobias; Lund, Mass Soldal; Hogganvik, Ida; Braber, Folker den & Stølen, Ketil (2007). Assessing Enterprise Risk Level : the CORAS Approach. I Khadraoui, Djamel & Herrmann, Francine (Red.), Advances in Enterprise Information Technology Security. IGI Global. ISSN 9781599040905. s. 311–333. Fulltekst i vitenarkiv
• Braber, Folker den; Hogganvik, Ida; Lund, Mass Soldal; Stølen, Ketil & Vraalsen, Fredrik (2007). Model-based security analysis in seven steps — a guided tour to the CORAS method. BT technology journal. ISSN 1358-3948. 25(1), s. 101–117. Fulltekst i vitenarkiv
• Lund, Mass Soldal & Stølen, Ketil (2006). Deriving tests from UML 2.0 sequence diagrams with neg and assert. I Anderson, Kenneth M. (Red.), Proceedings of the 28th International Conference on Software Engineering & Co-Located Workshops. ACM Publications. ISSN 9781595930859. Fulltekst i vitenarkiv
• Lund, Mass Soldal & Stølen, Ketil (2006). A fully general operational semantics for UML 2.0 sequence diagrams with potential and mandatory choice. Lecture Notes in Computer Science (LNCS). ISSN 0302-9743. 4085, s. 380–395. Fulltekst i vitenarkiv
• Rossebø, Judith Ellen Yarranton; Lund, Mass Soldal; Husa, Knut Eilif & Refsdal, Atle (2006). A conceptual model for service availability. I Gollmann, Dieter (Red.), Quality Of Protection - Security Measurements and Metrics. Springer Publishing Company. ISSN 9780387290164. s. 107–118. Fulltekst i vitenarkiv
• Rossebø, Judith; Lund, Mass Soldal; Refsdal, Atle & Husa, Knut Eilif (2006). A conceptual model for service availability. Advances in Information Security. ISSN 1568-2633. 23, s. 107–118. Fulltekst i vitenarkiv
• Vraalsen, Fredrik; Lund, Mass Soldal; den, Braber Folker & Stølen, Ketil (2005). The CORAS tool for security risk analysis, Trust Management, Third International Conference, iTrust 2005, Proceedings. Springer. ISSN 9783540260424. s. 402–405. Fulltekst i vitenarkiv Vis sammendrag

  The CORAS Tool for model-based security risk analysis supports documentation and reuse of risk analysis results through integration of different risk analysis and software development techniques and tools. Built-in consistency checking facilitates the maintenance of the results as the target of analysis and risk analysis results evolve.

• Vraalsen, Fredrik; Lund, Mass Soldal; Mahler, Tobias; Parent, Xavier & Stølen, Ketil (2005). Specifying legal risk scenarios using the CORAS threat modelling language - Experiences and the way forward. Lecture Notes in Computer Science (LNCS). ISSN 0302-9743. 3477. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2005). Specifying Legal Risk Scenarios Using the CORAS Threat Modelling Language, Trust Management, Third International Conference, iTrust 2005, Proceedings. Springer. ISSN 9783540260424. s. 45–60. Fulltekst i vitenarkiv Vis sammendrag

  The paper makes two main contributions: (1) It presents experiences from using the CORAS language for security threat modelling to specify legal risk scenarios. These experiences are summarised in the form of requirements to a more expressive language providing specific support for the legal domain. (2) Its second main contribution is to present ideas towards the fulfilment of these requirements. More specifically, it extends the CORAS conceptual model for security risk analysis with legal concepts and associations. Moreover, based on this extended conceptual model, it introduces a number of promising language constructs addressing some of the identified deficiencies.

• Vraalsen, Fredrik; Braber, Folker den; Lund, Mass Soldal & Stølen, Ketil (2005). The CORAS tool for security risk analysis. Lecture Notes in Computer Science (LNCS). ISSN 0302-9743. s. 402–405. Fulltekst i vitenarkiv
• Braber, Folker den; Lund, Mass Soldal; Stølen, Ketil & Vraalsen, Fredrik (2005). Integrating security in the development process with UML. I Khosrow-Pour, Mehdi (Red.), Encyclopedia of Information Science and Technology. Idea Group. ISSN 9781591405535. s. 1560–1566. Fulltekst i vitenarkiv

Se alle arbeider i NVA

• Berrefjord, Vivi Ringnes & Lund, Mass Soldal (2024). Cybermakt. En tverrfaglig innføring. Universitetsforlaget. ISBN 9788215057071. 363 s. Fulltekst i vitenarkiv
• Lund, Mass Soldal; Solhaug, Bjørnar & Stølen, Ketil (2011). Model-Driven Risk Analysis. The CORAS Approach. Springer. ISBN 9783642123221. 460 s. Fulltekst i vitenarkiv

Se alle arbeider i NVA

• Lund, Mass Soldal (2026). Europeiske matbutikker hacket - nå advares norske hjem. [TV]. TV2. doi: https:/play.tv2.no/nyheter/europeiske-matbutikker-hacket-naa-advares-norske-hjem-jq53zk2w. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2026). Ekspert om frysehackingen: Avslører et oversett sikkerhetsproblem. [Internet]. digi.no. doi: https:/www.digi.no/sikkerhet/ekspert-om-frysehackingen-avslorer-et-oversett-sikkerhetsproblem/7181098. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2026). Kan hjemmet ditt bli hacket? [Internet]. Aftenposten.no. doi: https:/www.aftenposten.no/norge/i/kv7Ala/kan-hjemmet-ditt-bli-hacket. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2026). Cyberangrep mot matbutikker: – Ingen grunn til at vi skal bli spart. [Internet]. nrk.no. doi: https:/www.nrk.no/artikkel/cyberangrep-mot-matbutikker-ingen-grunn-til-at-vi-skal-bli-spart-1531564. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2026). – Jeg har aldri tenkt så mye på en film. [Internet]. Forsvarets forum. doi: https:/www.forsvaretsforum.no/gaza-hamas-israel/jeg-har-aldri-tenkt-sa-mye-pa-en-film/529023. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2026). Cyber defence and implications for maritime sector. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2026). Kunstig intelligens. Fulltekst i vitenarkiv
• Hartmark, Elias Evjen; Anisi, Alireza David; Sauter, Alexander & Lund, Mass Soldal (2026). Towards Automated Runtime Verification: LLM-Assisted Synthesis of Temporal Logic from Safety Requirements. Fulltekst i vitenarkiv
• Wigernæs, Ine; Lombnæs, Peder; Rostad, Camilla & Lund, Mass Soldal (2026). Matberedskap og matsikkerhet. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2026). Det er framleis språkmodellar. doi: https:/klassekampen.no/utgave/2026-02-09/debatt-det-er-framleis-sprakmodellar. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2026). Kronprinsessens e-post og mobilnummer lekket: – En sikkerhetstrussel. [Internet]. nrk.no. doi: https:/www.nrk.no/norge/kronprinsessens-e-post-og-mobilnummer-lekket_-_-en-sikkerhetstrussel-1.17754770. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2026). Kunstig intelligens – redning eller trussel? Fulltekst i vitenarkiv
• Lund, Mass Soldal (2025). Frå kuler til kode – korleis cybermakt påverkar moderne militærmakt. doi: https:/www.nffo.no/aktuelt/medlemstreff-pa-lillehammer. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2025). Cyberåtak og cybersikkerheit. doi: https:/www.inn.no/forskning/forskingsdagane/arrangement-forskingsdagane-2025/researchers-night-kongsvinger/index.html. Fulltekst i vitenarkiv
• Lund, Mass Soldal & Grindahl, Aleksandra (2025). Cybersikkerhet og cybermakt. doi: https:/www.inn.no/forskning/forskingsdagane/arrangement-forskingsdagane-2025/cybersikkerhetsprat/. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2025). Sikkerheitstruslar og cyberåtak. doi: https:/www.iktorkide.no/tjenester/program-innovasjonsseminar-2025/#faqsporsmal-642. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2025). Frå kuler til kode: Korleis cybermakt påverkar moderne militærmakt? Fulltekst i vitenarkiv
• Lund, Mass Soldal (2025). Kommentarer og reaksjoner på Totalberedskapsmeldingen. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2024). – En avansert operasjon. [Internet]. tv2.no. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2024). VG Forklarer: Bør vi være redde etter personsøkereksplosjonene? [Internet]. vg.no. Fulltekst i vitenarkiv
• Berrefjord, Vivi Ringnes & Lund, Mass Soldal (2024). Introduksjon. I Berrefjord, Vivi Ringnes & Lund, Mass Soldal (Red.), Cybermakt. En tverrfaglig innføring. Universitetsforlaget. ISSN 9788215057071. s. 12–22. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2024). Distriktsnyheter Innlandet. Mass Soldal Lund, professor i cybersikkerhet og samfunnssikkerhet. [TV]. NRK Innlandet. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2024). Vil ha mindre marknads­tenking i akademia. [Internet]. Khrono. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2024). Denne russiske basen forsvant fra nettet da hackere slettet 280 servere og 2000 terabyte data fra satellittsenteret. [Internet]. digi.no. Fulltekst i vitenarkiv
• Barua, Ishita & Lund, Mass Soldal (2024). Kan kunstig intelligens redde liv? Fulltekst i vitenarkiv
• Berrefjord, Vivi Ringnes; Lund, Mass Soldal & Skeie, Johanne Jensen (2024). #PolyPod: Hva er cybermakt? [Internet]. Polyteknisk forenings podcast . Fulltekst i vitenarkiv
• Berrefjord, Vivi Ringnes; Lund, Mass Soldal & Skeie, Johanne Jensen (2024). #PolyBok: Bokbad om «Cybermakt». Fulltekst i vitenarkiv
• Svanes, Hege & Lund, Mass Soldal (2024). Cyberangrep og jamming - en ny normal. [Internet]. Forsvarspodden. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2024). Professor i cybertryggleik: — Aukande trussel. [Internet]. Khrono. Fulltekst i vitenarkiv
• Berrefjord, Vivi Ringnes & Lund, Mass Soldal (2024). Hemmer forsvarsevnen: – Kan bruke cyberangrep til å få folk til å løpe rundt som hodeløse høns. [Internet]. digi.no. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2023). Fienden er eit tastetrykk unna. Syn og Segn. ISSN 0039-7717. 129(1), s. 32–39. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2023). «Lurer» Putin med dataspillet Counter-Strike. [Internet]. vg.no. Fulltekst i vitenarkiv
• Siler, Janne Seime & Lund, Mass Soldal (2023). Brennpunkt: Cyberkriger. Episode 2. Farlig spill. [TV]. NRK. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2023). How to build a national defense in cyberspace? Fulltekst i vitenarkiv
• Lund, Mass Soldal (2023). Mobilen kan være en dødsfelle på slagmarken. [Internet]. Forsvarets forum. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2023). Nasjonal sikkerhet: Disse landene vil hacke Norge: – Misbrukes. [Internet]. TV2.no. Fulltekst i vitenarkiv
• Sætren, Gunhild Birgitte; Lund, Mass Soldal & Vaag, Jonas Rennemo (2023). Developing training for strategic crisis management. A systematic literature review. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2023). Autonomy in cyberspace operations – Outlook and challenges. I Radzivilov, Hryhoriy Danylovych; Chevardin, Vladyslav Evgeniyovy; Zaluzhnyi, Oleksiy Viktorovych; Husainov, Pavlo Valetynovych; Yurchenko, Oleg Vasyliovych & Kovalchuk, Lyudmila Vasylivna (Red.), First International Scientific and Practical Conference. Cyberwarfare: Intelligence, defence and offensive security. Kruty Heroes Military Institute of Telecommunications and Information Technologies. s. 14–17. Fulltekst i vitenarkiv
• Lund, Mass Soldal & Aase, Johnny Grøneng (2023). Må bli meir enn ein draum. Offisersbladet. ISSN 0332-7159. s. 19–19. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2023). Autonomy in cyberspace operations – outlook and challenges. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Sikkerheit i ei usikker tid – Konsekvensar for leiing og praksis i skulen. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Simulator for cybersikkerheit i digital skipssystem. Skipsrevyen. ISSN 0800-2282. 52(6/7), s. 52–53. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Rapport med krass kritikk av sikkerheten på norsk sokkel. [Internet]. Aftenposten.no. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Framtidas krisar og konfliktar: Aktivisme, kriminelle og IT-mobilisering. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Russiske hackere fortsetter: Gjensidige og flere bedrifter er rammet. [Internet]. Aftenposten.no. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Kuttet i cybermidler: - Høyst beklagelig. [Internet]. dagbladet.no. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Mange bedrifter er blitt utsatt for dataangrep den siste uken. [Journal]. Aftenposten. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Eksperter: - All grunn til å ta det på alvor. [Internet]. TV2.no. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Rapport med krass kritikk av sikkerheten på norsk sokkel. [Journal]. Aftenposten. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Mange bedrifter er blitt utsatt for dataangrep den siste uken. Dataforsker sier det skjer flere angrep enn før. [Internet]. Aftenposten.no. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Vettug viten: Cyberkrigen i Ukraina. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). The Russo-Ukrainian war as an opportunity to study hybrid warfare. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Cyberåtak som politisk verkemiddel – tilfellet Russland. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Krigen i Ukraina. Frykt for flere cyberangrep mot Finland og Sverige. [TV]. NRK Nyhter. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). NRK svarer: Spør oss om krigen mellom Russland og Ukraina. [Internet]. Nrk.no. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Russland: Har ikke brukt fryktede hackere. [Internet]. dagbladet.no. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). NRK svarer: Spør oss om krigen mellom Russland og Ukraina. [Internet]. Nrk.no. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). NRK svarer: Spør oss om krigen mellom Russland og Ukraina. [Internet]. Nrk.no. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Russiske journalister, bloggere og korrupsjonsjegere er jaget i eksil. [Internet]. Forsvarets forum. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Anton er oppgitt over nettroll: - Det irriterer meg at folk ikke sier rett ut hva de mener. [Internet]. iFinnmark Pluss. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Russiske Anton er oppgitt over nettroll. [Journal]. Finnmarken. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Putins motstandere jagget vekk. [Journal]. Tønsberg blad. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Russiske journalister, bloggere og korrupsjonsjegere er jaget i eksil. [Journal]. Bergens Tidende. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Cyberekspert: Slik har Putin feilet. [TV]. VGTV. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Ekspert: - Har ikke sett de cyberangrepene vi så for oss. [Internet]. VG Nyhetsdøgnet. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). – Ikke mulig å drive med noen som helst form for uavhengig journalistikk i Russland i dag. [Internet]. Journalisten. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Russiske journalister, bloggere og korrupsjonsjegere er jaget i eksil. [Journal]. Rogalands avis. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Cybersikkerheit – «Kva kan vi forvente?». Fulltekst i vitenarkiv
• Lund, Mass Soldal (2022). Cyberåtak i Ukraina – forventa og antiklimaks. Dagens næringsliv. ISSN 0803-9372. s. 31–31. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2021). Motstandsdyktigheit i det maritime cyberdomenet - Velkomen og introduksjon. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2021). Cybertrusselen og elektronisk krigføring – kva kan vi sjå føre oss i gråsona? Norsk Militært Tidsskrift. ISSN 0029-2028. 191(3), s. 22–29. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2020). Menneskemaskina. Syn og Segn. ISSN 0039-7717. 126(1), s. 74–81. Fulltekst i vitenarkiv
• Lund, Mass Soldal & Rognstrand​, Andrea (2019). Hacker-angrep: – Den nye hverdagen. [Internet]. Forsvarets forum. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2018). CND-konsept for taktiske nettverk. I Jøsok, Øyvind & Knox, Benjamin James (Red.), Ledelse i cyberdomenet. Forsvarets Ingeniørhøgskole. s. 35–47. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2017). Cyber som operasjonsdomene. Norsk Militært Tidsskrift. ISSN 0029-2028. 186(1), s. 28–34. Fulltekst i vitenarkiv
• Hareide, Odd Sveinung; Jøsok, Øyvind & Lund, Mass Soldal (2017). Maritime Cyber Security Demonstrator in Norway. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2017). Internetthøgre frå 4chan til Trump. Gnist- Marxistisk tidsskrift. ISSN 2535-3195. 46(4), s. 140–142. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2014). What does the cyber warrior need to know? Fulltekst i vitenarkiv
• Lund, Mass Soldal (2014). How Good are Attack Trees for Modelling Advanced Cyber Threats? Fulltekst i vitenarkiv
• Lund, Mass Soldal (2014). Kan vi lage forsvarbare informasjonssystem? Fulltekst i vitenarkiv
• Lund, Mass Soldal (2014). After Action Review of Cyber Exercises. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2013). Framtidas krig. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2013). Et verktøy for bedre risikoanalyse i krisesituasjoner. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2012). Hvordan analysere sikkerhet mht. endring. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2012). Analysing risk in practice. The CORAS approach to model-driven risk analysis. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2012). It-sikkerheit krev risikoanalyse. Fulltekst i vitenarkiv Vis sammendrag

  Kronikk om behovet for risikoanalyse for it-sikkerhet. Også publisert online 26-03.2012

• Lund, Mass Soldal (2011). Panel discussion at First NESSOS Industry Seminar. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2011). Bridging the Gap in Model-based V&V Methodology. Fulltekst i vitenarkiv Vis sammendrag

  In this paper we suggest that one of the big challenges in development of model-based V&V methodology is bridging the gap between the low-level user guides of V&V tools and the high-level text-book descriptions of model-driven development methodologies. As a step towards mitigating this we suggest a structure for V&V methodology with three layers: a bottom level with usage of specific V&V techniques, a middle level with V&V method patterns, and a top level with overall development methodology. Within this structure we suggest that the middle level is often missing in presentations of model-based V&V and in presentations of model-driven development methodologies, and is where the need for development is the greatest.

• Lund, Mass Soldal (2008). Model-based analysis using the Escalator tool. Fulltekst i vitenarkiv
• Lund, Mass Soldal (2006). Oversikt over metodar og teknikkar for å beskrive truslar. Fulltekst i vitenarkiv
• Rossebø, Judith Ellen Yarranton; Lund, Mass Soldal; Husa, Knut-Eilif & Refsdal, Atle (2005). A Conceptual Model for Service Availability. Fulltekst i vitenarkiv
• Vraalsen, Fredrik; Braber, Folker den; Lund, Mass Soldal & Stølen, Ketil (2005). The CORAS tool for security risk analysis. Fulltekst i vitenarkiv
• Vraalsen, Fredrik; Lund, Mass Soldal; Mahler, Tobias; Parent, Xavier & Stølen, Ketil (2005). Specifying Legal Risk Scenarios Using the CORAS Threat Modeling Language. Experiences and the Way Forward. Fulltekst i vitenarkiv
• Lund, Mass Soldal & Vraalsen, Fredrik (2005). Analysing trust, security & legal issues using CORAS. Fulltekst i vitenarkiv
• Lund, Mass Soldal & Stølen, Ketil (2005). Extendable and modifiable operational semantics for UML 2.0 sequence diagrams. Fulltekst i vitenarkiv
• Braber, Folker den; Lund, Mass Soldal & Vraalsen, Fredrik (2005). Model-based analysis of security and trust using CORAS. Fulltekst i vitenarkiv
• Erstad, Erlend; Larsen, Marie Haugli; Lund, Mass Soldal & Ostnes, Runar (2022). Maritime Cyber Simulator Scenario Workshop report. Norges teknisk-naturvitenskapelige universitet. Fulltekst i vitenarkiv Vis sammendrag

  The 7th of December 2021, the Maritime Cyber Resilience (MarCy) project held a Cyber Simulator Scenario workshop aiming to create a fundament for training to enhance operational maritime cyber resilience. MarCy is a research project collaboration, between the academic partners Norwegian University for Science and Technology (NTNU), Norwegian Defence University College (NDUC), and the industry partners DNV, Norwegian Hull Club (NHC) and Kongsberg Defence & Aerospace (KDA). The scope of the workshop was to invite maritime stakeholders and people in the maritime industry to discuss how and if simulator training should be part of cyber awareness training, and what simulator scenarios can be beneficial to implement in such training. The aim was to develop both operational level scenarios for the crew handling ships, and management level scenarios for the shipowners and maritime stakeholders. In addition to this, the workshop led to fruitful discussion how the maritime industry is dealing and coping with cyber threats, and what could be considered as beneficial for cyber training. Real life incidents and experiences was also shared among the participants. The MarCy project partners and the authors of the report want to express their greatest gratitude for all the participants attending the workshop. The workshop could not have been completed without you. Due to the protection of the privacy for the attendants, no individual level information is given. See more in Section 2. List of the organizations attending the workshop: DNV Island Offshore Kongsberg Aerospace & Defence Norwegian Defence University College Norwegian Hull Club NTNU – COAST project NTNU in Ålesund NTNU in Gjøvik NTNU – SFI-Move project Royal Norwegian Naval Academy The Norwegian Armed Forces Cyber Defence The Norwegian Armed Forces The Norwegian Coast Guard The Norwegian Coastal Administration The Norwegian Society for Sea Rescue

• Mølholm, Atle Johan; Mobech-Hanssen, Bjørn; Martinussen, Svein Erlend; Lund, Mass Soldal; Reutz, Bjørn Anders Hoffstad & Ummaneni, Ravindra Babu [Vis alle 11 forfattere av denne artikkelen] (2021). Teknologiutdanningen på Forsvarets Høgskole. Forsvarets høgskole. Fulltekst i vitenarkiv
• Seehusen, Fredrik; Lund, Mass Soldal & Stølen, Ketil (2009). A Transformational Approach to Facilitate Monitoring of High Level Policies. SINTEF Digital. ISSN 9788214044331. Fulltekst i vitenarkiv Vis sammendrag

  We present a method for specifying high level security policies that can be enforced by runtime monitoring mechanisms. The method has three main steps: (1) the user of our method formalizes a set of policy rules using UML sequence diagrams; (2) the user selects a set of transformation rules from a transformation library, and applies these using a tool to obtain a low level intermediate policy (also expressed in UML sequence diagrams); (3) the tool transforms the intermediate low level policy expressed in UML sequence diagrams into a UML inspired state machine that governs the behavior of a runtime policy enforcement mechanism. We believe that the method is both easy to use and useful since it automates much of the policy formalization process. The method is underpinned by a formal foundation that precisely defines what it means that a system adheres to a policy expressed as a sequence diagram as well as a state machine. The foundation is furthermore used to show that the transformation from sequence diagrams to state machines is adherence preserving under a certain condition. Oppdragsgiver: Norwegian Research Council (NCR); European Commission (EC)

• Lund, Mass Soldal & Bogya, Emese Lujza (2008). Evaluation of the 1st DIGIT field trial. SINTEF Digital. ISSN 9788214044171. Fulltekst i vitenarkiv Vis sammendrag

  This report evaluates the 1st DIGIT field trial, a security risk analysis conducted for Santander in the autumn of 2007. The evaluation includes lessons learned from the analysis and an empirical investigation into the use of the CORAS language in the analysis. Oppdragsgiver: NFR

• Hogganvik, Ida; Lund, Mass Soldal & Stølen, Ketil (2007). Quality Evaluation of the CORAS UmL Profile. SINTEF Digital. ISSN 9788214040685. Fulltekst i vitenarkiv Vis sammendrag

  This report contains an evaluation of the CORAS UML profile and consists og two parts:Modeling a benchmarking test called ""the core security risk scenarios"" using the CORAS UML profileAssessing the quality og the CORAS UML profile using a quality evaluation framework for modeling languages.The results shows that it was possible to model almost all the information in the core security risk scenarios with the CORAS UML profile. However, being able to express the core security risk scenarios is not sufficient. The diagrams are characterized by duplication of information, and information that is spread out over several diagrams which makes it difficult to get an overview.In the quality evaluation the CORAS UML profile has been found to include the main security analyses concepts and modeling perspectives, and therefor have a high domain appropriateness factor. It benefits from being based on a well-known and widely used modeling language for which several tools are available. The quality evaluation shows that the main weakness of the UML profile are related to its graphical symbols and and diagram types.The symbols do not always conforme to best practice within symbol design. Some of the diagrams are more confusing than they are explanatory, and they require a substancial effort from the modeler.   Oppdragsgiver: Norges Forskningsråd

• Lund, Mass Soldal & Stølen, Ketil (2007). A fully general operational semantics for UML sequence diagrams with potential and mandatory choice. Universitetet i Oslo. ISSN 9788273682857. Fulltekst i vitenarkiv Vis sammendrag

  UML sequence diagrams is a specification language that has proved itself to be of great value in system development. When put to applications such as simulation, testing and other kinds of automated analysis there is a need for formal semantics. Such methods of automated analysis are by nature operational, and this motivates formalizing an operational semantics. In this report we present an operational semantics for UML 2.0 sequence diagrams that we believe gives a solid starting point for developing methods for automated analysis. The operational semantics has been proved to be sound and complete with respect to a denotational semantics for the same language. It handles negative behavior as well as potential and mandatory choice. We are not aware of any other operational semantics for sequence diagrams of this strength.

• Lund, Mass Soldal (2007). Operational analysis of sequence diagram specifications. Universitetet i Oslo. Fulltekst i vitenarkiv Vis sammendrag

  This thesis is concerned with operational analysis of UML 2.x sequence diagram specifications. By operational analysis we mean analysis based on a characterization of the executions of sequence diagrams, or in other words an operational semantics for sequence diagrams. We define two methods for analysis of sequence diagram specifications – refinement verification and refinement testing – and both are implemented in an analysis tool we have named ‘Escalator’. Further, we make the first steps in the direction of extending our approach with support for availability analysis. In order to facilitate operational analysis, we define an operational semantics for UML 2.x sequence diagrams. The operational semantics is loyal to the intended semantics of UML, and is proven to be sound and complete with respect to the denotational semantics for sequence diagrams defined in STAIRS – a framework for stepwise development based on refinement of sequence diagram specifications. The operational semantics has a formalized meta-level, on which we define execution strategies. This meta-level allows us to make distinctions between positive and negative behavior, between potential and universal behavior, and between potential and mandatory choice, all of which are inherently difficult in an operational semantics. Based on the operational semantics and its formalized meta-level, we define trace generation, test generation and test execution. Further, based on a formalization of refinement in STAIRS, the trace generation is used to devise a method for refinement verification, and the test generation and the test execution are used to define a method for refinement testing. Both are methods for investigating whether or not a sequence diagram specification is a correct refinement of another sequence diagram specification. The operational semantics, the refinement verification and the refinement testing are implemented with the term rewriting language Maude, and these implementations are integrated in the Escalator tool. In addition, Escalator provides a graphical user interface for working with sequence diagram specifications and for running the analyses. In order to facilitate availability analysis, we define a conceptual model for service availability where the basic properties of availability are identified. Further, we extend the operational semantics with support for one class of these basic properties, namely real-time properties, and outline how the operation semantics extended with time can be applied to make methods for timed analysis of sequence diagram specifications.

• Rossebø, Judith Ellen Yarranton; Lund, Mass Soldal; Husa, Knut Eilif & Refsdal, Atle (2006). A conceptual model for service availability. Universitetet i Oslo. Fulltekst i vitenarkiv Vis sammendrag

  Traditionally, availability has been seen as an atomic property asserting the average time a system is "up" or "down". In order to model and analyse the availability of computerised systems in a world where the dependency on and complexity of such systems are increasing, this notion of availability is no longer sufficient. This report presents a conceptual model for service availability designed to handle these challenges. The core of this model is a characterisation of service availability by means of accessibility properties and exclusivity properties, which is further specialised into measurable aspects of service availability. We outline how this conceptual model may be refined to a framework for specifying and analysing availability requirements.

Se alle arbeider i NVA