Rudi Serfontein
email: rudi.serfontein@nwu.ac.zahennie.kruger@nwu.ac.za

Hennie Kruger

Lynette Drevin
email: lynette.drevin@nwu.ac.za

Identifying information security risks in a social network using self-organising maps

Keywords: Self-Organising Maps, Social Network Analysis, Information Security

Managing information security risks in an organisation is one of the most important tasks an organisation has. Unfortunately, due to the complexity of most organisational systems, identifying information security risks can be difficult. One way to identify possible risks in an organisation is to make use of Social Network Analysis (SNA). While they can be used to identify risks, the metrics calculated using SNA are often numerous and daunting to managers unfamiliar with SNA. Furthermore, as the data in this form tend to be uncomfortable to process, educating managers about risks in their organisation can be quite difficult. Also, as these metrics often require quantitative processing in order to be useful, SNA on its own is not always an attractive method to use to identify risks in an organisation. In this paper the use of self-organising maps to identify possible information security risks in an organisation is investigated. Risk data were obtained from an organisation that deals in risk management, which were used to build a social network. A number of metrics associated with risk were calculated from the network, and these metrics were used to cluster the various entities using a self-organising map. Certain entities that pose a possible information security risk were identified. The results suggest that it may be viable to use self-organising maps, in concord with SNA, to more easily identify risks in an organisation using visual methods.

Introduction

Information security risk management is one of the most crucial parts of information security and should be one of the most important actions taken by organisations [START_REF] Wangen | Information security risk assessment: A method comparison[END_REF]. Unfortunately, due to the relative complexity of most organisational systems, identifying information security risks that are inherent to people using the systems, and making managers aware of them, is often quite difficult. One of the methods proposed in recent years to address such risks involve the use of Social Network Analysis (SNA) [START_REF] Armstrong | A course applying network analysis to organizational risk in information security[END_REF][START_REF] Dang-Pham | Investigation into the formation of information security influence: Network analysis of an emerging organisation[END_REF][START_REF] Serfontein | The feasibility of raising information security awareness in an academic environment using SNA[END_REF].

SNA is a method that can be used to evaluate an organisation, for instance a community or business, in such a way that social interactions can be studied quantitatively, rather than qualitatively [START_REF] Scott | The SAGE handbook of social network analysis[END_REF]. It does however have a significant drawback in that large networks, when visualised, may have so many nodes and arcs that the network is visually incomprehensible. In order to address this drawback, a number of studies have employed techniques that alter significant nodes and edges of a visualised network in order to draw attention to certain aspects. Some of these techniques include differentiating the colour of nodes and edges [START_REF] Tsui | Linking social network analysis with the analytic hierarchy process for knowledge mapping in organizations[END_REF], using differing sized nodes to correspond to certain metrics [START_REF] Dang-Pham | Applying network analysis to investigate interpersonal influence of information security behaviours in the workplace[END_REF], and using labels of various sizes [START_REF] Dang-Pham | Investigation into the formation of information security influence: Network analysis of an emerging organisation[END_REF]. A somewhat more novel technique makes use of Self Organising Maps (SOMs) to directly visualise network data [START_REF] Boulet | Batch kernel SOM and related laplacian methods for social network analysis[END_REF]. A SOM is an effective technique that can be used not only to visualise high-dimensional data, but to visualise it in such a way that the result can act as both a similarity graph and a clustering diagram [START_REF] Kohonen | The self-organizing map[END_REF]. The SOM technique can be used to identify similar nodes within a social network, even in the presence of seemingly contradicting attributes, and present this data in a way that managers are quickly informed of risks in the network.

SOMs have also been used in information security research to propose improvements to intrusion detection methods [START_REF] De La Hoz | PCA filtering and probabilistic SOM for network intrusion detection[END_REF], and as a method for analysing information security behavioural data [START_REF] Hunt | Using security logs to identify and manage user behaviour to enhance information security[END_REF][START_REF] López | Analysis of computer user behavior, security incidents and fraud using self-organizing maps[END_REF]. While the approach suggested by Boulet, Jouve, Rossi and Villa [START_REF] Boulet | Batch kernel SOM and related laplacian methods for social network analysis[END_REF] does allow for social networks to be visualised as SOMs, it has a shortcoming in that the SOMs generated can not necessarily be used in a way that is relevant to the process of identifying possible information security risks. This is mainly as a result of the fact that, in order to identify risks within a social network, a number of metrics calculated from the network data is used rather than the raw data itself. In this paper the feasibility of using existing SOM techniques to inform managers of possible risks in an organisation is discussed. The value of such an application is twofold; firstly, by using a visualisation method that reduces the amount of data that is visualised, the often confusing graphs produced by traditional SNA visualisation techniques can be replaced with SOMs that are easier to process graphically. Furthermore, as SOM algorithms produce maps that naturally display data of interest, analysis and evaluation of the data should no longer require the visualisation results to be adapted (node enlargement, colouration, etc.) in order to be meaningful. Secondly, as SOMs organise similar data into clusters, their application should make it easier to inform a manager of groups of similar at-risk entities. This is thanks to the clustering done by the SOM algorithms, as, due to the relationship between certain SNA metrics and the CIA triad (Confidentiality, Integrity and Availability), as will be discussed in Section 2, clustering the nodes according to these metrics allows an evaluator to quickly identify similar problematic nodes. Furthermore, because the SOM algorithm uses the calculated SNA metrics as attributes to determine the clusters, the clusters themselves can be used to infer similarities that may not be readily transparent from the available data. Another advantage is that managers can be informed and educated of possible risks in an organisation early on, which may aid in developing effective awareness, education, and training programs. The graphical nature of SOM may also make it a useful tool for training inexperienced risk managers, and can potentially aid in identifying standard trends and patterns.

In the remainder of the article the background, research methodology, and results, will be discussed respectively. The background discussion will focus on SNA in the context of information security, as well as SOMs. The discussion of the method will focus on both the application of the techniques, and the data collection phase. The paper will then conclude with a discussion of the results and implications.

Background

The primary theme of this paper is the use of Social Network Analysis (SNA) metrics as inputs for a Self-Organising Map (SOM), which should aid in evaluating risk in an organisation. In order to demonstrate how this can be done, five SNA metrics will be discussed briefly. While there are dozens of SNA metrics that can potentially be used, the five discussed here were chosen based on their established relationships with risk in the literature. The section will start with a description of SOMs, followed by the evaluation of the selected SNA metrics in relation to risk.

Self-Organising Maps (SOM)

The self-organising map (SOM) is a neural network technique that can be used to visualise and evaluate high-dimensional data [START_REF] Bäck | Handbook of natural computing[END_REF]. The SOM technique uses given data to produce a self-organising neural network wherein the data points are clustered into topographical regions [START_REF] Pal | An insight of world health organization (WHO) accident database by cluster analysis with self-organizing map (SOM)[END_REF]. This visualisation technique has a wide range of known applications, from evaluating comparable biological adaptations [START_REF] Nakayama | Comparative transcriptomics with self-organizing map reveals cryptic photosynthetic differences between two accessions of north american lake cress[END_REF] and improving optimisation algorithms [START_REF] Gu | Self-organizing map-based weight design for decomposition-based many-objective evolutionary algorithm[END_REF][START_REF] Kuo | Integration of growing selforganizing map and bee colony optimization algorithm for part clustering[END_REF], to clustering data for problem-solving purposes [START_REF] Pal | An insight of world health organization (WHO) accident database by cluster analysis with self-organizing map (SOM)[END_REF][START_REF] Lee | Using self-organizing map and clustering to investigate problem-solving patterns in the massive open online course: An exploratory study[END_REF]. One of the greatest advantages SOM has over other high-dimension visualisation techniques is that it produces a two-dimensional topographical map that can be evaluated and interpreted without any special knowledge or skills. In addition to clustering known data points, depending on the data, the technique can also be used in vector quantisation, and as a regression modelling technique [START_REF] Bäck | Handbook of natural computing[END_REF]. All these methods can arguably be used to obtain valuable information about data, but in the context of this paper only the clustering function of SOM will be considered. The algorithm for developing a SOM [START_REF] Fausett | Fundamentals of neural networks: Architectures, algorithms, and applications[END_REF] is shown below. This algorithm produces one map with all of the entities sorted into clusters. Certain software suites, such as Viscovery SOMine [START_REF] Somine | [END_REF], provide additional information by colouring the same map using values from different attributes.

As stated, SOMs can be used to cluster high-dimensional data on a two-dimensional map, producing a result that can be interpreted easily without training. This makes the technique especially valuable to those in managerial positions, as these individuals may not have the time to study large reports and data sets in detail, and may also hold true for the outcomes of SNA based studiesespecially if the resulting network is particularly large or complex. By calculating the SNA metrics, as discussed in the next section, and applying SOM to the resulting data set, the risks posed by certain individuals or groups can be determined and presented visually in a way that is easy to process and interpret. Additionally, a number of at-risk individuals may be identified that would not necessarily have been evident through the use of more traditional visualisation techniques such as bar-graphs. It is possible for an individual to have all the traits of a highrisk individual and not be an obvious risk from the data itself. In these instances, a clustering technique such as SOM can be used to identify individuals that have similar, possibly hidden, attributes. This makes it significantly easier to address certain information security risks, as larger scale programmes can be developed to target groups consisting of similar individuals.

In summary, SOM is a valuable technique to use in addition to SNA, as the clustering function of SOM can be used to infer invaluable information about information security risks if the correct and relevant SNA metrics are used.

Social Network Analysis (SNA) in the context of Information Security

One of the most well-known frameworks for information security is the CIA triad [START_REF] Au | An investigation on the relationship between control self-assessment, cloud security, and cloud-related business performance-using partial least squares[END_REF], which references Confidentiality, Integrity, and Availability. Confidentiality describes the access rights that users have to a piece of information. For example, a manager having confidential access to certain business data that his employees do not, or should not, have. One possible SNA metric that can be used to evaluate a risk to confidentiality is closeness centrality. Closeness centrality is calculated by determining all the shortest distances to all other nodes within the network [START_REF] Armstrong | Organizational risk using network analysis[END_REF], so a node with a high closeness centrality has a large number of close relationships to other nodes in the network. Such a node may therefore have access to information that it should not have access to. Alternatively, if the node is an object or a resource, such as a shared computer or a photocopier, it could become a significant confidentiality risk if malware or untrustworthy maintenance personnel are involved. Integrity describes not only how accurate any piece of information is but, by extension, how trustworthy it is. One of the SNA metrics that can be used to evaluate the risk a node poses to the integrity of the information in the network is total degree centrality. The total degree centrality measure is concerned with an individual node's position within the network [START_REF] Armstrong | Organizational risk using network analysis[END_REF][START_REF] Hanneman | Introduction to social network methods[END_REF], and is determined by using the number of nodes leading into and out of a node. A node with a high total degree centrality is well connected within the network, and may have enough influence over other nodes to impact the integrity of the information passing through them. Consider, as an example, an office worker with a high total degree centrality that has to capture data for a corporate database. If this worker were to make a mistake in capturing the data, the integrity of the data that a large number of nodes rely on may be compromised.

The betweenness centrality measure can be used to identify nodes that are risks to both integrity and confidentiality. This measure is a representation of the number of times that a particular node is part of the shortest path between any two nodes in the network [START_REF]ORA-Lite[END_REF]. It is reflective of the number of indirect nodes that are connected to that node. To demonstrate the rationale behind using betweenness centrality as an indicator of risk to both integrity and confidentiality, consider a department with a "go-to" individual. This individual will likely have access to greater amounts of information than is ideal, and would be in a position to alter the information flowing through the network. Furthermore, as nodes with high betweenness measures tend to act as brokers, this individual may be seen as a trustworthy shortcut to obtain information in the network, which places it in a position to obtain greater amounts of information, as well as manipulate information as it flows through the network.

The final member of the triad, availability, deals with the ability to access the data in a timely manner. Availability is often at odds with both confidentiality and integrity, as systems meant to protect availability and confidentiality often impact on the availability of the data. With regards to SNA, one of the metrics that may identify a high risk node in terms of availability is the one that identifies a node as a boundary spanner. A boundary spanner is a node that, if removed, will cause one part of the network to become completely isolated [START_REF] Cormen | Introduction to algorithms second edition[END_REF], thereby negatively impacting the availability of information in certain parts of the network.

The final SNA metric to be mentioned here is eigenvector centrality. Eigenvector centrality measures the extent to which a particular node is connected to highly connected nodes [START_REF] Armstrong | Organizational risk using network analysis[END_REF]. Nodes that have a high eigenvector measure are considered to possess emergent leadership properties [START_REF] Borgatti | Centrality and network flow[END_REF] and may be considered a potential risk to confidentiality, integrity, and availability. For example, consider the impact an informal leader can have on information in a network. Confidential information may be shared with such a node as a result of the connections with highly connected nodes, whereas the integrity of the data in the network may be impacted by the additional knowledge the node obtains. Availability may also be impacted negatively if the emergent leader convinces other nodes to delay the flow of information, or if the information is redirected through the network along suboptimal routes. A summary of the SNA metrics discussed, and how they relate to the CIA triad, is given in Table 1. It should be emphasised that, while this brief discussion focussed on each member of the CIA triad individually, confidentiality, integrity, and availability are all interconnected. It is possible, for instance, for a significant enough increase in confidentiality to result in a significant reduction in availability. This is also true for the relationship between confidentiality and integrity, and the relationship between integrity and availability. The goal is typically to find a balance between these three aspects that is appropriate to the particular situation. This interrelatedness should be kept in mind when evaluating risks using SNA, as well as when selecting controls to address these risks.

From this short discussion it is clear that SNA metrics can be used to identify and possibly evaluate risks in terms of the CIA triad. The use of SNA metrics as input data for a SOM is therefore appropriate, and its use in this manner may help to identify and visualise risks in an organisation. This should help to improve overall awareness of risks in the organisation, aid in training managers, and may even help to determine overall preventative measures. The application in the rest of the paper uses the five SNA metrics discussed in this section as input for a SOM.

Method

The study was conducted using data provided by a manager from a large company that deals with risk evaluation. The data are confidential, and were subsequently anonymised prior to publication. Using this data, a network was built that describes the relationship between various entities. This network is shown in Fig. 1.

The entities, or nodes, of the network include 26 real-world risks, 612 controls, 6 risk owners, 26 control owners, 13 risk coordinators and 12 governing bodies. The risks are those risks that the organisation has to manage, whilst the controls are those controls used to manage the risks. The risk-and control owners are ultimately responsible for the risks and controls respectively, whereas the risk coordinators ensure that the correct risks are managed using the appropriate controls. The governing bodies are responsible for determining which control is used with which risk. These bodies also determine what the probability of a risk occurring is, as well as the severity of such an occurrence. The network is undirected, as unidirectional relationships between entities such as risks and risk owners do not seem realistic.

The network data were processed using the software suite ORA-Lite [START_REF]ORA-Lite[END_REF], while the SOMs were generated using the Viscovery SOMine Suite [START_REF] Somine | [END_REF]. The data for the SOM consists of the 5 SNA metrics for each node. In total, 695 nodes are contained in the network, and a total number of 1738 links exist between them. The focus of the network is on managing real-world risks, and it was subsequently processed in a risk centric way, i.e. the relationships between the nodes are based on similar relationships to particular risks. This means that the relationship between a risk coordinator and a control owner, for example, is described only in terms of their shared relationship to the same risk. With networks of this size, the large number of metric values that are produced can be quite complex. In order to help evaluate such complex data in a simpler, graphical way, the SOM algorithm is used. The SOMs can be used to quickly identify problem areas, which should make it easier to evaluate the data. Additionally, as SOMs are graphical in nature, they can be applied iteratively to investigate how the risk in a network changes over time, or as certain controls are introduced that aim to manage those risks.

When applying this technique to training risk managers, one of the aims is to highlight certain trends or groups that may pose a natural risk in the network. In doing so, the risk manager should be better informed of the nuances of the network and may be able to introduce more effective risk mitigation measures than would have been possible otherwise. Consider, for example, a network, such as the one shown in Fig. 1, with risks, control coordinators, and controls. If a SOM is developed for the network, the manager should be able to readily identify groups of nodes that have similar risk profiles based on their clustering. If a certain grouping of controls and control coordinators are found in the same cluster, for instance, it may indicate that there is a problem with the way in which the controls are managed. Alternatively, if all of the control coordinators are grouped into one high risk cluster, it may be appropriate to introduce measures, such as policies, to address the risks posed by these nodes.

Another way in which the technique can be used in training is to monitor how the risk profile of certain clusters change when new controls are implemented to address the identified risks. As a SOM is graphical in nature, and the geographical structure of the map changes as the risk values for the nodes change, it should be possible to identify the changes in the network graphically. This is especially true for clusters that lose nodes, as the area of the map that the cluster occupies should be reduced. By using the SOMs as a graphical aid, the manager should be able to identify which approaches work best, and under which circumstances.

Results and discussion

The SOM algorithm produced a map with three regions, or clusters, when applied to the network data. This map is shown in Fig. 2 to Fig. 6. Each figure shows the same map, but with different colourations. The colourations are used to show how the values of the five measures differ for various nodes. The clusters are the same in each image, as one map, built using all five SNA metrics as node attributes, was obtained. In Fig. 2, where the boundary spanner measure is used to colour the map, the red colouration that covers most of Cluster C2 indicates that the nodes in C2 pose a significant possible risk, as the nodes in this cluster have a much higher boundary spanner value than the nodes in other clusters. A cursory evaluation of the cluster's data shows that C2 exclusively contains all of the nodes that represent the risks. It should be noted that, while the risks are all found in the same cluster for this network, this will not necessarily be the case for all networks. As the boundary spanner metric indicates that a node's removal will completely isolate a part of the network, this suggests that the current structure in the network includes nodes that will be isolated if any of the risks are resolved. The network data itself shows that these nodes are primarily controls. If, for example, the risk "Corporate Brand" is completely resolved, i.e. if the company finds itself in a situation where there is no risk at all to the company brand, then the controls that exist to manage that risk, such as "Social Media strategy and protocols" and "Expert communications resources", are no longer needed. In order to ensure that these controls are not kept in place unnecessarily, additional measures need to be implemented. The colouration, based on the total degree centrality, used on the SOM in Fig. 3 shows that there is an area in cluster C2 where the nodes have unusually high total degree centrality values, which is associated with a higher level of risk to integrity. Of the nodes in C2, there are six nodes, indicated by the red area in C2, that have a significantly higher amount of total degree centrality than the rest of the nodes. These nodes are the risks "Forest fires", "Environmental impacts", "Interruption to supply networks", "Waste Treatment Capacity", "Urban Resource Capacity", and "Rural Resource Capacity". All of these risks can have a significant impact if realised, which is why the influence they have is so substantial. This also means that any errors with regards to these risks, such as the risk of forest fires being over-or underemphasised, can have a significant impact on the information that is ultimately used in the network to manage other risks. If, for example, the integrity of the information with regards to the chances of a forest fire occurring is compromised, then there may not be enough water available to address the fire. If the fire affects any industrial assets, this may have environmental impacts, which in turn could negatively affect the company's corporate brand image.

To protect the integrity of the information of these nodes, additional controls should be implemented.

An area with values much higher than the surrounding areas is shown to be present in cluster C3 in both Fig. 4 and Fig. 5. This area, which is situated on the left hand side of cluster C3 where it borders Cluster C2, is coloured green in Fig. 4 and green, orange, and red in Fig. 5. Additionally, a hotspot is present on the border between C1 and C2, as shown in Fig. 4. While the nodes in the hotspot area between C1 and C2 certainly pose a risk to confidentiality, the section of C3, where the nodes have much higher values for closeness centrality and eigenvector centrality than the rest of the nodes in the cluster, warrants further investigation. The higher closeness centrality measure of these nodes, shown in Fig. 4, suggest that they are a risk to confidentiality, whereas the very high eigenvector centrality measure shown in Fig. 5 indicate that they are an overall risk. There are two nodes in particular that fall into this region, one being a risk owner that is responsible for 11 out of the 26 risks, and the other being a risk coordinator that is responsible for 6 risks. The remainder of C3 is low risk and, as both of these nodes are in the cluster, it intimates that the risk posed by this risk owner and risk coordinator could be alleviated by reducing the number of risks that they are responsible for. Some of the risks could be transferred to other risk owners and coordinators. Alternatively, the risks can be co-owned and co-coordinated with owners and coordinators that are responsible for a smaller number of risks.

With the exception of the small area of low risk in C3, Fig. 4 shows that most of the nodes in the network have a high measure of closeness centrality. This suggests that controls should be in place to protect the confidentiality of the information in the network in general, as almost any one of the nodes could be responsible for compromising confidentiality.

Fig. 6 highlights the existence of a single hotspot that exists in cluster C1 with regards to betweenness centrality. The hotspot, which is situated on the left hand side of C1 and has a red colour, contains a single risk coordinator, which poses a risk to both the integrity and the confidentiality of information in the network. In order to resolve this risk, the dependence on the specific risk coordinator should be reduced. The dependence of the risk coordinator can be reduced in one of at least two ways. The first method involves transferring some of the coordinator's responsibilities, such as risks, to another coordinator. This coordinator should preferably be located in cluster C1, as such a coordinator is likely to have a similar amount of power and influence. The second method that could be used is to employ an additional risk coordinator to take over some of the duties. This coordinator could also assume some of the duties of the risk coordinator in C3, thereby reducing the risk of two nodes simultaneously.

Based on all the SOMS shown in Fig. 2 to Fig. 6, there are six risks, two risk coordinators, and a risk owner that pose potential risks to the overall security of information in this network. From this discussion, the advantage of using the SOM method to visualise SNA metric data is clear: by using SOMs to visualise SNA metric data, a relatively simple process can be followed in order to evaluate the risks in a network. The advantages are especially clear when compared to the process that would be needed in order to evaluate the risks in a network, such as the one shown in Fig. 1, or when using only raw data and statistical analysis. The use of SOMs in this manner gives managers the opportunity to evaluate risks graphically, as well as to compile risk discussion reports that do not require any prior knowledge of SOMs or SNA. This, in turn, could help improve the nature and quality of risk management, as a greater number of options and plans could develop as a result. Furthermore, SOMs allow for a way to systematically identify risks, and can also be used to monitor the progress and impact of risk mitigation strategies. Depending on the situation, it may be possible to identify positive or negative changes in the network almost instantaneously using this method. The central premise, i.e. that SOMs can be used to visualise SNA risk data, and in turn help educate managers of risks in their organisation in a quick and simple way, is therefore feasible.

Conclusion

Information security risk management is one of the most crucial parts of information security, but it is often complicated by the complexity of most organisational systems.

In order to simplify the task of identifying risks in an organisation, SOM can be used to identify possible risks in an organisation by visualising SNA metric data of the organisation. A SOM, which clusters similar entities into geographically separate regions, is relatively simple to evaluate due to its graphical nature. When compared to other risk identification techniques that employ SNA metrics, which may require risk managers to process and evaluate large tables of numbers, the use of SOM may reduce the amount of work needed, as entities that pose a threat to the organisation can be identified with relative ease. Additionally, as a SOM is easier to evaluate, inexperienced risk managers may find the use of SOM less daunting than to use numerical data and statistical analysis. Finally, as a SOM provides an additional level of information that may not be readily apparent from the data, it could aid in educating risk managers of dangers in the organisation that may not be known, or obvious.

Fig. 1 .

 1 Fig. 1. Social network showing relationships between risks (blue), risk controls (purple), risk coordinators (yellow), risk owners (orange), control owners (pink) and the governing bodies (green) responsible for appointing the various role-players.

Fig. 2 .Fig. 4 .Fig. 5 .Fig. 6 .

 2456 Fig. 2. SOM (boundary spanner) Fig. 3. SOM (total degree centrality)

Table 1 .

 1 SNA metrics in the context of Information Security

		CIA
	SNA Metric	Triad	Rationale
		C I A
	Total degree centrality	X	Nodes with a high total degree centrality have influence in the net-work and are connected to a significant portion of the network.
	Closeness cen-trality	X	Nodes with a high closeness centrality have access to a significant amount of information in the network.
	Betweenness centrality	X X	Nodes with a high betweenness centrality may be prone to infor-mation brokering and tampering.
	Boundary spanner	X	If a boundary spanner node is removed, an entire section of the net-work becomes isolated
	Eigenvector centrality	X X X	Nodes with a high eigenvector centrality are considered emergent leaders and, depending on their influence and attitude, may be a gen-eral risk, depending on the circumstances


Lynn Futcher
email: lynn.futcher@mandela.ac.za

Johan Van Niekerk
email: johan.vanniekerk@mandela.ac.za

An Educational Intervention for Teaching Secure Coding Practices

Keywords: Educational Intervention, Secure Coding Practices, OWASP, Web Application Security

Cybersecurity vulnerabilities are typically addressed through the implementation of various cybersecurity controls. These controls can be operational, technical or physical in nature. The focus of this paper is on technical controls with a specific focus on securing web applications. The secure coding practices used in this research are based on OWASP. An initial investigation found that there was a general lack of adherence to these secure coding practices by third year software development students doing their capstone project at a South African University. This research therefore focused on addressing this problem by developing an educational intervention to teach secure coding practices, specifically focusing on the data access layer of web applications developed in the .NET environment. Pre-tests and post-tests were conducted in order to determine the effectiveness of the intervention. Results indicated an increase in both knowledge and behaviour regarding the identified secure coding practices after exposure to the intervention.

Introduction

With the recent increase in cyber-related attacks, cybersecurity is becoming a key area of concern for many organisations. Web applications often handle very sensitive data, used for carrying out critical tasks such as banking, online shopping and online tax filing [START_REF] Deepa | Securing web applications from injection and logic vulnerabilities: Approaches and challenges[END_REF]. These applications are trusted by billions of users for performing such daily activities. However, 75% of all attacks on the internet are executed through the application layer of the OSI model [START_REF]A CISO ' s Guide to Application Security[END_REF], and more than 76% of web applications have vulnerabilities [START_REF] Chandrasekar | [END_REF]. Handling risks related to the security of web applications is a major challenge for many organizations. Not surprisingly, Web applications have recently received attention from academia and industry to initiate some defence mechanisms to protect them from security threats [START_REF] Deepa | Securing web applications from injection and logic vulnerabilities: Approaches and challenges[END_REF]. Many of these Web applications have common vulnerabilities which can be easily corrected [START_REF] Zhu | Supporting secure programming in web applications through interactive static analysis[END_REF] through introducing secure coding practices. The secure coding practices used in this research are based on OWASP. An initial investigation found that there was a general lack of adherence to these secure coding practices by third year software development students doing their capstone project at a South African University. This research therefore focused on addressing this problem by developing an educational intervention to teach secure coding practices, specifically focusing on the data access layer of web applications developed in the .NET environment. The following section highlights the related literature, while Section 3 provides the research design. Section 4 presents the educational intervention including both the knowledge and behavioural components. This is followed by Section 5 which provides the results of the verification of the educational intervention before concluding in Section 6.

Related Literature

More than 90,000 vulnerabilities have been recorded in the Symantec comprehensive vulnerability database over the past two decades, from 24,560 vendors representing over 78,900 products. On average, over 340,000 web attacks were blocked from web applications per day in 2014 [START_REF] Chandrasekar | [END_REF]. Although this improved to 229,000 in 2016 [START_REF] Chandrasekar | [END_REF], it still remains a serious concern since most attacks are no longer on the networks, but more on the software applications that run on the application layer. If 76% of web applications contain known vulnerabilities, it means that 24% of the scanned web applications do not contain known vulnerabilities. Therefore, it is possible for web applications to avoid known vulnerabilities. Those web applications without known vulnerabilities probably adhere to some form of best practice for secure software development. This is true as some researchers suggest that applying such practices and methodologies can improve security in software application [START_REF] Bishop | Evaluating secure programming knowledge[END_REF][START_REF] Dark | Teach the Hands, Train the Mind[END_REF]. There are various organisations and institutions responsible for developing standards and best practices. These include the National Institute of Standards and Technology (NIST), the International Organizations for Standardization (ISO) and the International Electro-Technical Commission (IEC), the Microsoft Developer Network (MSDN) and the Open Web Application Project (OWASP) which provides best practices for improving security in web applications. The best practices provided by these organisations were evaluated and OWASP was considered the most relevant for identifying fundamental secure coding practices to be taught to software developers. OWASP is known by many organisations for its Top 10 Vulnerability List (Table 1) that it publishes and updates periodically [START_REF] Chung | What approaches work best for teaching secure coding practices?[END_REF][START_REF]A CISO ' s Guide to Application Security[END_REF][START_REF] Li | A survey on server-side approaches to securing web applications[END_REF]. This list focusses on identifying the most serious web ap-plication security vulnerabilities for many organisations [START_REF][END_REF]. The Top 10 list changes according to which vulnerability is most dominant at any given time. The risk posed by each of these vulnerabilities can be reduced by more than one type of control. For the data access layer within .NET, OWASP recommends specific secure coding practices. Table 2 presents the nine secure coding practices (SP1 to SP9) for data access based on OWASP and used in this study. These relate to some of the vulnerabilities shown in Table 1. As an example, parameterised SQL commands (SP1), or the use of stored procedures (SP6), can block SQL injections. Therefore more than one control can reduce a vulnerability. The secure coding practices shown in Table 2 are referred to using the codes SP1 to SP9 throughout this paper. If one of them is not properly handled, it can be easy for an attacker to access and modify information that is in the database. For example, if the connection string is found in other parts of the application code and not locked in the configuration file, it can be easy for an attacker to access the information using the same connection string to connect to the database. Or, if the expected values in an input field are not whitelisted in a system with concatenated SQL strings, attackers can use characters to manipulate the SQL string in the database and the information would be at risk. These vulnerabilities cannot be prevented by programmers unless they know the types of flaws that exist in their code [START_REF] Bishop | Evaluating secure programming knowledge[END_REF][START_REF] Chi | Teaching Secure Coding Practices to STEM Students[END_REF]. Similarly, they cannot implement these security controls unless they are taught how they work [START_REF] Dark | Effect of the secure programming clinic on learners' secure programming practices[END_REF]. Once software developers have been taught about secure coding practices, it is more likely that they will have the requisite knowledge [START_REF] Conklin | A graduate level assessment course: A model for safe vulnerability assessments[END_REF]. However, there has to be some form of compliance instrument to monitor their adherence, since it is known that people with the requisite knowledge do not always behave accordingly. Therefore, an educational intervention that focuses on both knowledge and behaviour was developed and provided to software development students to improve the security of their web applications.

Research Design

This research was conducted in the School of Information and Communication Technology at a comprehensive institution in South Africa, offering both degrees and vocational qualifications. In this case, the sample was drawn from students registered for their third year in the National Diploma: Software Development. In South Africa, there are no locally recognised curricular guidelines for computing. Many universities therefore rely on the recommendations provided in global computing curricular publications. The Association of Computing Machinery (ACM) Information Technology curricular guidelines have been used to model IT qualifications. The IT2008 and the more recent IT2017 curricular guidelines require students in computing and engineering disciplines to engage in a capstone project during their final year of study [START_REF] Lunt | Curriculum guidelines for undergraduate degree programs in Information Technology[END_REF][START_REF] Lunt | Information Technology Curricula[END_REF]. Since the diploma is a three year qualification, students are required to complete a capstone project in their third year of study. These capstone projects take place over a full year of study. According to the ACM IT curricular guidelines, capstone projects should typically adhere to the following [START_REF] Lunt | Curriculum guidelines for undergraduate degree programs in Information Technology[END_REF][START_REF] Lunt | Information Technology Curricula[END_REF]:

-Project groups of 3 to 5 students; -Based on a real-world problem; -Must be integrative; -Students should have completed most of the curriculum before attempting the project.

Students registered for the diploma are introduced to programming and business application systems development. Therefore, most of their capstone projects focus on developing applications for solving real world problems using business applications. When students choose the capstone projects, many of them focus on web, mobile or gaming applications, while a few develop desktop applications.

Although students are taught specifically to develop software in a Windows environment using the .NET framework, students may develop their capstone projects in the programming language of their choice. Most project students choose web applications in the .NET development environment as this is where their skills lie.

This research focused on two aspects relating to secure coding practices, namely knowledge and behavioural compliance of the students and involved four main phases:

-Phase 1 was the first phase for this research which started off by analysing students' behaviour relating to secure coding practices. This was done by conducting a code review on previously completed third year capstone projects, which were developed in the .NET environment. The results for this behavioural analysis indicated low levels of compliance to the identified secure coding practices. -Phase 2 addressed the knowledge assessment phase for this research, which assessed students' knowledge relating to secure coding practices. This was achieved using a questionnaire, which served as a pre-test for this study.

Results from the pre-test indicated that students lacked knowledge relating to secure coding practices. Therefore, students lacked in both the knowledge and behavioural aspects. -Phase 3 comprised of an educational intervention for addressing both the knowledge and behavioural aspects, which students lacked in Phase 1 and 2. In terms of the knowledge aspect, students were provided with online lessons relating to secure coding practices to work through; in terms of the behavioural aspect, students were given a checklist to check their application code against the listed secure coding practices. -Phase 4 involved the verification of the educational intervention for this research. The first part of this phase was the knowledge verification (Phase 4A), and the second part was the behavioural verification (Phase 4B).

The results for Phase 1 and 2 were published in the 2017 Human Aspects in Information Security and Assurance (HAISA) conference [START_REF] Mdunyelwa | Secure coding practices in the software development capstone projects[END_REF]. The focus of this paper is therefore on Phases 3 and 4. The following section describes the educational intervention (Phase 3), while Phase 4 (A and B) are discussed in Section 5.

Educational Intervention

The educational intervention was split into two parts, where the first part focused on the knowledge, and the second part focused on the behaviour of students relating to secure coding practices. Owing to the lack of knowledge on the part of the students, the researcher realised the need to create a knowledge component that could assist students in acquiring the requisite knowledge regarding secure coding practices. The need to address behavioural compliance was also realised since it is known that having knowledge does not necessarily ensure that people would behave accordingly [START_REF] Vroom | Towards information security behavioural compliance[END_REF]. Both the knowledge and behavioural components of this research were designed using the identified secure coding practices in Table 2.

Knowledge Component

The knowledge component for this research took the form of a blended learning course, called the Web Application Security Course, that students worked through to improve their knowledge regarding secure coding practices.

Design of the Knowledge Component

The knowledge component for this research included online lessons that the researcher designed using the identified secure coding practices. For each of the secure coding practices, their importance and the security implications if they were ignored were explained. The online learning platform that was used to design the lessons was the Moodle Learning Management System that runs on the university's website. Moodle is a learning management system used by educators to create effective blended learning material for students in various higher educational institutions. Moodle has been adopted by many institutions for its cost effectiveness, its ability to expand with increased student populations, and its ability to meet the needs of institutions, students and educators [START_REF] Florian | Understanding by Design , Moodle , and Blended Learning : A Secondary School Case Study[END_REF]. Figure 1 provides an overview of the process followed by the students when completing the online lessons on Moodle. The lessons took the form of interactive Microsoft PowerPoint slides, which were converted to videos, for students to work through. Each secure coding practice was addressed in a single lesson. After completing each lesson, the students were required to take a quiz, which allowed them to reflect on the content of the lesson. The quiz had four questions assigned to each lesson. The students had to answer only one randomly generated quiz question before continuing to the next lesson. If the student selected the incorrect answer, they were required to work through the lesson again, and if they selected an incorrect answer once again, a different question would be randomly generated. Alternatively, if they selected the correct answer, they were allowed to continue to the next lesson. A brief overview of each secure coding practice (SP1 to SP9) as listed in Table 2, within the knowledge component follows:

-SP1 (Using Parameterised SQL commands): The content for this secure coding practice firstly provides the background relating to parameterised SQL commands in order to equip students with the necessary information relating to this secure coding practice. The remainder of the lesson shows the students how parameterised SQL commands can be implemented in their code, and why it is necessary to use them. The content first provides detail about the importance of connection strings, and how they should be handled when developing web applications, providing detail on how to implement both the secure coding practices. -SP9 (Encryption): For this secure coding practice, an analogy is used to explain the concept of encryption to the students. The lesson further explains the analogy to clarify the concepts for the students. Since OWASP provides recommendations relating to acceptable encryption algorithms, the content for this lesson also emphasises the use of the encryption algorithms recommended by OWASP when developing web applications.

All the lessons were followed by a quiz question to check students' understanding of the content contained in the lesson they had worked on. The results for the short content quizzes were not recorded, since answers were simply used to ensure that students do not move to the next lesson without understanding the content in the previous lesson.

Administering the Knowledge Component The Web Application Security lessons were prepared by the researcher and distributed to the students on Moodle. The students were permitted to work through the lessons as often as they wanted. During a lecture, the researcher explained the process that the students needed to follow when completing the online content. Most students worked through the content in the computer laboratories at the university as soon as it was made active and available to them. A total of 120 students completed the online lessons. The students had to work through all the lessons, since they were required to take a quiz which served as a Post-test (Phase 4A) for which marks were recorded.

Behavioural Compliance Monitoring Instrument

Although it is possible for a student to have the requisite knowledge and not perform accordingly when developing their web applications, it is most unlikely for them to behave accordingly when they do not have the requisite knowledge. Therefore, it was deemed necessary to firstly educate the students on secure coding practices and then to monitor their adherence to these practices. This section provides details on how the behaviour of students was monitored when developing their web applications as part of their third year capstone projects.

Design of Behavioural Compliance Instrument

The behavioural compliance instrument took the form of a checklist as seen in Table 3. The code review checklist for this research was adapted from the secure coding practices in Table 2 and was provided to the students electronically via Moodle. Conducting the Behavioural Compliance Instrument During a lecture the researcher explained to the students how they should go about using the checklist to review their capstone projects. They were required to check all web forms accessing the data access layer against the secure coding practices for SP1 to SP9 using the checklist provided in Table 3. Having worked through the knowledge component, as discussed in Section 4.1, the students should have acquired the requisite knowledge relating to the secure coding practices that should be implemented in their web applications. Since most students worked in groups when developing their web applications, they were also required to conduct a peer code review on each other's web forms using the checklist provided. The peer code review helped the students to double check whether they had really adhered to the secure coding practices as indicated in their own code reviews. Feedback from the students was positive and most students found the checklist helpful for their code and to ensure compliance to the secure coding practices.

Effectiveness of the Educational Intervention

Once students had completed the educational intervention, it was necessary to determine its effectiveness. The knowledge component of the educational intervention was responsible for providing students with knowledge regarding secure coding practices. Having completed the online course, the students were expected to implement the learnt secure coding practices in their capstone projects, showing behavioural compliance. The verification of the knowledge component was achieved through an online quiz distributed to the students through the Moodle site as discussed in Section 5.1. Verification of the behavioural compliance component took the form of a code review by the researcher on the students' capstone projects as discussed in Section 5.2.

Knowledge Verification

The setup for the post-test questionnaire was such that students were only allowed to work through the post-test after they had completed the lessons in the knowledge component of the educational intervention, referred to as the Web Application Security Course. The 113 students who completed the posttest were only allowed to work through the post-test once. The results for the post-test questionnaire were automatically recorded on the Moodle site, where the researcher was able to export the data to an Excel spreadsheet for analysis. A comparison of the knowledge pre-and post-test is shown in Table 4. Table 4 shows the results for Phase 2, Knowledge Assessment (pre-test), and Phase 4A, Knowledge Verification (post-test). There was a substantial im-provement in the students' knowledge as indicated in the second row, Phase 4A. Students' knowledge has improved in all of the secure coding practices (SP1 to SP9), as seen in the variances. SP2, SP3, SP5 and SP7 showed reasonable improvements, while SP8 and SP9 showed the highest improvements with variances above 80%. As mentioned previously, knowledge acquisition does not guarantee a change in behaviour. In order to monitor the adherence of the students to these secure coding practices when developing their web applications behavioural compliance monitoring was required.

Behavioural Verification

The behavioural verification instrument used was the same checklist used in Phases 1 and 3 as shown in Table 3. The checklist was used by the researcher to conduct a code review on the third year capstone projects. The code review was conducted by the researcher before the final submission of the software development projects. The researcher first informed the students about the code review process scheduled to take place during a session in the computer laboratory. Students filled in their group names and were required to be in the computer laboratory in order for their projects to be reviewed. The code review was conducted during the students' practical sessions. For each of the capstone projects, the researcher reviewed five web forms per project, which connected to the database and were related to the capstone projects' main functionality. 17 groups were present for the code review, and they were all reviewed successfully, in the presence of the students who belonged to the group being reviewed. Table 5 shows the results from the behavioural analysis for the students before and after exposure to the educational intervention. As can be seen from the results in Table 5, there was an improvement in students' adherence to secure coding practices after the educational intervention, with most capstone project groups having adhered to all the secure coding practices. Although SP5 and SP7 were recommended by OWASP, they were not required by the capstone projects from which the sample for this research was drawn. All averages per secure coding practice were between 90% and 100%, with SP3, SP8, and SP9 showing 100% compliance. SP6 and SP9 showed the largest improvements of 58%(SP6) and 69%(SP9) respectively, while SP3, SP4 and SP8 showed good improvements of between 20% and 35%.

The results of this study indicate that students' adherence to secure coding practices can be positively impacted through a formal educational intervention. However, it is important that such an intervention addresses both the knowledge and behaviour of students since having the requisite knowledge does not ensure compliance. It is for this reason that a behavioural compliance monitoring instrument formed part of the study. This is a step towards educating students in secure application development which is essential in addressing the many security vulnerabilities existing in Web applications today. Limitations of this study do exist. Firstly, this study addressed only the identified secure coding practices which were determined from OWASP. Secondly, the identified secure coding practices only focused on the data access layer of Web applications developed in the .NET environment. Future research could investigate similar interventions within various other application development contexts.

Ethical Considerations

This research project adhered to all ethical requirements of the Nelson Mandela University and obtained ethics approval from the university research committee (REF H15-ENG-ITE-009).

Table 1 :

 1 OWASP Top 10 Vulnerability List 2017[START_REF]OWASP Top 10[END_REF].

	Vulnerability	Description
	SQL Injection	Injection flaws occur when untrusted data is sent to an inter-
		preter as part of a command or query.
	Broken Authentica-	This relates to authentication and session management that are
	tion	often implemented incorrectly. It allows attacks to compromise
		information, and session tokens or exploit other implementation
		flaws.
	Sensitive Data Expo-	Many web applications and Application Programming Interfaces
	sure	(APIs) do not properly protect data allowing attackers to steal
		or modify data.
	XML External Enti-	External entities can be used to disclose files using the file Uni-
	ties	form Resource Identifiers (URIs) handler, internal file shares,
		internal port scanning, remote code execution, and denial of
		service attacks.
	Broken Access Con-	Restrictions on what authenticated users are allowed to do are
	trol	often not properly enforced, allowing attackers to exploit flaws
		to access unauthorized functionality, or data, such as other users'
		accounts or change access rights.
	Secure Misconfigura-	This is mostly a result of insecure default configurations, incom-
	tion	plete or ad hoc configurations.
	Cross-Site Scripting Also know as XSS, it allows attackers to execute scripts in the
		victim's browser which can hijack user sessions, deface web sites,
		or redirect users to malicious sites.
	Insecure Deserialisa-	Insecure deserialisation leads to remote code execution, deserial-
	tion	isation flaws can also be used to perform tasks such as injection
		attacks, and privilege escalation attacks.
	Using Components	Components including libraries, frameworks and other software
	with Known Vulner-	modules, run with the same privileges as the application. If a
	abilities	vulnerable component is exploited, such attacks can facilitate
		serious data loss or server take over.
	Insufficient Logging	This allows attacks to further attack systems, maintain persis-
	and Monitoring	tence, pivot to more systems, and temper, extract, or destroy
		data.

Table 2 :

 2 Secure Coding Practices. Adapted from[START_REF][END_REF].

	SP	Secure Coding Practices
	SP1	Use Parameterised SQL commands for all data access, without exception.
	SP2	Do not use SQL command with a string made up of a concatenated SQL
		strings.
	SP3	Properly validate input fields.
	SP4	Apply the Principle of Least Privilege when setting up the database of your
		choice.
	SP5	When using SQL Server, prefer integrated authentication over SQL authenti-
		cation.
	SP6	Using stored procedures is the most effective way to counter the SQL injection
		vulnerability.
	SP7	Encrypt connection strings.
	SP8	Connection strings should be based in a configuration file.
	SP9	Encrypt sensitive data using acceptable encryption algorithms.

  -SP2 (Concatenated SQL strings): Content for this secure coding practice begins by introducing what is meant by concatenated SQL strings. The lesson proceeds by showing how programmers make use of concatenated SQL strings and the negative implications of using them. This lesson also provides a way in which to avoid using concatenated SQL strings, which is by means of parameterised SQL commands. -SP3 (Input validation): The content for this secure coding practice begins by discussing validation in general. It also highlights the various types of validation, such as blacklisting and whitelisting, and why they are important. The content also provides suggestions on what to use when dealing with validation, for example, ASP.NET Regular Expressions to tell input fields which values to accept. -SP4 (Principle of Least Privilege): This secure coding practice content explains what the Principle of Least Privilege is and why it is important when developing web applications. This content also provides a scenario where the use of this secure coding practice is shown and how it can be implemented. -SP5 (Authentication): The content of this secure coding practice was addressed by means of a video adapted from YouTube. The video was embedded in the slides and distributed as a single lesson to the students to listen to and to watch. -SP6 (Using Stored Procedures): The content for this secure coding practice focusses on how stored procedures are used and why they are important, providing examples on how they should be implemented in a web application. -SP7 + SP8 (Connection strings): These two secure coding practices both deal with connection strings, and have been addressed collectively in the same lesson.

Table 3 :

 3 Code Review Checklist.

	SP	Questions
	SP1	Do they make use of parameterised SQL commands for all data access? Yes /
		No (Number of Instances)
	SP2	Do they make use of concatenated strings in the queries? Yes (Number of
		Instances) / No
	SP3	Are all input fields validated? Input Properly Validated / Input not Properly
		Validated / No Validation
	SP4	Do they make use of the Principle of Least Privilege when setting up their
		databases? Yes / No
	SP5	Do they use integrated authentication or do they use SQL authentication?
		Integrated Authentication / SQL Authentication
	SP6	Do they use stored procedures for their queries? Yes / No / Inconsistent Use
		of Stored Procedures and Queries
	SP7	Do they encrypt their connection strings? Yes / No
	SP8	Does the connection string only appear once in the web.config file? Yes / No
	SP9	Is all the sensitive data being encrypted using the OWASP recommended
		methods? Encrypted Using Acceptable Method / No Encryption / Encrypted
		Not using Acceptable Method

Table 4 :

 4 Knowledge Assessment and Verification Results (Pre-Test vs Post-Test).

	Phases	SP1 SP2 SP3 SP4 SP5 SP6 SP7 SP8 SP9
	Phase 2	74%	36%	30%	58%	26%	39%	20%	3%	1%
	Phase 4A	95%	95%	89%	91%	91%	77%	93%	88%	83%
	Variance	21% 59% 59% 33% 65% 38% 73% 85% 82%

Table 5 :

 5 Behavioural Verification Results (Phase 1 and 4B).

	Phases	SP1 SP2 SP3 SP4 SP5 SP6 SP7 SP8 SP9
	Phase 1	86%	84%	77%	60%	N/A 38%	N/A 68%	31%
	Phase 4B	96%	96%	100% 91%	N/A 96%	N/A 100% 100%
	Variance	10% 12% 23% 31% N/A 58% N/A 32% 69%

The financial assistance of the National Research Foundation (NRF) towards this research is hereby acknowledged. Opinions expressed and conclusions arrived at, are those of the authors, and are not necessarily to be attributed to the NRF.