E-mail phishing attacks remain one of the most significant challenges in IT security and are often used for initial access. Many organizations rely on phishing simulations to educate their staff to recognize suspicious e-mails. Previous studies have analyzed the effectiveness of these phishing simulations, with mixed findings. However, the perception of and attitudes towards phishing simulations among staff have received little to no attention.

This paper presents findings from a study that we carried out in cooperation with a multinational company that conducted phishing simulations over more than 12 months. We first conducted a quantitative survey involving 757 employees and then qualitative interviews with 22 participants to gain deeper insights into the perception of phishing simulations and the corresponding e-learning. We could not find evidence that employees feel attacked by their organisation as previous studies suspected. On the contrary, we found that a majority (86.9 %) have a positive or very positive attitude towards phishing simulations. The interviews revealed that some employees developed new routines for e-mail processing, but most describe themselves as having become more vigilant without concrete changes. Furthermore, we found evidence that phishing simulations create a false sense of security, as the employees feel protected by them. Additionally, lack of communication and feedback can negatively impact employees’ attitude and lead to adverse consequences. Finally, we show that only a small portion of the employees who clicked on the phishing website interacted with the interactive e-learning elements, which raises questions about its objective usefulness, although they are perceived as useful.

Virtual Private Networks (VPNs) provide confidentiality and hide the original IP address. Although many VPN providers promise not to record user activity, several media reports of data breaches show that this is often not true. Tor, on the other hand, allows anonymous communication using onion routing and takes privacy and anonymity seriously, but at the cost of performance loss. What is missing is a sweet spot between VPNs and anonymization networks that supports bulk downloads and video streaming but provides countermeasures against untrusted VPN providers and Autonomous System (AS)-level attackers.

In this paper, we present OnionVPN, an onion routing-based VPN tunnel, that provides better bulk transfer performance than Tor and offers additional security features over a VPN: (1) intermediate VPN nodes see only encrypted traffic, (2) protection against AS-level attackers with a new path selection algorithm, and (3) onion services with a novel cryptographic NAT traversal algorithm using the Noise protocol framework. We analyze 118 VPN providers, systematically compare them to our requirements and show that OnionVPN is currently possible with three VPN providers. An alternative to Tor for bulk traffic could relieve the Tor network and provide a better experience for other users who need higher privacy and anonymity features.

In today's dynamic business landscape, efficient supply chain management is crucial for maintaining competitiveness and sustainability. Traditional methods often lead to fragmented processes, lack of transparency, communication gaps, and increased operational costs. This research addresses these challenges through a case study, literature review, and comparative analysis, proposing a software platform solution named SuppliFlow. The study integrates insights from various sectors, including e-commerce, to explore Digital Supply Networks, Distribution Management, Integrated Supply Chain Management, and sustainability practices aligned with the Circular Economy. It also advances the concept of Supply Chain as a Service. This research develops customizable workflows within SuppliFlow, designed to cater to specific supply chain requirements from procurement to delivery. The integration of the Beckn Protocol, an open-source data protocol, is examined for its potential to establish decentralized networks and secure transactions. The study also investigates real-time order tracking and consolidated payments for financial and data management efficiencies. A SuppliFlow prototype tailored for assembly service providers was created and tested to assess its effectiveness in standardizing procurement-to-delivery processes. The findings indicate that SuppliFlow can enhance supply chain efficiency, reduce operational costs, and improve visibility. This research contributes to supply chain management by presenting a novel approach through the development and testing of SuppliFlow. The implications suggest potential pathways for future research and practical applications in improving organizational performance in the global marketplace.

Mid-sized thermal energy storage (TES) systems, especially in the distributed sector, have received little attention for public buildings. Validation of such systems, especially for the use of multiple renewables with different operating modes using CFD simulations, is still pending. The objective of this study is to validate a CFD model for the operation of complex and mid-sized TES systems for simultaneous charging and discharging cycles to enable investigations on optimized operating modes, geometric optimizations, and predictive charging and discharging scenarios. For this purpose, the 60 m3 local heating storage of Großbardorf, Germany, was used to obtain real-time operating conditions and in-situ temperature distribution data. Charging and discharging cycles as well as combined scenarios were calculated and compared with the experimentally determined dynamics of the thermocline. Simulations were performed using the open-source tool OpenFOAM® with the single-phase transient solver buoyantPimpleFoam in laminar and turbulent modes, including ambient heat losses. Good agreement was found between simulated and experimental data, especially in the regions of layer transitions with a RMSE of 1.2 ℃ or less over the entire observation period. It is shown how the validation allows further improvements and optimizations of TES with greater confidence. In particular, for research on the efficient use of multiple, fluctuating renewable energies and the increase of self-sufficiency in the decentralized sector, a demand-optimized charging and discharging layout is presented for a mid-sized TES to be installed at the new Institute for Hydrogen and Energy Technology (iwe) at Hof University of Applied Sciences. By conducting research in facilities such as the iwe, this approach will not only create opportunities for the future deployment of renewable energy storage and related systems, but also highlight the importance of decarbonization in the decentralized sector.

Background

The Migraine Disability Assessment (MIDAS) is widely used. However, there are limited data on how much a reduction in the MIDAS score indicates a change that matters to the patient.

Methods

Data from the DMKG (i.e. German Migraine and Headache Society) Headache Registry were used to determine the minimal important difference (MID) of the MIDAS, using the Patient Global Impression of Change (PGIC) as anchor and applying average change and receiver operating characteristic curve methods.

Results

In total, 1218 adult migraine patients (85.6% female, 40.2 ± 12.8 years, baseline MIDAS 44.2 ± 47.4, follow-up MIDAS 36.5 ± 45.3) were included. For patients with baseline MIDAS >20 (MIDAS grade IV, n = 757), different methods using PGIC “somewhat improved” as anchor yielded percent change MIDs of the MIDAS between −29.4% and −33.2%. For baseline MIDAS between 6 and 20 (grades II and III, n = 334), using PGIC “much improved” as anchor, difference change MIDs were between −3.5 and −4.5 points.

Conclusions

Based on the above results, we estimated the MID of the MIDAS at −30% for patients with a baseline MIDAS >20, and at −4 points for those with a baseline MIDAS of 6–20, for a tertiary headache care population.

Trial Registration

The DMKG Headache Registry is registered with the German Clinical Trials Register (DRKS 00021081).

Background: Abnormalities in electrocortical parameters and persistence of afterimage after visual stimulation are known to occur in migraine patients. The results of studies on Contingent Negative Variation (CNV) and afterimage persistence in migraine patients suggest a link between these two phenomena and a connection to the pathomechanism of migraine.

Objectives: To date, no studies have investigated both afterimage duration and CNV parameters in the same subjects. The aim of this study was to investigate the relationship between the early component of CNV (iCNV) and the duration of the afterimage in migraine patients.

Methods: Sixty seven migraine patients from the headache center of the University of Rostock Medical Center were examined for iCNV amplitude, iCNV habituation and afterimage duration. The subjects also completed questionnaires developed for this study and the MIDAS (Migraine Disability Assessment) questionnaire.

Results: Associations were found between iCNV amplitude and afterimage duration and between habituation capacity and afterimage duration. A deficit in habituation capacity correlated with a significantly prolonged afterimage duration. Increased iCNV amplitude and prolonged afterimage duration were also significantly correlated.

Conclusion: Conclusions about the pathophysiology of migraine can be drawn from the results of this study. The results support the hypothesis of cortical hyperexcitability as a consequence of a low pre-activation level, which may be a possible contributory cause of migraine. Furthermore, they allow assessment of whether the afterimage examination, which is easier and quicker to perform than the CNV examination, can be used as a diagnostic tool or as a parameter to monitor the course of therapy in people with migraine.

IFAT München 2024

Lead-Management ist eine der großen Herausforderungen im Vertrieb, da die Neukundengewinnung immer bedeutsamer wird. Dieses essential erläutert, wie durch den parallelen Ausbau der drei Basisdimensionen: Prozesse, Menschen und Daten Lead-Exzellenz erreicht werden kann. Hierzu sind zunächst die Rahmenbedingungen zu analysieren und zu bewerten. Anschließend müssen die Prozesse in eine Prozesslandkarte eingebunden, die Kompetenzprofile den neuen Anforderungen angepasst und die Datenbasis vervollständigt werden.
Eine umfangreiche Checkliste zeigt auf, wie Unternehmen bei der Einführung oder Überarbeitung ihres bereits existierenden Lead-Managements sinnvollerweise vorgehen sollten.

Link: 

https://www.thomsonreuters.com.ar/content/dam/ewp-m/documents/argentina/es/pdf/other/concepcion-responsabilidad-civil-medica-markus-finn.pdf

Modern DRAM is susceptible to fault attacks that undermine the entire system’s security. The most well-studied disturbance effect is Rowhammer, where an attacker repeatedly opens and closes (i.e., hammers) different rows, which can lead to bitflips in adjacent rows. Different hammering strategies include double-sided, hammering two rows sandwiching a victim row, and one-location, hammering a single row. One-location Rowhammer requires no physical address information, as any location in memory is mapped to a DRAM row, and no relation between rows is required for hammering. The recently discovered Rowpress differs from Rowhammer by not hammering rows but keeping them open longer, evident by a disjoint set of affected memory locations.

In this paper, we examine the differences between four attack variants: one-location Rowhammer, a one-location Rowpress variant we developed, double-sided Rowhammer, and double-sided Rowpress on a set of 12 DDR4 modules. Our methodology is to hammer and press the exact same set of physical memory locations in all attack variants. Surprisingly, our results show that on 4 out of 12 DDR4 modules, we were only able to reproduce double-sided Rowhammer but none of the other attack variants. On 2 DDR4 modules, we were able to reproduce all attack variants. We find that the number of unique bitflip locations ranges from 161 to 15 612, when hammering the exact same set of physical memory locations. Our one-location Rowhammer attack induces roughly the same amount of bitflips as double-sided Rowhammer, however, only 61.8 % of bitflip locations overlap. We explain this by one-location Rowhammer inducing bitflips due to the Rowhammer as well as the Rowpress effect, making the differentiation of both methods difficult, therefore, calling it Presshammer. Based on our observed bitflips, we develop the first end-to-end one-location Rowpress attack. One-location Rowpress requires only minimal physical address information that an attacker can acquire through a same-row same-bank side-channel attack. Our end-to- end attack escalates to kernel privileges within less than 10 minutes.

In the face of increasing digitization, companies must make significant changes to their offerings and operations to remain competitive. This digital transformation of organizations includes a digital transformation of the workplace, which is often met with resistance from employees. While it is recognized that reducing employee resistance is crucial for organizations, there is a limited understanding of the antecedents of employee resistance in the context of digital transformation, different resistance behaviors, and potential countermeasures. Drawing on technostress and employee resistance theories, we address these research gaps. Results from two empirical studies support our central prediction that digital transformation of the workplace causes technostress, which in turn promotes passive and active resistance behaviors among employees. Additionally, we highlight that organizations can use digital literacy facilitation to reduce employee technostress and resistance.