https://security1.win.tue.nl/groups/index.htmlThe Security Cluster consists of the following groups. The people in the cluster are listed on the Staff page. Threat Analysis We study attacker actions in order to support human analysts in finding their traces in log and alert data. This research concerns two overarching topics: Threat Intelligence, which studies attackers in their ecosystem and social engineering frontiers. Security Monitoring in a Security Operations Center, which studies analyst processes and models for log analysis. Staff Expertise Luca Allodi: Investigates attacker operations, economics, and how these are ultimately delivered to the (human) user to improve operational defense capabilities. Emmanuele Zambon: Investigates the security of Industrial Control Systems (ICS) to improve their defense capabilities. Christoffer Leite da Silva: IoT, cyber threat intelligence, anomaly detection. Peter Boosten: Networking within the small world called cybersecurity. Roelf Wichertjes: Everything and anything on the operational side of IT. Sam Baggen: Trying to keep the IT afloat. Data Protection Privacy and security of electronic data (e.g., electronic health records, financial data, demographic data) has become a hugely important issue. Access control is often employed as the first line of defense for data protection. Existing access control models and mechanisms, however, are often not suited for the challenges introduced by modern IT systems. Moreover, access control can be circumvented, for instance, by insiders exploiting policy misconfiguration or by attackers gaining unauthorized access through social engineering attacks against legitimate users. The Data Protection group aims to realize novel theories, methods, and technology that enable the realization of an adaptive authorization infrastructure capable of responding to security threats. To achieve this goal, we focus on three orthogonal and complementary research lines: Access Control, Data analytics for security, and Social Engineering.Hugoen-us