Thomas Neubauer

  • Thomas NeubauerE-Mail
  • Phone: +43 (1) 505 36 88
  • Fax: +43 (1) 505 88 88

Bio

Dr. Thomas Neubauer is senior researcher at Secure Business Austria and the Institute of Software Technology and Interactive Systems (IFS) at the Vienna University of Technology. He received a Master in Business Informatics from the University of Vienna and a Master in Computer Science from the Vienna University of Technology. He wrote his PhD thesis at the Institute of Software Technology and Interactive Systems at the Vienna University of Technology. He has published numerous papers in refereed journals and at international conferences. He worked for two years in the financial sector and was consultant for the Austrian Federal Chancellery (CIO Office) and Austrian Social Security Institutions. His research focuses on the integration of security concepts into business process management (e.g., Survey Status Quo BPM), support for management decision makers in formulating a reasonable risk versus cost trade-off when investing in IT security solutions and measuring the actual level of security (z.B., Atana, Aurum). Another research focus is on the improvement of privacy enhancing technologies such as pseudonymization, especially in the field of e-health. He was granted a patent titled ‘Data Processing System for the Processing of Object Data’ in September 2007.

Publications

  • Stefan Fenz and Andreas Ekelhart and Thomas Neubauer, "Information Security Risk Management: In which security solutions is it worth investing?," Communications of the Association for Information Systems, 2011. BibTeX
    @ARTICLE{Fenz_Information_Security_Risk_Mana_2011,
      Author = {Stefan Fenz and Andreas Ekelhart and Thomas Neubauer},
      sbahotlist = {true},
      title = {Information Security Risk Management: In which security solutions is it worth investing?},
      journal = {Communications of the Association for Information Systems},
      year = {2011},
      month = {NA},
      note = {not published yet},
      }
  • Daniel Abouakil and Johannes Heurix and Thomas Neubauer, "Data Models for the Pseudonymization of DICOM Data," in Proceedings of the 44nd Hawaii International Conference on System Sciences, 2011, p. 157. BibTeX
    @INPROCEEDINGS{Abouakil_Data_Models_for_the_Pseudonymi_2011,
      Author = {Daniel Abouakil and Johannes Heurix and Thomas Neubauer},
      sbahotlist = {true},
      title = {Data Models for the Pseudonymization of DICOM Data},
      booktitle = {Proceedings of the 44nd Hawaii International Conference on System Sciences},
      year = {2011},
      month = {1},
      pages = {157},
      }
  • Kresimir Kasal and Johannes Heurix and Thomas Neubauer, "Model-driven Development Meets Security: An Evaluation of Current Approaches," in Proceedings of the 44nd Hawaii International Conference on System Sciences, 2011, p. 268. BibTeX
    @INPROCEEDINGS{Kasal_Model_driven_Development_Meets_2011,
      Author = {Kresimir Kasal and Johannes Heurix and Thomas Neubauer},
      sbahotlist = {true},
      title = {Model-driven Development Meets Security: An Evaluation of Current Approaches},
      booktitle = {Proceedings of the 44nd Hawaii International Conference on System Sciences},
      year = {2011},
      month = {1},
      pages = {268},
      }
  • Johannes Heurix and Michael Karlinger and Michael Schrefl and Thomas Neubauer, "A Hybrid Approach integrating Encryption and Pseudonymization for Protecting Electronic Health Records," in Proceedings of the Eighth IASTED International Conference on Biomedical Engineering, 2011. BibTeX | PDF
    @INPROCEEDINGS{Heurix_A_Hybrid_Approach_integrating__2011,
      Author = {Johannes Heurix and Michael Karlinger and Michael Schrefl and Thomas Neubauer},
      sbahotlist = {true},
      title = {A Hybrid Approach integrating Encryption and Pseudonymization for Protecting Electronic Health Records},
      booktitle = {Proceedings of the Eighth IASTED International Conference on Biomedical Engineering},
      year = {2011},
      month = {2},
      pdf = {2011_BioMed_A HYBRID APPROACH INTEGRATING ENCRYPTION AND.pdf},
      }
  • Stefan Fenz and Andreas Ekelhart and Thomas Neubauer, "Information Security Risk Management: In which security solutions is it worth investing?," Communications of the Association for Information Systems, vol. 28, iss. 1, pp. 329-356, 2011. BibTeX | PDF
    @ARTICLE{Fenz2011a,
      Author = {Stefan Fenz and Andreas Ekelhart and Thomas Neubauer},
      sbahotlist = {true},
      title = {Information Security Risk Management: In which security solutions is it worth investing?},
      journal = {Communications of the Association for Information Systems},
      year = {2011},
      month = {5},
      pdf = {2011 - Fenz - Information Security Risk Management In Which Security Solutions Is It Worth Investing.pdf},
      volume = {28},
      number = {1},
      pages = {329-356},
      }
  • Johannes Heurix and Thomas Neubauer, "A methodology for the pseudonymization of medical data," International Journal of Medical Informatics, vol. 80, iss. 3, pp. 190-204, 2010. BibTeX
    @ARTICLE{Neubauer_A_methodology_for_the_pseudony_2010,
      Author = {Johannes Heurix and Thomas Neubauer},
      sbahotlist = {true},
      title = {A methodology for the pseudonymization of medical data},
      journal = {International Journal of Medical Informatics},
      year = {2010},
      month = {10},
      volume = {80},
      number = {3},
      pages = {190-204},
      }
  • Stefan Fenz and Andreas Ekelhart and Thomas Neubauer, "Ontologiebasiertes IT Risikomanagement," in D.A.CH Security 2009, 2009, pp. 14-24. BibTeX | PDF
    @INPROCEEDINGS{Ekelhart_OntologiebasiertesITRisikomanagement_2009,
      Author = {Stefan Fenz and Andreas Ekelhart and Thomas Neubauer},
      title = {Ontologiebasiertes IT Risikomanagement},
      booktitle = {D.A.CH Security 2009},
      year = {2009},
      month = {1},
      abstract = {Informationssicherheitsrisikomanagement (Information Security Risk Management, ISRM) stellt einen effizienten Zugang zur Bewertung, Verringerung und Evaluierung von Informationssicherheitsrisiken dar. Bereits bestehende ISRM-Ans{\"a}tze sind weitgehend akzeptiert, setzen jedoch sehr detailliertes Informationssicherheitswissen und genaue Kenntnisse des tats{\"a}chlichen Unternehmensumfeldes voraus. Die inad{\"a}quate Umsetzung von ISRM gef{\"a}hrdet die planm{\"a}{\ss}ige Umsetzung der Unternehmensstrategie und kann zu einer Minderung des Unternehmenswertes f{\"u}hren. Der vorliegende Beitrag pr{\"a}sentiert das AURUM Tool, welches die Schwachstellen bestehender Ans{\"a}tze adressiert und Entscheidungstr{\"a}ger bei der Auswahl eines effizienten IT-Sicherheitsportfolios unter Ber{\"u}cksichtigung organisationsspezifischer, technischer und wirtschaftlicher Anforderungen unterst{\"u}tzt.},
      pdf = {2009 - Ekelhart - Ontologiebasiertes IT Risikomanagement.pdf},
      pages = {14-24},
      publisher = {Syssec},
      }
  • Stefan Fenz and Andreas Ekelhart and Thomas Neubauer, "AURUM: A Framework for Supporting Information Security Risk Management," in Proceedings of the 42nd Hawaii International Conference on System Sciences, HICSS2009, 2009, pp. 1-10. BibTeX | PDF
    @INPROCEEDINGS{Ekelhart_AURUMFrameworkSupporting_2009,
      Author = {Stefan Fenz and Andreas Ekelhart and Thomas Neubauer},
      sbahotlist = {true},
      title = {AURUM: A Framework for Supporting Information Security Risk Management},
      booktitle = {Proceedings of the 42nd Hawaii International Conference on System Sciences, HICSS2009},
      year = {2009},
      month = {1},
      abstract = {As companies are increasingly exposed to a variety of information security threats, they are permanently forced to pay attention to security issues. Risk management provides an effective approach for measuring the security through risk assessment, risk mitigation and evaluation. Existing risk management approaches are highly accepted but demand very detailed knowledge about the IT security domain and the actual company environment. This paper presents AURUM - a new methodology for supporting the NIST SP 800-30 risk management standard - and provides a comparison with the GSTool and CRISAM in order to highlight the benefits decision makers may expect when using AURUM.},
      pdf = {2009 - Ekelhart - AURUM A Framework for Information Security Risk Management.pdf},
      pages = {1-10},
      publisher = {IEEE Computer Society},
      note = {978-0-7695-3450-3},
      }
  • Stefan Fenz and Andreas Ekelhart and Thomas Neubauer, "Business Process-based Resource Importance Determination," in Proceedings of the 7th International Conference on Business Process Management (BPM 2009), 2009, pp. 113-127. BibTeX | PDF
    @INPROCEEDINGS{Fenz_BusinessProcessbasedResource_2009,
      Author = {Stefan Fenz and Andreas Ekelhart and Thomas Neubauer},
      sbahotlist = {true},
      title = {Business Process-based Resource Importance Determination},
      booktitle = {Proceedings of the 7th International Conference on Business Process Management (BPM 2009)},
      year = {2009},
      month = {1},
      abstract = {Information security risk management (ISRM) heavily depends on realistic impact values representing the resources importance in the overall organizational context. Although a variety of ISRM approaches have been proposed, well-founded methods that provide an answer to the following question are still missing: How can business processes be used to determine resources importance in the overall organizational context? We answer this question by measuring the actual importance level of resources based on business processes. Therefore, this paper presents our novel business process-based resource importance determination method which provides ISRM with an efficient and powerful tool for deriving realistic resource importance figures solely from existing business processes. The conducted evaluation has shown that the calculation results of the developed method comply to the results gained in traditional workshop-based assessments.},
      pdf = {2009 - Fenz - Business Process-based Resource Importance Determination.pdf},
      pages = {113-127},
      publisher = {Springer},
      note = {accepted for publication},
      }
  • Stefan Fenz and Andreas Ekelhart and Thomas Neubauer, "Ontology-based Decision Support for Information Security Risk Management," in International Conference on Systems, 2009. ICONS 2009., 2009, pp. 80-85. BibTeX | PDF
    @INPROCEEDINGS{Ekelhart_OntologybasedDecisionSupport_2009,
      Author = {Stefan Fenz and Andreas Ekelhart and Thomas Neubauer},
      title = {Ontology-based Decision Support for Information Security Risk Management},
      booktitle = {International Conference on Systems, 2009. ICONS 2009.},
      year = {2009},
      month = {3},
      abstract = {As e-Business and e-Commerce applications are increasingly exposed to a variety of information security threats, corporate decision makers are increasingly forced to pay attention to security issues. Risk management provides an effective approach for measuring the security but existing risk management approaches come with major shortcomings such as the demand for very detailed knowledge about the IT security domain and the actual company environment. This paper presents the implementation of the AURUM methodology into a software solution which addresses the identified shortcomings of existing information security risk management software solutions. Thereby, the presented approach supports decision makers in risk assessment, risk mitigation, and safeguard evaluation.},
      pdf = {2009 - Ekelhart - Ontology-based Decision Support for Information Security Risk Management.pdf},
      pages = {80-85},
      publisher = {IEEE Computer Society},
      }
  • Stefan Fenz and Andreas Ekelhart and Thomas Neubauer, "Automated Risk and Utility Management," in 2009 Sixth International Conference on Information Technology: New Generations, 2009, pp. 393-398. BibTeX | PDF
    @INPROCEEDINGS{Ekelhart_AutomatedRiskand_2009,
      Author = {Stefan Fenz and Andreas Ekelhart and Thomas Neubauer},
      title = {Automated Risk and Utility Management},
      booktitle = {2009 Sixth International Conference on Information Technology: New Generations},
      year = {2009},
      month = {1},
      abstract = {Information security breaches pose major threats to the reliable execution of corporate strategies and may have negative effects on business value. Information security risk management (ISRM) provides an effective approach for assessing, mitigating, and evaluating information security risks. Existing ISRM approaches are highly accepted but demand very detailed knowledge about the IT security domain and the actual company environment. This paper presents the AURUM prototype that supports decision makers in selecting security measures according to organization-specific technical and economical requirements.},
      pdf = {2009 - Ekelhart - Automated Risk and Utility Management.pdf},
      pages = {393-398},
      publisher = {IEEE Computer Society},
      }
  • Stefan Fenz and Thomas Neubauer and Bernhard Riedl and Veronika Grascher, "Pseudonymization for improving the privacy in e-Health applications," in Proceedings of the 41st Hawaii International Conference on System Sciences, HICSS2008, 2008, pp. 255-264. BibTeX | PDF
    @INPROCEEDINGS{Riedl_Pseudonymizationimprovingprivacy_2008,
      Author = {Stefan Fenz and Thomas Neubauer and Bernhard Riedl and Veronika Grascher},
      sbahotlist = {true},
      title = {Pseudonymization for improving the privacy in e-Health applications},
      booktitle = {Proceedings of the 41st Hawaii International Conference on System Sciences, HICSS2008},
      year = {2008},
      month = {1},
      pdf = {2008 - Riedl - Pseudonymization for Improving the Privacy in e-Health Applications.pdf},
      pages = {255-264},
      publisher = {IEEE Computer Society},
      note = {978-0-7695-3075-8},
      }
  • Thomas Neubauer and Christian Stummer, "Interactive Decision Support for multiobjective COTS Selection," in Proceedings of the 40th Hawaii International Conference on System Sciences, HICSS2007, 2007. BibTeX
    @INPROCEEDINGS{Neubauer_InteractiveDecisionSupport_2007,
      Author = {Thomas Neubauer and Christian Stummer},
      sbahotlist = {true},
      title = {{Interactive Decision Support for multiobjective COTS Selection}},
      booktitle = {Proceedings of the 40th Hawaii International Conference on System Sciences, HICSS2007},
      year = {2007},
      month = {1},
      }

View all publications