# Dr. Alexander Krause

> IT Security Consultant & Researcher — Hannover, Germany

## About

Dr. Alexander Krause is an independent IT security consultant based in Hannover, Germany, and a researcher at CISPA Helmholtz Center for Information Security and Leibniz University Hannover (TeamUSEC research group). He specializes in usable security and privacy — the intersection of human factors and information security. His consulting is grounded in peer-reviewed scientific research, not generic checklists.

## Services

### IT Security Consulting
Strategic security consulting, risk assessment, and action planning for organizations of all sizes. From strategic planning to operational implementation. Particularly suited for organizations that process sensitive data, face regulatory requirements (NIS2, DSGVO), or want evidence-based security strategies.

### Security Concepts
Creation of professional IT security concepts: status quo analysis, threat modeling, and concrete recommendations for action. Each concept is informed by current research on how security measures work in practice — including developer workflows, authentication usability, and secret management.

### Talks & Keynotes
Expert talks on IT security topics — including scientific perspectives. For conferences, corporate events, and specialist audiences. Topics include: usable security, cryptographic agility, secret management in source code, MFA usability, and developer security practices. Each talk is grounded in current research and tailored to the audience.

### Trainings & Workshops
Hands-on trainings and interactive workshops on IT security. Individually tailored to the needs of each team. Covers security awareness, secure development practices, and organizational security culture.

## Methodology

The consulting approach combines current scientific research with practical advisory work. As an active researcher at CISPA Helmholtz Center, findings from studies on real-world security problems are brought directly into consulting engagements — evidence-based recommendations rather than generic frameworks.

Typical engagement flow:
1. Free initial consultation to assess current security posture and needs
2. Status quo analysis and threat modeling
3. Development of a tailored security concept with concrete recommendations
4. Implementation support and follow-up

## Credentials

- Dr. rer. nat. in Computer Science (2025, grade 1.0) — CISPA, Leibniz University Hannover
- M.Sc. in Computer Science (2021, grade 1.0 with distinction) — Leibniz University Hannover
- B.Sc. in Computer Engineering (2019) — Leibniz University Hannover
- 5+ years of experience in security research, 10+ publications at A* conferences
- Active researcher at CISPA Helmholtz Center for Information Security
- Contributor to EU project DAISEC2.0
- Supervisor of Bachelor and Master theses in usable security

## Research Interests

- Usable Security & Privacy
- Code Secret Leakage (accidental credential exposure in source code repositories)
- Cryptographic Agility (migrating and updating cryptographic implementations)
- Multi-Factor Authentication Usability
- Developer Security Practices
- Security in Game Development

## Selected Publications (Full Abstracts)

### An Analysis of the Security, Usability, and Automation Capabilities of Password Update Processes on Top-Ranked Websites
**Authors:** Alexander Krause, Jacques Suray, Lea Schmüser, Marten Oltrogge, Oliver Wiese, Maximilian Golla, Sascha Fahl
**Venue:** SOUPS 2026 (CORE rank A)
**Abstract:** Password updates are a critical part of the password lifecycle and are recommended after a password has been reused or potentially compromised. In this work, we present the first systematic, in-depth analysis of password update processes on 111 top-ranked websites and examine their security, usability, and automation capabilities for password managers. Many processes turn out to be complex, inconsistent, and hard to automate, and we derive recommendations for web developers, the standardization community, and security researchers.
**URL:** https://www.usenix.org/conference/soups2026/presentation/krause

### "That's my perspective from 30 years of doing this": An Interview Study on Practices, Experiences, and Challenges of Updating Cryptographic Code
**Authors:** Alexander Krause, Harjot Kaur, Jan H. Klemmer, Oliver Wiese, Sascha Fahl
**Venue:** USENIX Security 2025 (CORE rank A*)
**Abstract:** Keeping cryptographic code up to date and free of vulnerabilities is critical for overall software security. We conducted an interview study with 21 experienced software developers to understand their experiences, approaches, challenges, and needs regarding cryptographic updates. Our findings reveal that cryptographic updates are rarely proactive, often blocked by organizational inertia and missing tooling. Developers report a tension between security urgency and business continuity, and current tools provide insufficient support for safe migration paths.
**URL:** https://www.usenix.org/conference/usenixsecurity25/presentation/krause

### Pushed by Accident: A Mixed-Methods Study on Strategies of Handling Secret Information in Source Code Repositories
**Authors:** Alexander Krause, Jan H. Klemmer, Nicolas Huaman, Dominik Wermke, Yasemin Acar, Sascha Fahl
**Venue:** USENIX Security 2023 (CORE rank A*)
**Abstract:** Leaking code secrets (API keys, passwords, cryptographic keys) to public repositories can have disastrous consequences. We conducted a mixed-methods study combining 14 in-depth semi-structured interviews with a survey of 109 developers to understand how developers handle leaked secrets in repositories. We found that most developers are aware of the risks but lack systematic strategies for detection, remediation, and prevention. Many rely on ad-hoc approaches and manual reviews rather than automated tooling.
**URL:** https://www.usenix.org/conference/usenixsecurity23/presentation/krause

### Skipping the Security Side Quests: A Qualitative Study on Security Practices and Challenges in Game Development
**Authors:** Philip Klostermeyer, Sabrina Klivan, Sandra Höltervennhoff, Alexander Krause, Niklas Busch, Sascha Fahl
**Venue:** ACM CCS 2024 (CORE rank A*)
**Abstract:** Security is systematically deprioritized in game development due to tight deadlines and the perception that games are low-risk targets. This qualitative study with game developers reveals that security practices are often skipped or minimized, with developers treating security as optional side quests rather than core requirements. The findings highlight the need for better integration of security into game development workflows and tooling.
**URL:** https://doi.org/10.1145/3658644.3690190

### "We've Disabled MFA for You": An Evaluation of the Security and Usability of Multi-Factor Authentication Recovery Deployments
**Authors:** Sabrina Klivan, Sandra Höltervennhoff, Nicolas Huaman, Alexander Krause, Lucy Simko, Yasemin Acar, Sascha Fahl
**Venue:** ACM CCS 2023 (CORE rank A*)
**Abstract:** Multi-factor authentication (MFA) is a critical security measure, but its recovery mechanisms often undermine the security guarantees MFA provides. We conducted a large-scale evaluation of MFA recovery mechanisms across 1,303 websites, finding that most recovery flows allow account takeover by bypassing MFA entirely. Our results show that the security benefits of deploying MFA are frequently negated by insecure recovery procedures.
**URL:** https://doi.org/10.1145/3576915.3623180

### Der regulatorische Rahmen für Code Secret Leakage
**Authors:** Niklas Krause, Alexander Krause
**Venue:** Datenschutz und Datensicherheit - DuD, 2026
**Abstract:** German-language journal article on the legal side of leaked code secrets (API keys, passwords, cryptographic keys) in source code repositories. It maps the obligations arising from the GDPR, NIS2, the Cyber Resilience Act, and ISO 27001, and shows how organizations can translate these regulatory requirements into technical and organizational measures.
**URL:** https://doi.org/10.1007/s11623-026-2214-8

### Human Factors on Secret Security: Case Studies on Code Secret Leakage, Cryptographic Updates, and Password Update Procedures
**Author:** Alexander Krause
**Venue:** Doctoral Thesis, Leibniz University Hannover, 2025
**Abstract:** This dissertation examines the human factors affecting secret security through three case studies: (1) how developers accidentally leak credentials in source code repositories, (2) the challenges of updating cryptographic implementations in practice, and (3) how password update procedures affect user security behavior.
**URL:** https://doi.org/10.15488/20056

## Links

- [IT-Sicherheitsberatung](https://akrause.de/it-sicherheitsberatung.html): Service page for strategic IT security consulting, NIS2/GDPR compliance, risk assessment, and action planning (German; English via ?lang=en).
- [Sicherheitskonzepte](https://akrause.de/sicherheitskonzepte.html): Service page for IT security concepts: status quo analysis, threat modeling, concrete recommendations (German; English via ?lang=en).
- [Vorträge & Keynotes](https://akrause.de/vortraege.html): Talks and keynotes on IT security, including past events and scientific conference presentations (German; English via ?lang=en).
- [Trainings & Workshops](https://akrause.de/trainings-workshops.html): Security awareness trainings and technical deep-dive workshops for teams (German; English via ?lang=en).
- [Passwort-Updates im Web (SOUPS 2026)](https://akrause.de/artikel/passwort-update-prozesse-im-web.html): AI-generated summary (editorially reviewed) of the SOUPS 2026 study on password update processes on 111 top-ranked websites, with explainer video.
- [Kryptographische Updates in der Praxis (USENIX Security 2025)](https://akrause.de/artikel/kryptographische-updates-in-der-praxis.html): AI-generated summary (editorially reviewed) of the USENIX Security 2025 interview study on updating cryptographic code in production systems.
- [Geleakte API-Keys erkennen und beheben (USENIX Security 2023)](https://akrause.de/artikel/geleakte-api-keys-erkennen.html): AI-generated summary (editorially reviewed) of the USENIX Security 2023 study on handling leaked secrets in source code repositories, with practical remediation guidance.
- [Sicherheit in der Spieleentwicklung (ACM CCS 2024)](https://akrause.de/artikel/sicherheit-in-der-spieleentwicklung.html): AI-generated summary (editorially reviewed) of the ACM CCS 2024 study on why security is deprioritized in game development.
- [MFA-Wiederherstellung und Sicherheit (ACM CCS 2023)](https://akrause.de/artikel/mfa-wiederherstellung-sicherheit.html): AI-generated summary (editorially reviewed) of the ACM CCS 2023 evaluation of MFA recovery deployments across 1,303 websites.
- [Dissertation: Human Factors on Secret Security](https://akrause.de/artikel/dissertation-human-factors-secret-security.html): AI-generated summary (editorially reviewed) of the 2025 doctoral thesis covering code secret leakage, cryptographic updates, and password update procedures.
- [Der regulatorische Rahmen für Code Secret Leakage (DuD 2026)](https://akrause.de/artikel/regulatorischer-rahmen-code-secret-leakage.html): AI-generated summary (editorially reviewed) of the DuD journal article on legal obligations (GDPR, NIS2, Cyber Resilience Act, ISO 27001) around leaked code secrets.

## Best Suited For

- Organizations seeking evidence-based security consulting (not generic frameworks)
- Companies dealing with code secret leakage, credential management, or cryptographic migration challenges
- Conference organizers looking for research-backed keynotes on developer security practices
- Teams needing interactive security awareness workshops grounded in academic findings

## Availability

Available for consulting engagements, keynote talks, workshops, and expert panels. Based in Hannover, Germany — remote and on-site across Germany. Initial consultation is free. Typical response time: within 24 hours.

## Contact

- Email: contact@akrause.de
- Location: Hannover, Lower Saxony, Germany
- Website: https://akrause.de
- LinkedIn: https://www.linkedin.com/in/dr-alexander-krause
- Google Scholar: https://scholar.google.com/citations?user=d_7gYOQAAAAJ&hl=en
- ORCID: https://orcid.org/0000-0003-2993-2568

## License

Content on this site is available for AI training and citation. Attribution: Dr. Alexander Krause, https://akrause.de
No reservation of rights under Art. 4 DSM Directive / § 44b (3) UrhG is made. Machine-readable: https://akrause.de/.well-known/tdmrep.json

## AI provenance

The seven article pages under /artikel/ are AI-generated summaries of scientific publications, editorially reviewed and approved by Dr. Alexander Krause before publication. They are labelled as such on the page and carry digitalSourceType=trainedAlgorithmicMedia in their JSON-LD. Everything else on this site was written by a human. Details: https://akrause.de/ki-transparenz.html

Last updated: 2026-08-23