Adaptive User-Centered Security

Abstract

Part 1: Cross-Domain Conference and Workshop on Multidisciplinary Research and Practice for Information Systems (CD-ARES 2014): Software SecurityInternational audienceOne future challenge in informatics is the integration of humans in an infrastructure of data-centric IT services. A critical activity of this infrastructure is trustworthy information exchange to reduce threats due to misuse of (personal) information. Privacy by Design as the present methodology for developing privacy-preserving and secure IT systems aims to reduce security vulnerabilities already in the early requirement analysis phase of software development. Incident reports show, however, that not only an implementation of a model bears vulnerabilities but also the gap between rigorous view of threat and security model on the world and real view on a run-time environment with its dependencies. Dependencies threaten reliability of information, and in case of personal information, privacy as well. With the aim of improving security and privacy during run-time, this work proposes to extend Privacy by Design by adapting an IT system not only to inevitable security vulnerabilities but in particular to their users’ view on an information exchange and its IT support with different, eventually opposite security interests

A Systematic Mapping Study on Privacy by Design in Software Engineering

“…[61] PbD postulates that IT security requirements be considered in all phases of software development to reduce vulnerabilities. [65] PbD is an approach for software development which protects privacy from the early/concept stages of the software development life cycle. [39] PbD means embedding privacy proactively in the design process of a technical system by using data minimization techniques.…”

“…Then in [59] PbD is seen as a policy measure that guides developers in the process of including privacy into the systems they develop. It is worth to mention that Wohlgemuth [65] uses the term security in the definition of PbD by considering it as equivalent to privacy.…”

“…Other researchers have considered a user-centric approach for the development of software systems and with which to provide users with control over their personal data. Wohlgemuth [65] proposes an adaptive user-centered security to extend user-centered security so as to address users' requirements during information exchange between IT systems. The proposal adapts a threat model, IT security models, and integrates users as participants during information exchange when system are in the operation stage.…”

“…The proposal adapts a threat model, IT security models, and integrates users as participants during information exchange when system are in the operation stage. In this context, users need to explicitly configure their privacy preferences [65]. Bokhove et al [40] presents a user-centric approach for use in protecting users' privacy when applications use sensor data for well-being systems.…”