Collaborative Research: Intelligent Interactions with Risk Communication for Risk Mitigation

这个研究项目将使非技术人员能够轻松地管理他们的在线风险。当前的信息基础设施非常不安全，这在很大程度上是由于非技术人员在网上无视风险寻求行为。本研究的方法是将风险沟通与智能交互设计相结合。虽然风险沟通理论已被纳入计算机安全领域，但其应用仍处于萌芽阶段。智能交互的工具还没有被用来帮助个人做出适合他们环境的风险决策。通过将这些方法与特定的在线风险相结合，研究将使个人能够做出明智的安全选择。请注意，这项工作特别关注已识别的人类个体，而不是通常抽象的理性自我优化用户。研究的核心要素是：1)理解个体？S风险感知，2)使用该感知进行有效的风险沟通，3)确保中断和沟通适合手头的工作流程，以及4)提供自动化和无缝的风险缓解。这些创新的方法有很高的风险，但也有很高的回报，有可能使许多离散的安全工具得到广泛使用。在本研究中，以知识为基础的技术风险识别方法将与以人为中心的风险感知方法相结合，以实现自动化和上下文感知的缓解。根据我们的研究结果，个人将根据他们的任务、工作流程和环境选择承担知情风险。相比之下，今天的个人被非语境化的、没有叙述的、不合时宜的、通常在技术上难以理解的风险缓解建议打断。因此，人们天真地冒着他们不知道如何避免的风险。为了使非技术人员能够使用，该研究项目将嵌入一种简化安全措施使用的新方法。建议的半透明设计是通过以下组合来实现的：风险推理只在必要时打断个人，使用工作流来构建一个专注于风险和如何在上下文中减轻风险的连贯叙述，并将适当的减轻行动组合成简单的自定义宏。

This research project will enable nontechnical individuals to easily manage their online risks. The current information infrastructure is profoundly insecure in no small part due to the oblivious risk-seeking behaviors of nontechnical individuals online. The methods in this research are a combination of risk communication with intelligent interaction design. While the theory of risk communication has been embraced in computer security, its use is embryonic. The tools of intelligent interaction have not been adopted to assist individuals in making risk decisions appropriate to their contexts. By combining these approaches to specific online risks the research will enable individuals to make informed security choices. Note that this work specifically focuses work on the identified human individual as opposed to the commonly abstracted rational self-optimizing user. The core elements of the research are: 1) understanding the individual?s risk perception, 2) using that perception for effective risk communication, 3) ensuring the interruptions and communications are appropriate to the workflow at hand, and 4) providing risk mitigation that is automated and seamless. The innovative methods carry a high risk, but also a high payoff in potentially enabling the wide use of many discrete security tools. In this research, the knowledge-based approach to identification of technical risk will be integrated with a human-centered approach to the perception of risk to enable mitigation that is automated and contextually aware.Using the results of our research, individuals will choose to take informed risks based on their on tasks, workflows and context. In contrast, today individuals are interrupted with decontextualized, narrative-free, inappropriately timed, and often technologically incomprehensible suggestions for risk mitigation. Consequently, people innocently take risks they have no way of knowing how to avoid. To enable the nontechnical individual, this research project will embed a novel approach to simplifying the use of security measures. The proposed translucent design is enabled by this combination of reasoning about risk to interrupt the individual only when necessary, using workflow to build a coherent narrative that focuses on the risks and how to mitigate them in context, and combining the appropriate mitigating actions into simple customized macros.