Collaborative Research: Intelligent Interactions with Risk Communication for Risk Mitigation

该研究项目将使非技术人员能够轻松管理其在线风险。当前的信息基础设施是非常不安全的，这在很大程度上是由于非技术人员在线的无意识的风险寻求行为。 本研究的方法是风险沟通与智能交互设计相结合。虽然风险沟通的理论已经被计算机安全所接受，但它的使用还处于萌芽状态。智能交互的工具还没有被采用来帮助个人做出适合他们环境的风险决策。通过将这些方法结合到特定的在线风险中，研究将使个人能够做出明智的安全选择。请注意，这项工作特别关注已识别的人类个体，而不是通常抽象的理性自我优化用户。研究的核心要素是：1）理解个体？的风险感知，2）使用该感知进行有效的风险沟通，3）确保中断和沟通适合手头的工作流程，以及4）提供自动化和无缝的风险缓解。这些创新的方法具有很高的风险，但也有很高的回报，可能使许多离散的安全工具得到广泛使用。在这项研究中，以知识为基础的方法来识别技术风险将与以人为本的方法来感知风险，以实现自动化和上下文感知的缓解。使用我们的研究结果，个人将根据他们的任务，工作流程和上下文选择采取明智的风险。相比之下，今天的个人被打断与脱离语境，叙述自由，不适当的时间，往往是技术上无法理解的建议，以减轻风险。因此，人们天真地承担了他们不知道如何避免的风险。为了使非技术人员，这个研究项目将嵌入一种新的方法来简化安全措施的使用。所提出的半透明设计通过以下组合实现：仅在必要时对风险进行推理以打断个体，使用工作流程来构建关注风险以及如何在上下文中减轻风险的连贯叙述，并将适当的缓解措施组合成简单的自定义宏。

This research project will enable nontechnical individuals to easily manage their online risks. The current information infrastructure is profoundly insecure in no small part due to the oblivious risk-seeking behaviors of nontechnical individuals online. The methods in this research are a combination of risk communication with intelligent interaction design. While the theory of risk communication has been embraced in computer security, its use is embryonic. The tools of intelligent interaction have not been adopted to assist individuals in making risk decisions appropriate to their contexts. By combining these approaches to specific online risks the research will enable individuals to make informed security choices. Note that this work specifically focuses work on the identified human individual as opposed to the commonly abstracted rational self-optimizing user. The core elements of the research are: 1) understanding the individual?s risk perception, 2) using that perception for effective risk communication, 3) ensuring the interruptions and communications are appropriate to the workflow at hand, and 4) providing risk mitigation that is automated and seamless. The innovative methods carry a high risk, but also a high payoff in potentially enabling the wide use of many discrete security tools. In this research, the knowledge-based approach to identification of technical risk will be integrated with a human-centered approach to the perception of risk to enable mitigation that is automated and contextually aware.Using the results of our research, individuals will choose to take informed risks based on their on tasks, workflows and context. In contrast, today individuals are interrupted with decontextualized, narrative-free, inappropriately timed, and often technologically incomprehensible suggestions for risk mitigation. Consequently, people innocently take risks they have no way of knowing how to avoid. To enable the nontechnical individual, this research project will embed a novel approach to simplifying the use of security measures. The proposed translucent design is enabled by this combination of reasoning about risk to interrupt the individual only when necessary, using workflow to build a coherent narrative that focuses on the risks and how to mitigate them in context, and combining the appropriate mitigating actions into simple customized macros.