Privacy and Security in Software and Things: A Human Perspective

点击翻译按钮获取中文摘要

Technology continues to fail users when it comes to privacy and security. Years of scientific research demonstrate that building systems that seamlessly integrate privacy and security is challenging. From a human-centric perspective, I will conceptualize the two "victims" involved in this challenge as the "software producer": all those involved in the production of software, and the "software consumer": the end-user. Software producers often lack security expertise, they follow standard security practices that fails to consider under-represented user groups, and are generally unaware of practices to protect users' privacy. On the consumer side, users' incomplete mental models of privacy and security can lead to serious errors. Importantly, a bridge is missing between both sides; producers need to have a proper understanding of their consumers to build technologies that match users' expectations and in turn help further their mental models of the technology. This research takes a holistic view that, for the first time, captures the interplay between software producers and consumers, with the overarching goal of facilitating the development of secure software, and giving users control over their personal data. We will tackle three research themes: We will work towards identifying actors that influence the state of security and privacy in software, and assessing the degree of influence of each actor. These actors may include individuals involved in the Software Development Lifecycle (SDLC), standardization bodies, software development processes, and security best practices. Upon identifying the set of actors, we will devise new methodologies to study the degree by which each of the actors influences software security and privacy. We will work towards identifying critical instances in the SDLC where we can encourage collaboration and knowledge sharing between developers and privacy and security experts. We will devise evaluation parameters to gauge the usefulness of these opportunities to the developer, and how disruptive they are to the experts. We will then iteratively design tools to support these opportunities, employing large multitouch screens to facilitate collaboration, incorporating visualization techniques to enable exploration and knowledge sharing, as well as experimenting with techniques to distribute efforts to avoid experts' burnout. Users typically have poor mental models of privacy and security, which often leads them to dismiss protective measures, or to inadvertently circumvent them. We will work on identifying design patterns for future technologies to help users cope with evolving technology and improve their privacy and security mental models. We will iteratively design and build tools, employing these design patterns to allow users to manage data accessed by software they use. We will also research simple yet effective methods to communicate data access and privacy leaks to users while avoiding user habituation.