CAREER: Finding Levers for Privacy and Security by Design in Mobile Development

移动的数据是最快出现的个人数据形式之一。确保这些数据的隐私和安全性是移动终端生态系统面临的关键挑战。移动的应用程序易于构建和分发，并且可以收集大量各种敏感的个人数据。目前保护这些数据的方法依赖于设计的安全性和隐私性：鼓励开发人员主动实施安全和隐私功能来保护敏感数据。虽然有许多技术创新可以帮助开发人员保护用户数据，但这些创新的采用率很低。采用率低的原因包括缺乏隐私或安全设计方面的培训，以及隐私增强功能和最佳实践数据安全措施的实施成本往往很高，甚至与需要用户分析或监控的商业模式背道而驰。隐私和安全保护机制的低采用率是一个社会问题，它阻碍了安全和可信的移动的生态系统。目前尚不清楚是什么因素促使开发人员在面临诸如更长的开发时间表、个人数据市场以及数据保护和数据支持服务之间的紧张关系等不利因素时实施隐私或数据安全功能。了解开发人员的决策是解决这个问题的核心：开发人员做出的决策是通过设计实现隐私和安全的基础。该项目1）研究开发人员，以发现通过设计鼓励隐私和数据安全的工作实践; 2）构建工具来鼓励这种工作实践。该项目使用调查和现场实验来确定通过设计激发隐私和安全的因素。它为移动的开发人员开发和测试基于证据的工具包，以提高移动的数据生态系统中的隐私和数据安全性。该项目提出了以下研究问题：1。移动的应用程序开发人员如何通过设计来定义隐私和安全？2.移动的应用程序开发中的哪些实践鼓励开发人员优先考虑数据保护？3.开发工具如何鼓励开发人员在设计期间优先考虑数据保护？通过回答这些问题，该项目阐明了开发文化，说明了开发人员如何理解隐私和安全需求，并发现了优先考虑隐私和安全的实践。该项目解释了开发实践对隐私和数据安全结果的影响，促进了软件工程和安全可靠计算方面的知识。该项目的研究结果和产品支持快速发展的移动的技术部门通过设计实现隐私和数据安全。通过设计找到鼓励隐私和数据安全的发展实践，可以改善安全和值得信赖的网络空间研究社区的技术创新技术转让，并加强对这些敏感数据的保护。

Mobile data are one of the fastest emerging forms of personal data. Ensuring the privacy and security of these data are critical challenges for the mobile device ecosystem. Mobile applications are easy to build and distribute, and can collect a large variety of sensitive personal data. Current approaches to protecting this data rely on security and privacy by design: encouraging developers to proactively implement security and privacy features to protect sensitive data. Although there are many technical innovations available to help developers protect user data, adoption of these innovations is low. Reasons for low adoption range from a lack of training in privacy or security design to the fact that privacy-enhancing features and best-practice data security measures are often expensive to implement, or even counter to business models that require user profiling or monitoring. Low adoption of privacy and security protection mechanisms is a social problem that inhibits a secure and trustworthy mobile ecosystem. It is unknown what factors can motivate developers to implement privacy or data security features when faced with disincentives such as longer development timelines, markets for personal data, and tensions between data protection and data-enabled services. Understanding developer decision-making is central to addressing this problem: the decisions made by developers are fundamental to enabling privacy and security by design to succeed. This project 1) studies developers to discover work practices that encourage privacy and data security by design; and 2) builds tools to encourage such work practices. This project uses surveys and field experiments to determine factors that motivate privacy and security by design. It develops and test evidence-based toolkits for mobile developers to improve privacy and data security in the mobile data ecosystem. The project asks the following research questions: 1. How do mobile application developers define privacy and security by design?2. What practices in mobile application development encourage developers to prioritize data protection? 3. How can development tools encourage developers to prioritize data protection during design?By answering these questions, the project illuminates development culture, illustrates how developers understand privacy and security needs, and discovers practices that prioritize privacy and security. The project explains the impact of development practices on privacy and data security outcomes, advancing knowledge in software engineering and secure and trustworthy computing. Findings and products from this project support the rapidly developing mobile technology sector in enabling privacy and data security by design. Finding development practices that encourage privacy and data security by design improves technology transfer of technical innovations from the secure and trustworthy cyberspace research community, and bolsters protections for this sensitive data.