Trust_Security-Serene-Risc-2015-marsh
0 likes282 views
1) The document discusses the importance of trust in building a secure digital ecosystem over the next 10 years, with technologies, norms and policies aligning to produce a resilient system. 2) It emphasizes that computing is about and for people, and outlines some key points about trust including that it is subjective, involves risk, and control is not always possible. 3) The discussion then focuses on technical solutions for cybersecurity that leverage and enable trust, including computational trust models, trust enablement, device comfort, and intelligent information sharing that considers trust relationships and privacy.
Trust_Security-Serene-Risc-2015-marsh
- 1. Let’s have a wee chat about… Trust (and Security) Stephen Marsh stephen.marsh@uoit.ca www.stephenmarsh.ca @smarsh2008 (25 minutes to change the world? It just might work)
- 2. Why Are We Here? “… we would like to frame the discussion around a more optimistic outlook trying to imagine what cybersecurity might look like ten years down the road if technologies, norms and policies align to produce a liberal, healthy and resilient digital ecosystem …”
- 3. Steve's First Rule of Computing Computing is about... and for... People (that's us)
- 4. Points to remember This is the case now This will be the case in the future
- 5. Well, isn’t this timely “The Internet-based economy has a bright future, provided that key conditions are in place, such as trust, education, and the right policy frameworks to promote participation, innovation, trade, competition and investment.” “Innovation and economic growth will depend on various factors such as access to capital, a skilled workforce and, not least, trust of end users.” “While a peaceful cyberspace provides us with many opportunities, the potential for malicious cyber activities by State and non-state actors to create instability and mistrust in international relations is increasing.” Chair's Statement, GCCS 2015 (April 17 2015)
- 6. Not to mention “For the Internet to remain a global engine of social and economic progress, confidence must be restored. The Commission calls on the global community to build a new social compact with the goal of restoring trust and enhancing confidence in the Internet.” GCIG (ourinternet.org), April 15 2015
- 7. And Finally “… real security on the Internet can only be realised within a broader context of trust and respect of fundamental human rights and values, such as privacy” Internet Society Statement on Collaborative Security, April 2015 internetsociety.org
- 8. What? Trust? Confidence? • Indulge me whilst I quote that bastion of left-wing thinking, The Guardian: “Trust and confidence are an odd premise on which to advance this report. Think about these traits. They are fickle and human. Hard to gain and easy to lose, they are attributes of people, acquired by lifetimes of experience and the manifold clues embedded in our social fabric. But machines, entities, infrastructure and artefacts – these are not things we trust. They are things we use, tolerate or begrudgingly accept, with varied levels of reflection and knowledge. We don’t want our corporations and security agencies fickle and fallible. Trust and confidence take hard work, time and evidence. They must be earned. And they will be earned by obeying laws, respecting and promoting human rights, and cracking down and remedying profligate corporate and government behaviour without fear or favour.” (Julia Powles, April 17 2015, gu.com/p/47tjq/stw, my emphasis)
- 9. Well, I beg to differ • Trust is absolutely the right way to frame the discussion • Indeed, when all else fails, it’s all there is left • Oddly enough, it’s also quite possible for people to think about people and machines in similar ways (kudos to Reeves and Nass) • This, naturally, applies to trust too
- 10. This works both ways • People can think about trust • Devices, tools, machines, can think about trust • They can all think about what this means about each other • Moreover, we can leverage trust to make people stronger
- 11. For the record, I do not remotely subscribe to the point of view that people are the weakest link
- 12. For the record, I do not remotely subscribe to the point of view that people are the weakest link (which point of view quite happily alienates the very people we should be working with!)
- 13. Trust There are plenty of definitions, let’s think about something that works here… A subjective probability, of sorts (Gambetta) In a circumstance of ambiguity Where control is not always possible (Cofta) And therefore where there is risk (Luhmann)
- 14. Trust – Control – Security (+ Understanding) cf. Cofta, 2007; Luhmann, 1979; (et al)
- 15. Hang on Steve, what’s this session about? “Technical Solutions to Cybersecurity Challenges” Hmm… Better get down to it then
- 16. What we do, how we think Computational Trust and its siblings Foreground Trust, Trust Enablement Device Comfort Intelligent Information 10 Commandments
- 17. Computational Trust • Marsh, 1994, etc., etc. • Formalise Trust and its siblings • regret, forgiveness, wisdom, comfort, mistrust, distrust… • To be able to • Think about it and understand it better • Better define it (and its applicability) • Apply it and use it • There are lots of trust models out there, in lots of domains
- 18. Trust Enablement and Foreground Trust • Trust Enablement… • Dwyer, 2011; Dwyer & Marsh, 2015a, 2015b; Dwyer & Marsh, 2015 (in review) • Essentially: allow people to make trusting decisions, given the facts and context • Foreground Trust (extends this!) (Marsh et al, 2012) • Focus Trust Enablement on automated help for users in context - resulting in empowerment and understanding • Leverage the Media Equation (Reeves & Nass) • Yes, blatantly use trust
- 19. Device Comfort • Marsh et al, 2010; Storer et al, 2013; Atele-Williams, 2014 • An application of Foreground Trust and an extension of Briggs' Trust Daemon • Aimed at users of mobile devices • Now being examined elsewhere also • Uses Annoying Interfaces, Relationships, Trust… • Advise, Encourage, Warn (and Proscribe)
- 20. Intelligent Information • Based on the ACORN architecture (years old now!) • Wrapping information in agents • Allow the agents (information) to use trust, etc. reasoning to determine things like • Who to share with • For how long • When • Why • Transitivity • For info sharing. Privacy...
- 21. And think about People! • The cyberspace of the future must revolve around Steve’s First Law, or it will fail to be useful or valid • Part of this involves designing for people • Which is why Privacy by Design is such a powerful concept • But the key is to create security (and trust) models and practices that help people understand and take part • So, we have some commandments we try to live by (and naturally think others should too! what are commandments for otherwise…?)
- 22. (1) Make it for people. (2) Make it understandable, not just by maths profs... (amongst which number I am not) (3) Support monitoring and intervention. (4) Do not fail silent(ly) (5) Make it configurable (6) Make it queryable (No, it isn't a word. Should be though) (7) Cater for different time priorities and outlooks (8) Allow for incompleteness. (9) Foster an ongoing relationship (10) Acknowledge risk up front.
- 23. We’re done • Consider: • There is no future for people, without people • Cyber-anything is people-oriented and trust is key • Security must be people-oriented too, and trust is key • Just because it’s hard, doesn’t make it impossible • Just because people do it, doesn’t make it weak (or indeed strong) • You can’t do it without trust