A thorough understanding of usable privacy research challenges is essential for ensuring high-quality research, improving methods and avoiding repeating mistakes, identifying research gap fillers, and advancing the field. In this chapter, we will examine some of the challenges associated with conducting usable privacy studies, such as the challenges of encompassing a variety of users, conflicting privacy and usability goals, privacy as a secondary objective, the privacy paradox, and issues related to measuring the right thing, the difficulty of conducting ecologically valid studies, and ethical and legal issues such as ethics of nudge and deception when conducting this type of research. We will further discuss the Human-Computer Interaction (HCI) challenges related to privacy technologies including the challenge of educating users on how privacy-enhancing technologies work and how to make online privacy transparent considering the effects of different factors such as information level, time, and medium through which we communicate to users that all play an important role in determining the effectiveness of transparency in protecting users' privacy. This chapter concludes by discussing some specific HCI challenges associated with privacy laws, such as discrepancies between what privacy laws require and what users need and problems regarding notice and choice.
This book explores usable privacy research, practices, challenges, and solutions for developers and practitioners in HCI, information systems, and the law
This chapter provides an overview of solutions for achieving usable privacy. First, the need for combining human-centred and privacy by design approaches is highlighted. Moreover, it is discussed how important challenges for usable privacy can be approached by available solutions. These include example approaches for considering culturally dependent privacy personas, developing usable Privacy-Enhancing Technology (PET) configuration tools through interdisciplinary efforts, raising users' attention to privacy as a secondary goal via engaging them with the policy content, designing usable multi-layered privacy notices and usable privacy management via semi-automation, and achieving usable transparency through usable explanations of PETs and different forms of visualisation of data disclosures. Finally, we discuss how fundamental legal privacy requirements map to Human-Computer Interaction (HCI) requirements and HCI solutions, focusing on the solutions discussed in this chapter.
A wide variety of literature exists on privacy across different communities and disciplines, including Human-Computer Interaction (HCI). Privacy literature is also scattered within HCI, considering that HCI has evolved from its origins to include a variety of disciplines. Therefore, this section is not intended to provide an exhaustive list of HCI privacy literature references. We explored the literature on usable privacy with a focus on the interaction and usability pillars of HCI, using the definition of usable privacy. Our search was narrowed to publications in reputed and high-quality journals and venues within and related to the privacy and security research field to categorise major themes and trends. Various themes are discussed in this section, including usable privacy research in the Internet of Things (IoT), inclusive privacy, usable privacy for developers, usable privacy for Privacy-Enhancing Technologies (PETs), visual privacy, and efforts to help people make better privacy decisions with usable privacy notices and choices. For each theme, we discuss pertinent literature and complete our discussion with existing problems, gaps, and future directions.
This chapter provides an overview of the legal and technical background needed in order to research and develop usable privacy solutions. A focus is placed on the EU Legal Privacy Framework, along with an overview of North American privacy laws, to provide a more comprehensive introduction to privacy laws and regulations. Additionally, it provides a classification and overview of existing privacy-enhancing technologies that have been researched and developed as privacy tools, systems, or system components.
This final chapter provides key takeaways reflecting on lessons learnt from usable privacy research. Moreover, it discusses current and future challenges related to usable privacy that are associated with AI technology advancements. Finally, conclusions are drawn to make the point that interdisciplinary privacy research is needed to adequately address human aspects.
This introductory chapter first discusses the significance of privacy and informational self-determination as a basic human right for individuals and as a value for democratic societies. It highlights the role of Privacy-Enhancing Technologies (PETs) in effectively protecting privacy and argues that the usability of privacy functions and usable PETs are important prerequisites for enforcing the right to informational self-determination. Moreover, this chapter also defines basic terms and concepts related to privacy, data protection, and usability and refers to related textbooks and surveys on usable privacy.
Security of software is still today a critical requirement as a lot of attacks exploit vulnerabilities in code. Securing software is, however, a complex process that requires, among other activities, analyzing the software specification and implementation. Many ML-based techniques or ML-based enhancements of conventional techniques have thus been proposed. In this chapter, we cover ML techniques for static analysis and ML-based fuzzing. We also discuss natural language processing techniques for the analysis of software specifications written in natural language to support different security-related tasks.
Even well-secured systems can be breached. There are several reasons for this, including the complexity and dynamic nature of today’s systems, insider threats, zero-day vulnerabilities, and human errors. Therefore, as we have discussed in Chap. 6 , monitoring and anomaly detection activities are critical. However, one important task in the security life cycle is to take proper actions, based on the results of those activities. The goals of those actions include mitigating, containing, and recovering from the attack, while at the same time trying to maintain the system operational as much as possible. In this respect, it is important to mention that resilience to attacks is today increasingly critical as many systems have stringent continuity requirements.
Machine learning techniques have been widely used over the years to enhance several security functions. This chapter provides an introduction to the techniques most widely used for those functions. Techniques covered include neural networks, autoencoders, recurrent networks and long short-term memory, attention mechanisms, and reinforcement learning. The chapter also covers transfer learning techniques that are critical to addressing the problem of scarce training data, which is often the case in security. In addition, the chapter covers embedding techniques as they are often used in conjunction with ML.
Security Policies define rules aiming to protect the infrastructure from insider and outsider threats. A key component to achieving this goal is access control policies, where security officers specify how subjects may access objects and under which conditions. However, developing detailed access control policies is a time-consuming and highly error-prone task that may have catastrophic effects if done incorrectly. Therefore, researchers have investigated techniques to automatically learn the security policies. In this chapter, we discuss ML techniques for automatic security policy learning. We organize those techniques in three parts: the first part refers to learning high-level access control policies, such as ABAC policy learning, whereas the second part discusses network security policy learning. While both parts pertain to access control policy learning, the former considers attributes of the subjects, objects, and operations, whereas the latter considers the idiosyncrasies of network environments, such as communication protocols and network addressing. The final part discusses privacy policy learning.
This chapter discusses major challenges in the use of ML for security, which are very much the same as in other domains. The chapter covers issues related to training datasets, such as scarcity of training data, and dataset quality. It also covers ethics issues and discusses several key dimensions of ethics, namely explainability, fairness, robustness, transparency, and privacy. The chapter then concludes with a discussion about ML security. Because many such topics are being extensively investigated, the chapter also provides pointers to surveys and tutorial papers, where the reader can find technical details, classifications of proposed approaches, and further references.
Provides a systematic analysis of machine learning techniques for enhancing critical security tasks in computer systems, networks, and data
Hardware is the backbone of all computing resources, and its security is of great importance. Compared with software vulnerabilities, hardware vulnerabilities are much harder to deal with because hardware cannot be patched easily as software. Thus, hardware developers heavily rely on hardware verification to find vulnerabilities in the prototype before the official release. In fact, in the hardware design cycle, hardware verification can take 60–75% of the time, and computing and human resources.
The EU GDPR [56] emphasizes that data subjects should be made aware of the risks related to personal data processing. In general, privacy impact assessment (PIA), whose technical core is referred to as privacy risk analysis (PRA) [45], is used to help service providers understand the privacy risks for data subjects from services they provide. With the GDPR coming into force in May 2018, it has become mandatory to conduct such assessments for certain kinds of personal data processing in Europe.
