1. Let’s have a wee
chat about…
Trust (and Security)
Stephen Marsh
stephen.marsh@uoit.ca
www.stephenmarsh.ca
@smarsh2008
(25 minutes to change the world? It just might work)
2. Why Are We Here?
“… we would like to frame the discussion around a
more optimistic outlook trying to imagine what
cybersecurity might look like ten years down the road if
technologies, norms and policies align to produce a
liberal, healthy and resilient digital ecosystem …”
3. Steve's
First
Rule
of
Computing
Computing
is
about...
and
for...
People
(that's
us)
5. Well, isn’t this timely
“The Internet-based economy has a bright future, provided that key
conditions are in place, such as trust, education, and the right policy
frameworks to promote participation, innovation, trade, competition and
investment.”
“Innovation and economic growth will depend on various
factors such as access to capital, a skilled workforce and, not least, trust of
end users.”
“While a peaceful cyberspace provides us with many opportunities, the
potential for malicious cyber activities by State and non-state actors to
create instability and mistrust in international relations is increasing.”
Chair's Statement, GCCS 2015 (April 17 2015)
6. Not to mention
“For the Internet to remain a global engine of social and
economic progress, confidence must be restored. The
Commission calls on the global community to build a
new social compact with the goal of restoring trust and
enhancing confidence in the Internet.”
GCIG (ourinternet.org), April 15 2015
7. And Finally
“… real security on the Internet can only be realised
within a broader context of trust and respect of
fundamental human rights and values, such as privacy”
Internet Society Statement on Collaborative Security, April 2015
internetsociety.org
8. What? Trust? Confidence?
• Indulge me whilst I quote that bastion of left-wing
thinking, The Guardian:
“Trust and confidence are an odd premise on which to advance this report. Think
about these traits. They are fickle and human. Hard to gain and easy to lose, they are
attributes of people, acquired by lifetimes of experience and the manifold clues embedded
in our social fabric.
But machines, entities, infrastructure and artefacts – these are not things we trust.
They are things we use, tolerate or begrudgingly accept, with varied levels of reflection
and knowledge.
We don’t want our corporations and security agencies fickle and fallible. Trust and
confidence take hard work, time and evidence. They must be earned. And they will be
earned by obeying laws, respecting and promoting human rights, and cracking down and
remedying profligate corporate and government behaviour without fear or favour.”
(Julia Powles, April 17 2015, gu.com/p/47tjq/stw, my emphasis)
9. Well, I beg to differ
• Trust is absolutely the right way to frame the
discussion
• Indeed, when all else fails, it’s all there is left
• Oddly enough, it’s also quite possible for people to
think about people and machines in similar ways
(kudos to Reeves and Nass)
• This, naturally, applies to trust too
10. This works both ways
• People can think about trust
• Devices, tools, machines, can think about trust
• They can all think about what this means about each
other
• Moreover, we can leverage trust to make people
stronger
11. For the record, I do not remotely subscribe to the point of
view that people are the weakest link
12. For the record, I do not remotely subscribe to the point of
view that people are the weakest link
(which point of view quite happily alienates the very
people we should be working with!)
13. Trust
There are plenty of definitions, let’s think about
something that works here…
A subjective probability, of sorts (Gambetta)
In a circumstance of ambiguity
Where control is not always possible (Cofta)
And therefore where there is risk (Luhmann)
14. Trust
–
Control
–
Security
(+
Understanding)
cf. Cofta, 2007; Luhmann, 1979; (et al)
15. Hang on Steve, what’s this session about?
“Technical Solutions to Cybersecurity Challenges”
Hmm…
Better get down to it then
16. What we do, how we think
Computational Trust and its siblings
Foreground Trust, Trust Enablement
Device Comfort
Intelligent Information
10 Commandments
17. Computational Trust
• Marsh, 1994, etc., etc.
• Formalise Trust and its siblings
• regret, forgiveness, wisdom, comfort, mistrust,
distrust…
• To be able to
• Think about it and understand it better
• Better define it (and its applicability)
• Apply it and use it
• There are lots of trust models out there, in lots of
domains
18. Trust Enablement and Foreground Trust
• Trust Enablement…
• Dwyer, 2011; Dwyer & Marsh, 2015a, 2015b; Dwyer
& Marsh, 2015 (in review)
• Essentially: allow people to make trusting decisions,
given the facts and context
• Foreground Trust (extends this!) (Marsh et al, 2012)
• Focus Trust Enablement on automated help for
users in context - resulting in empowerment and
understanding
• Leverage the Media Equation (Reeves & Nass)
• Yes, blatantly use trust
19. Device Comfort
• Marsh et al, 2010; Storer et al, 2013; Atele-Williams,
2014
• An application of Foreground Trust and an extension of
Briggs' Trust Daemon
• Aimed at users of mobile devices
• Now being examined elsewhere also
• Uses Annoying Interfaces, Relationships, Trust…
• Advise, Encourage, Warn (and Proscribe)
20. Intelligent Information
• Based on the ACORN architecture (years old now!)
• Wrapping information in agents
• Allow the agents (information) to use trust, etc.
reasoning to determine things like
• Who to share with
• For how long
• When
• Why
• Transitivity
• For info sharing. Privacy...
21. And think about People!
• The cyberspace of the future must revolve around
Steve’s First Law, or it will fail to be useful or valid
• Part of this involves designing for people
• Which is why Privacy by Design is such a powerful
concept
• But the key is to create security (and trust) models and
practices that help people understand and take part
• So, we have some commandments we try to live by
(and naturally think others should too! what are
commandments for otherwise…?)
22. (1) Make it for people.
(2) Make it understandable, not just by maths profs...
(amongst which number I am not)
(3) Support monitoring and intervention.
(4) Do not fail silent(ly)
(5) Make it configurable
(6) Make it queryable (No, it isn't a word. Should be
though)
(7) Cater for different time priorities and outlooks
(8) Allow for incompleteness.
(9) Foster an ongoing relationship
(10) Acknowledge risk up front.
23. We’re done
• Consider:
• There is no future for people, without people
• Cyber-anything is people-oriented and trust is key
• Security must be people-oriented too, and trust is key
• Just because it’s hard, doesn’t make it impossible
• Just because people do it, doesn’t make it weak (or
indeed strong)
• You can’t do it without trust
