Using risk analysis to assess trust
An on-line banking scenario
Based on iTrust’2004 paper by
Gyrd Brændeland and Ketil Stølen
iTrust’2004 30 March 2004
Tele og data
Overview
„ Contribution: Investigate the use of risk analysis as a
means to analyse trust.
„ Method: Application of methods from risk analysis on a
simple on-line banking scenario, targeting user trust.
„ Hypothesis:
„ User trust can be identified as an asset.
„ Risk analysis targeting user-trust can be based on the same
overall process as risk analysis in the security domain.
„ Trust risk analysis includes aspects that are not present in
conventional security risk analysis.
Tele og data
1
Elements in a security risk analysis
Frequency
Unwanted
Incident
Context
Target
Consequence
Asset
Vulnerability
Treatment
Threat
Tele og data
Scenario: on-line banking
on-line bank
Internet
Bank
net-bank user
Tele og data
2
Trust risk analysis
„ How can model based risk analysis be used to identify
threats, vulnerabilities and unwanted incidents that may
reduce user trust.
„ Focus: Those aspects where a risk analysis targeting trust
differs from an ordinary security risk analysis.
„ Trust is a more general issue than security.
Tele og data
Trust versus security
Trust:
„ Perceived security
„ Lack of information =>
worse than actual security.
„ Appealing interface =>
better than actual security.
„ Includes security, but also;
Security:
„ Actual security
„ legal,
„ sociological and
„ psychological issues
Tele og data
3
Establish the context
Egger – model of trust
on-line bank
Internet
Reputation
Trust propensity
Attitude
Transference
Bank
Pre-interaction filters
net-bank user
Tele og data
Establish the context
Interface properties
Informational content
Usability
Overview
Appeal
Products & services
Company
Security
Privacy
Communication
on-line bank
Internet
Reputation
Pre-interaction filters
Relationship management
Bank
net-bank user
Tele og data
4
Identify assets
„ Questions:
„ What is the significance of user trust from the perspective of the
service provider?
„ How do we measure user trust from the perspective of the service
provider?
„ The bank is interested in the number of users and their
money.
„ User trust affects customer behaviour. Therefore trust is
an asset for the bank.
Tele og data
Hierarchy of trust related assets
Market share
Database
confidentiality
Pre-interaction
filters
Net-bank
technology
confidentiality
User trust
Interface
properties
Informational
content
Reputation
Usability
Overview
Appeal
Products/
services
Communication
Company Perceived Perceived
policy
security
privacy
Tele og data
5
Risk evaluation criteria
„ What may be tolerated with respect to risk.
„ Risks that do not satisfy these criteria must be treated.
„ Example:
if risk impact < 0.15 decrease in user trust within a week then
accept risk else assign priority and treatment.
if risk impact < loss of 500 customers within a week then accept risk
else assign priority and treatment.
Tele og data
Identify risks
<< Unwanted Incident >>
security incident
published locally
<<Initiate>>
<<Unwanted Incident>>
security incident
published
in the National News
<<Initiate>>
<<Unwanted Incident >>
information about
security incident leaked
<<Asset>>
perceived
security
<<include>>
E
<<Eavesdropper >>
eavesdropper
<<Asset>>
customer
data
<<Threat Scenario >>
illegal access to
customer data
over network
Tele og data
6
Negative press
coverage on
security leakage
Analyse risks
OR
„ Determine consequence
and frequency
Customer
alerts press
Hacker reveals
weakness and alerts
press
The customer’s personal data
were acquired by another user
The data were accessed
crafting the specific URL
for the page that provides
user’s personal data
OR
The access achieved
acquiring the user’s
authentication
account
The access achieved by web
traffic eavesdropping
0.25
0.08
0.03
URL for the page that
provides user’s
personal data
unprotected, due to
programming error
Tele og data
Evaluate risks
Frequency
Consequence Rare
Unlikely
Possible
Likely
Almost
certain
Minor
Moderate
Major
Negative
exposure
Major
risk
Tele og data
7
Treatment
„Treatment: A way
of reducing the risk
value of a risk.
<< Treatment >>
public relations<< Reduce Consequence >>
work
<< Asset >>
perceived
security
<< Treatment >>
authentication
<< Reduce Likelihood >>
E
<< Unwanted Incident >>
information about
security incident leaked
<<include>>
<<Asset>>
customer
data
<< Eavesdropper >>
eavesdropper
<< Threat Scenario >>
illegal access to
customer data
Tele og data
Conclusions
„ Risk analysis is well suited to defend existing user trust.
„ User trust in an online banking system is an asset for the
service provider.
„ Risk analysis targeting user-trust can be based on the
same overall process as risk analysis in the security
domain.
„ Trust risk analysis includes aspects that are not present in
conventional security risk analysis.
„ These techniques can also be used to build new and
increase existing user trust.
Tele og data
8