Dimensions of Risk in Mobile Applications

Abstract

Mobile platforms, such as Android, warn users about the permissions an app requests and trust that the user will make the correct decision about whether or not to install the app. Unfortunately many users either ignore the warning or fail to understand the permissions and the risks they imply. As a step toward developing an indicator of risk that decomposes risk into several categories, or dimensions, we conducted two studies designed to assess the dimensions of risk deemed most important by experts and novices. In Study 1, semi-structured interviews were conducted with 19 security experts, who also performed a card sorting task in which they categorized permissions. The experts identified three major risk dimensions in the interviews (personal information privacy, monetary risk, and device availability/stability), and a forth dimension (data integrity) in the card sorting task. In Study 2, 350 typical Android users, recruited via Amazon Mechanical Turk, filled out a questionnaire in which they (a) answered questions concerning their mobile device usage, (b) rated how often they considered each of several types of information when installing apps, (c) indicated what they considered to be the biggest risk associated with installing an app on their mobile device, and (d) rated their concerns with regard to specific risk types and about apps having access to specific types of information. In general, the typical users' concerns were similar to those of the security experts. The results of the studies suggest that risk information should be organized into several risk types that can be better understood by users and that a mid-level risk summary should incorporate the dimensions of personal information privacy, monetary risk, device availability/stability risk and data integrity risk.

RAPID-Risk Assessment of Android Permission and Application Programming Interface (API) Call for Android Botnet

“…In particular, the Android malware and botnet distribution by malicious persons are always motivated by privacy exposure of victim, financial profit to attacker and degrading operating system of smartphone [16,26,27,15]. Thus, this research had classified the app features into three risks which are privacy risk, financial risk and system risk.…”

Privacy Itch and Scratch

“…); (2) Photo sharing on social networks; and (3) Location disclosure. These categories are chosen as common representative items from the 14 personal information items found to be a privacy risk on mobile devices in the user study conducted by Jorgensen et al [9].…”

“…With the rapid growth in pervasive/ubiquitous computing, personal information privacy has become a bottleneck research challenge [9,13,21]. A lot of private and often sensitive information about users that is collected through ubiquitous devices can be shared with unknown entities at any time, without them being aware.…”

The Role of Human Factors/Ergonomics in the Science of Security

“…The human factors component is based on principles of decision making, including that information framing influences decisions (Kahneman & Tversky, 1979) and that people often rely on gist representations rather than on detailed verbatim representations (Brust-Renck, Royer, & Reyna, 2013). Central to our approach is an assumption that most users will prefer less detailed displays of risk information, such as a summary risk score (Chen et al, in press;Gates, Chen, Li, & Proctor, 2014) and indication of risk categories (Jorgensen et al, 2015).…”

“…In addition to a summary risk (or safety) index, research has also identified the major risk categories (personal information privacy, monetary, and device availability/stability) that can be utilized by users who want more detailed information (Jorgensen et al, 2015). Principles of display design (e.g., Bennett & Flach, 2011) can form the basis for research to determine the most effective way to convey the risks associated with these categories to users when choosing among apps.…”