Towards usefully secure email

Masone, Chris; Smith, Sean W.

doi:10.1109/mtas.2007.335563

Cited by 10 publications

(2 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It is the core contention of the proposed research agenda that there is a clear and profound need for effective risk communication. While there have been studies of user conceptions of privacy [16] [17] and usable security [18]; these have focused on system design rather than contextual behaviors.…”

Section: Related Workmentioning

confidence: 99%

Mitigating Inadvertent Insider Threats with Incentives

Liu¹,

Camp²

2009

Financial Cryptography and Data Security

View full text Add to dashboard Cite

Abstract. Inadvertent insiders are trusted insiders who do not have malicious intent (as with malicious insiders) but do not responsibly managing security. The result is often enabling a malicious outsider to use the privileges of the inattentive insider to implement an insider attack. This risk is as old as conversion of a weak user password into root access, but the term inadvertent insider is recently coined to identify the link between the behavior and the vulnerability. In this paper, we propose to mitigate this threat using a novel risk budget mechanism that offers incentives to an insider to behave according to the risk posture set by the organization. We propose assigning an insider a risk budget, which is a specific allocation of risk points, allowing employees to take a finite number of risk-seeking choice. In this way, the employee can complete her tasks without subverting the security system, as with absolute prohibitions. In the end, the organization penalizes the insider if she fails to accomplish her task within the budget while rewards her in the presence of a surplus. Most importantly. the risk budget requires that the user make conscious visible choices to take electronic risks. We describe the theory behind the system, including specific work on the insider threats. We evaluated this approach using human-subject experiments, which demonstrate the effectiveness of our risk budget mechanism. We also present a game theoretic analysis of the mechanism.

show abstract

Section: Related Workmentioning

confidence: 99%

Mitigating Inadvertent Insider Threats with Incentives

Liu¹,

Camp²

2009

Financial Cryptography and Data Security

View full text Add to dashboard Cite

show abstract

“…One promising approach uses at-tribute-based annotations to help users make better trust decisions about their email communication. 6 Until such usable mechanisms are introduced into popular email clients, however, proceed with caution and verify those fingerprints. …”

Section: Fingerprint Verificationmentioning

confidence: 99%

A Case (Study) For Usability in Secure Email Communication

Kapadia

2007

IEEE Secur. Privacy Mag.

View full text Add to dashboard Cite

ABUSE: PKI for Real-World Email Trust

Masone

Smith

2010

Public Key Infrastructures, Services and Applications

Self Cite

View full text Add to dashboard Cite

Abstract. Current PKI-based email systems (such as X.509 S/MIME and PGP/ MIME) potentially enable a recipient to determine a name and organizational affiliation of the sender. This information can suffice for a trust decision when the recipient already knows the sender-but how can a recipient decide whether or not trust email from a new correspondent? Current systems are not expressive enough to capture the real ways that trust flows in these sorts of scenarios. To solve this problem, we begin by applying concepts from social science research to a variety of such cases from interesting application domains; primarily, crisis management in the North American power grid. We have examined transcripts of telephone calls made between grid management personnel during the August 2003 North American blackout and extracted several different classes of trust flows from these real-world scenarios. Combining this knowledge with some design patterns from HCISEC, we develop criteria for a system that will enable humans apply these same methods of trust-building in the digital world. We then present the design and prototype of Attribute-Based, Usefully Secure Email (ABUSE)-and present experimental evaluation showing that it solves the problem.

show abstract

Towards usefully secure email

Cited by 10 publications

References 31 publications

Mitigating Inadvertent Insider Threats with Incentives

Mitigating Inadvertent Insider Threats with Incentives

A Case (Study) For Usability in Secure Email Communication

ABUSE: PKI for Real-World Email Trust

Contact Info

Product

Resources

About