1. From Restrictions to Regulations: The Social Side of Security
Özgür Kafalı
Postdoctoral Researcher
Fall 2015
Community Forum
October 29, 2015

2. Restrictions are Annoying
seriously
now?!
Session timeout!
Enter password
* * * * * ©

3. What Could Go Wrong?
People have different tolerance levels for restrictions!
Find workarounds
copy / paste from another document
choose less secure passwords
Associated risks could be worse

4. Can We Do Better? that’s better Session: 2h left
Don’t forget to logout

5. User level Safety vs Liveness Architectural level Technical vs Social
Goal
User level Safety vs Liveness Architectural level Technical vs Social
Security
Functionality

6. Evaluation of Designs
Formal AI methods help us evaluate different design choices
Promotes flexibility: increase session duration
Provide accountability: commitments from users to logging out

7. Research Questions: Verification
How can we verify that a given specification satisfies desired properties
Which specification is more resilient to misuse?
Does a specification support easy recovery from misuse?

8. Research Questions: Revision
How can we revise a given specification to ensure it satisfies desired properties
Enhance liveness while preserving resilience
Enhance resilience while preserving liveness

9. Sociotechnical Systems (STS)
A social organization with
software components
stakeholders with individual goals
Hospital setting
healthcare software
administrators, physicians, workers, patients

10. STS Architecture

11. Technical Mechanisms Software level: access control to
system resources
Physical level: entrance to
emergency department

12. Social Norms Regulate interactions among stakeholders
Physicians are committed to
treating patients
Only experts are authorized to
operate on patients

13. Social Norms Healthcare workers are prohibited
from disclosing patient’s information
Sanctions for violating norms

14. Norm Strength: Authorization
Grant access to PC for 2 hours
stronger
Grant access to PC for 15 minutes
weaker

15. Norm Strength: Prohibition
Deny access to patient records without consent
stronger
In nonemergency cases, deny access to patient records without consent
weaker

16. Revision Patterns: Relaxation
Relation Used
Deadline
Release of liability
weaker commitment
extend
Ease of use
stronger authorization
Accessibility
weaker
prohibition
shorten

17. Revision Patterns: Accountability
Deny access to patient records without consent
Deny sharing of patient’s protected information
accessibility
accountability
In nonemergency cases, deny access to patient records without consent
Fall 2013 Community Forum
October 22, 2013

18. Formal Verification Techniques
Formalize requirements in temporal logic
Apply model checking
Verify whether
desired properties are satisfied
undesired executions are impossible

19. Revision Tool

20. Who Could Benefit?
Offer software designers additional security choices
Evaluate different designs with our AI tools
compare possible executions
select designs that promote secure collaboration among users

21. Collaboration Opportunities
Case studies with different organizations
What we need
What we offer
Access to security policies / requirements
Interview designers
Evaluate requirements
Identify / resolve conflicts
Apply social patterns