WSIW - 7th Workshop on Security Information Workers

7th Workshop on Security Information Workers

The human element is often considered the weakest element in security. Alth= ough many kinds of humans interact with systems that are designed to be secure, one particu= lar type of human is especially important, the security and privacy information workers who deve= lop, use, and manipulate privacy and security-related information and data as a significa= nt part of their jobs. Security/privacy information workers include:

Software developers, who design and build softwa= re that manages and protects sensitive information;
Security and system administrators, who deploy a= nd manage security-sensitive software and hardware systems;
IT professionals whose decisions have impact on = end users' security and privacy;
Intelligence analysts, who collect and analyze d= ata about security matters to understand information and make predictions;<= /li>
Security consultants and educators, who provide = guidance to individuals and organizations on practicing good security behav= iors and implementing security technologies; and
Privacy engineers and professionals, who ensure that privacy c= onsiderations are built into products and who help develop privacy policies=

This workshop aims to develop and stimulate discussion about security infor= mation workers. We will consider topics including but not limited to:

Empirical studies of security/privacy information worke= rs, including case studies, experiments, field studies, and surveys;
New tools designed to assist security/privacy informati= on workers;
Infrastructure for better understanding security/privac= y information workers;
Information visualization and other techniques designed= to help security/privacy information workers do their jobs;
Evaluations of tools and techniques for security/privac= y information workers

Successful submissions to this workshop will explicitly be informed by an u= nderstanding of how security/privacy information workers do their jobs, and the results will ex= plicitly address how we understand these workers.

We solicit papers describing new research contributions in this a= rea as well as case studies, work in progress, preliminary results, novel ideas, and position papers. Pa= pers should be atmost six pages (excluding references) using the SOUPS temp= late format (MS Word or LaTeX).
Submissions should be fully anonymized. Submissions may be made at <= a href=3D"https://wsiw2021.usenix.hotcrp.com/" target=3D"_blank">https://ws= iw2021.usenix.hotcrp.com/.

A word about paper length. Papers should be succinct, but thorough in prese= nting the work. Typical papers will be 5-6 pages long (plus references) but papers can be s= horter (e.g. 2-3 pages) if, for example, they present an novel idea with limited preliminary= results or a position likely to drive a lively discussion. Shorter, more focused papers are encou= raged and will be reviewed like any other paper. If you only need 2 or 4 pages (plus referenc= es) to clearly explain your work or idea, please submit a paper of that length. Reviewers will be = instructed to assess the value of the talk to the workshop audience irrespective of the paper le= ngth; however, we stress again that the presentation should be sufficiently thorough for revi= ewers to make this evaluation.

Workshop papers will be made available to attendees prior to the workshop. = However, they will not appear in the official SOUPS proceedings. Paper presentations will be a= pproximately 10-12 minutes in length followed by 5 minutes of questions and answers. Presentat= ions will be made remotely using Zoom.

The workshop will feature a keynote talk and paper presentations, as well a= s breakout sessions to provide an opportunity for smaller group interactive discussion about re= lated topics of interest, which may include methods, challenges, and future directions in security in= formation workers research.

The deadline for submissions is June 10th 23:59 AoE (extended) May 27 23:59 AoE (Anywhere on Earth).

You can find out more at http://security-information-workers.org/
or by emailing wsiw@sec.uni-hannover.de.

Agenda

Sunday, August 8, 2021, 11:00 =E2=80=93 14:30 Eastern Daylight Time

Time
11:00 =E2=80=93 11:15	Welcome and workshop agenda
11:15 =E2=80=93 11:35	A Privacy Testbed for IT= Professionals: Use Cases and Design Considerations - Joseph Gardiner (Univ= ersity of Bristol), Mohammad Tahaei (University of Bristol), Jacob Halsey (= University of Bristol), Tariq Elahi (University of Edinburgh), Awais Rashid= (University of Bristol) Abstract: We propose a testbed t= o assist IT professionals in evaluating privacy properties of software syst= ems. The goal of the testbed, currently under construction, is to help IT p= rofessionals systematically evaluate and understand the privacy behavior of= applications. We first provide three use cases to support developers and p= rivacy engineers, and then describe key design considerations for the testb= ed.
11:35 =E2=80=93 11:55	Exploring Government S= ecurity Awareness Programs: A Mixed-Methods Approach =E2=80=93 Jody Jacobs,= Julie Haney, Susanne Furman, Fern Barrientos (National Institute of Standa= rds and Technology) Abstract: Organizational security awa= reness programs are often underfunded and rely on part-time security awaren= ess professionals who may lack sufficient background, skills, or re-sources= necessary to manage an effective and engaging program. U.S. government org= anizations, in particular, face challenges due to strict security awareness= requirements that often result in success being measured by training compl= etion rates rather than impact on employees=E2=80=99 attitudes and behavior= s. However, no prior research has explored security awareness in the govern= ment sector. To address this gap, we are conducting an in-progress, mixed-m= ethods research effort to understand the needs, challenges, and practices o= f U.S. government security awareness programs. This understanding will info= rm the creation of resources for security awareness professionals, includin= g examples of successful practices and strategies, lessons learned, and sug= gestions for building a team having the appropriate knowledge and skills. W= hile focused on the U.S. government, our findings may also have implication= s for organizational security awareness programs in other sectors.
11:55 =E2=80=93 12:15	Components of a Model= of Cybersecurity Behavior Adoption =E2=80=93 Cori Faklaris (Carnegie Mello= n University) Abstract: Our research focuses on understanding = how attitudes and social influences act on end users in the process of cybe= rsecurity behavior adoption (or non-adoption). This work draws on five expe= ctancy-value models and on four stage models that have been applied success= fully in social psychology, marketing, and public health. In this talk, we = will first give an overview of these models. We then will present the progr= ess of our empirical mixed-methods research to validate a model of cybersec= urity behavior adoption that identifies the relevant (1) attitudes and (2) = social influences acting at each step, along with (3) tech characteristics = that are associated with sustained adoption. We will conclude with remarks = on how our work can be of use to cybersecurity teams tasked with boosting a= wareness and/or adoption.
12:15 =E2=80=93 12:30	Break
12:30 =E2=80=93 13:30	Keynote: Choosing Better Open = Source: Lessons from the Real World =E2=80=93 Michaela Demeter (Intel)
13:30 =E2=80=93 13:45	Break
13:45 =E2=80=93 14:05	What Makes Security-Rel= ated Code Examples Different - Azadeh Mokhberi, Tiffany Quon, Konstantin Be= znosov (University of British Columbia) Abstract: Developers relying on code examples (CEs) in softw= are engineering can impact code security. We Developers relying on code exa= mples (CEs) in software engineering can impact code security. We conducted = semi-structured interviews with seven professional developers to investigat= e developers=E2=80=99 habits, challenges, and strategies in the life cycle = of using security-related code examples (SRCEs), with a focus on exploring = the differences between security- and non-security-related CEs. Results ind= icate that a lack of adequately differentiating between SRCEs and non-secur= ity-related code examples (NSRCEs) is a reason for introducing vulnerabilit= ies into the code. We found that developers had a habit of reusing vulnerab= le code from their previous projects. This code reuse unintentionally intro= duced the same vulnerability into new projects, while that vulnerability ha= d already been fixed in later iterations of the original resource the CE ha= d been taken from. Our results highlight that professional developers need = the same number of such CEs even as they gain experience over time, while t= his may not be the case for NSRCEs.
14:05 =E2=80=93 14:25	Recording of Personal = Health Information in the Age of Smartphones - Raghav V. Sampangi (Dalhousi= e University), Carla Ann Heggie (Dalhousie University), Simeon Kanev (Allia= nce for Healthier Communities) Abstract: The ubiquity of smartphones and other mobile devic= es offers a range of conveniences, including giving patients the ability to= record discussions during healthcare appointments that may contain medical= advice and opinion, which constitute personal health information (PHI). We= explore the dimensions of re-cording PHI, with a focus on privacy, ethics,= and security aspects of these type of recordings in the Canadian context. = We note that there does not appear to be much guidance in healthcare policy= which dictates the boundaries of the relationship between the patient and = healthcare professional. In Canadian law, the concept of one party consent = allows patients to record interactions with healthcare professionals withou= t the need for their consent. While not illegal, this could result in issue= s such as erosion of trust, changed power dynamics, accountability, etc. In= this paper, we recommend guidelines, founded in Privacy by Design fundamen= tal principles, for application developers to inform patients or caregivers= about the potential risks of recording their interactions with healthcare = professionals. Our next steps are to evaluate the guidelines we recommend, = to continue exploring the various dimensions around recording and PHI, and = to develop and evaluate technological solutions for the same.
14:25 =E2=80=93 14:30	Closing remarks

Important Dates

Workshop paper submission deadline	Thurs= day June 10, 2021 (extended) ~~May 27, 2021~~
Workshop paper acceptance notification to authors	Monday, June 21, 2021
Workshop camera-ready papers due	Wednesday,= June 30, 2021
Workshop	Sunday, August 8, 2021

Submission Site

https://wsiw2021.usenix.hotcrp.com/

Registration

To register for WSIW'21 please visit https://umdsurvey= .umd.edu/jfe/form/SV_bjFxZUu7zv0fYpw.

Quarterly WSIW

Our third quarterly WSIW event will be May 3 at 11:00am EDT to 12:30pm! If = you=E2=80=99d like to do a short talk on a WIP, have a suggestion for a spe= aker, or want to talk about another topic of interest to the community, sen= d a quick email with a short description of the talk to wsiw@sec.uni-hannover.de. Looking forward to = =E2=80=9Cseeing=E2=80=9D you all and having some great discussions!
We do have a slack channel - email us if you want to be invited. The agenda for the third quarterly WSIW event is available here.

Previous workshops

You can find the websites for previous workshops here:

Organizing Committee / Program Committee Chairs

Y= asemin Acar, Max Planck Institute for Security and Privacy
Sa= scha Fahl, CISPA Helmholtz Center for Information Security
Kelsey Fulton, University of Maryland
Julie Haney, National Institute of Standards and Tech= nology

Web Chair

Christian Stransky, Leibniz University Hannover

WSIW 2021 & Quarterly WSIW

7th Workshop on Security Information Wo= rkers