Magazine menu Close Magazine menu

Transparency

Latest stories

data transparency center

How transparency centers and open data processing practices help your business

  • min read
    • Data processing centers are already a crucial part of digital business, and transparency centers – although less widespread – are becoming part of that picture too. But the two can be confused or poorly understood. Enterprises wanting to make sure they're protecting their security in the best way possible will want to get to the bottom of this. Here, we'll take an in-depth look at both, examining their different purposes and what your business should consider when using each as part of its security practice. What data processing centers do Data processing centers hold servers and computers that process your business's information. Increasingly, data processing centers are separate from the data-owning business's premises for safety, security and cost-effectiveness. According to Market Prospects Insights, "Data center operations include installing and maintaining network resources, ensuring data center security, and monitoring systems responsible for power and cooling." Speaking of power and cooling, more businesses are now thinking about the environmental impact of data processing. Thankfully, data processing needn't cost the earth. You can seek out data processing centers powered by renewable electricity, either in a country where grid power comes mostly from renewable energy, like Norway, Brazil or New Zealand. Or, process your data with a company that powers their data center by buying electricity only from renewable sources. Why data center location matters Regulation can also impact where businesses choose to process their data. You'll need to know how laws in the territory you and your customers are in could affect your data security. A third factor influencing where you process your data may be company values. At Kaspersky, we use two data centers in Zürich, Switzerland to store all threat-related data from our product users in Europe, North and Latin America, the Middle East and several Asia-Pacific countries. We chose Switzerland because of its long history of neutrality, as part of our Global Transparency Initiative (GTI.) What transparency centers do Wondering what next-level trust between businesses looks like? You may soon have the opportunity to examine your software supply chain in a new level of detail. Outside the open-source software movement, software source code is usually a closely guarded trade secret. But increasingly, front-runners realize that finding ways to safely and securely let partners and clients inspect their code helps build the trusting relationships businesses need to thrive. Communications giant Huawei established its first transparency center in Brussels in 2019. Huawei explains what they hope to achieve with their center: "Through the Cyber Security Transparency Centre, we plan to increase communication and collaboration with security professionals, governmental agencies, customers and other industry stakeholders, in order to develop a secure and trusted digital environment." Microsoft opened transparency centers in Brussels and Redmond, Washington in 2014 to 2015 as part of its Government Security Program (GSP.)  Matt Thomlinson, Vice President of Microsoft Security highlighted how transparency centers can contribute to better economic outcomes for all: "Only by increasing confidence in digital solutions […] can Europe ensure that every citizen, business and government feels the benefits of the digital revolution." Kaspersky started creating transparency centers in 2017 and now has seven, in Zürich (Switzerland,) Madrid (Spain,) São Paulo (Brazil,) Woburn (USA,) Tokyo (Japan,) Singapore and Kuala Lumpur (Malaysia.) We welcome customers and partners, including authorities responsible for cybersecurity, from anywhere in the world to visit these centers. How Kaspersky customers can use our transparency centers We suggest clients visit a transparency center if they want to know more about our data security, privacy and management practices, encryption methods or supply chain risk management. When customers visit our centers, we have experts on hand to give any technical information about our source code and technologies. We have three levels of access, like the beginner, intermediate and advanced slopes on a ski field – designed to allow a broader range of client visitors to get something out of the experience. They could rebuild our source code to ensure it matches publicly available modules, and read what independent auditors – including a Big Four accounting firm – have said about us in recent security reports. While few businesses have transparency centers today, others are adopting similar ideas. Showcase centers, for example, let customers try out the firm's latest tech and in some cases, securely review code. UK-based telecommunications multinational BT established a showcase center for its financial services products, where their customers learn more about their products – especially security features. Today, businesses must understand where and how their data is processed and ensure processing conforms with regulation and their organization's values. Find out what opportunities you have to better understand what's happening with your data. If you have an opportunity to visit a transparency center or other facility that lets you get up close and personal with the code of organizations in your supply chain, take up the offer – regardless of which ski slope you're on.
trust global business

New research on how to build trusted business relationships worldwide

  • min read
    • Trust is the building block of all relationships, but the way we build trust in business isn't the same the world over. Tyree Mitchell is assistant professor at Louisiana State University School of Leadership and Human Resource Development. His latest book with Jeanne Brett, Searching for Trust in the Global Economy, shares findings from studying managers in 33 countries, revealing differences in how they nurture trust relationships. It also asks if the pandemic has changed how we make decisions about trust. I spoke with Tyree about his research and ideas to improve relationships in virtual and global tech teams. Susi O'Neill: Why did you focus on international differences in trust for your research? Tyree Mitchell: Global economic development needs new business relationships. Negotiating them is tricky – there's much uncertainty, vulnerability and unmet expectations. Trust is critical. When negotiators trust each other, businesses use fewer resources to prevent exploitation and have better economic outcomes. Most research and theories on trust are from a Western perspective. Data from the World Values Survey shows different responses. For example, the US is higher on trust than Brazil. To build relationships, you must understand how trust varies between cultures. We wanted to explore what that means when negotiating business relationships and understand from managers and executives how trust happens. How do we decide if we'll trust a business partner? We learned from the 82 managers we interviewed four key actions they use to make trust decisions. First, due diligence – searching for information about the new partner, including financial status, ratings and reviews and data gathering on social platforms like LinkedIn. Second, brokering – a special introduction where a third party puts their reputation on the line. We particularly see this in East Asia. Third, goodwill building – interacting socially to get to know the partner, like grabbing a coffee or going to a sports event together. Finally, testing – getting the partner to act or react, like asking a question when you already know the answer. We want to know if they will be upfront about company difficulties or cover up problems. In the West, we use testing to check if you're forthcoming and honest, as the assumption is you can be trusted. In East Asia, testing is about checking competency, as people tend to embellish things, so partners want to know if you can deliver what you promise. From these actions, we found four standards for determining if someone is trustworthy -- competence, openness, respect and rapport (CORR.) Competence means, are they capable with the knowledge and skills to deliver on their promise? Openness means are you honest and forthcoming? Respect means showing regard for one another, even if you don't have shared values. Rapport refers to building affinity around shared values. What were the main differences you saw between research participants? We analyzed the 82 manager interviews using a framework based on regional differences in trust and the tightness of social norms. There is a cultural difference in how people answer the question, can most people be trusted? For example, in India, the answer is more often 'no' and in Sweden, more often 'yes,' so we call India' low-trust' and Sweden' high-trust.' There are also differences in tightness and looseness of social norms and consequences for deviating. For example, China is high-trust and tight, the US is high-trust and loose, India is low-trust and tight, and Mexico is low-trust and loose. To understand cultural differences in trust decisions, you must understand these differences. There are also differences in how different cultures decide to trust. East Asians emphasize testing more than Middle Easterners or Latin Americans. Latin Americans and Middle Easterners emphasize goodwill building more than East Asians. Latin America, the Middle East and South Asia are lower trust. But in Latin America, rapport and establishing shared values are more important. Respect for cultural differences is vital in the Middle East and South Asia. This may be because the institutions that monitor and sanction deviance from norms in 'tight,' but more diverse cultures don't cross ethnic boundaries. What were the most surprising research findings? East Asia and the West focus primarily on the business relationship. If there's a business relationship, the personal connection follows. China and UK's behavior was similar, but social norms are different. On brokering a relationship through a third party, one US manager asked, "What's in it for the person making the introduction?" That's not considered in the 'tight' East Asian culture – if the third party puts their reputation on the line, they're good to deal with. In this culture, someone can be outcast if they bring embarrassment on themselves or their family – the stakes are higher. How can transparency be improved between partners? Share information openly and honestly. Anticipate being asked questions about past performance and how you see the future relationship. Your potential partner may interpret reluctance to share as hiding, so when you can't share information, explain why. Signal you're engaged and want to learn more by asking questions. Trust is a two-way street. Are there differences in how people build rapport and trust in person versus online? During the pandemic (in the fall of 2020), we went back to the same managers we spoke to before to ask how they developed new relationships and made trust decisions virtually. A manager from Brazil said they found ways of keeping the spirit of face-to-face using technology, as talking to someone online is the same way to make a connection. Could virtual reality (VR) and the virtual office help bridge the geographic divide? Engineers and scientists I've interviewed for other research reacted negatively to the idea that VR could replace or substitute for face time. Personally, I'm comfortable using video conferencing, but I've found using a video game character awkward. I like the possibilities, but our ability as humans to get up to speed and be open to it can be a challenge. The reluctance to use virtual technology could be partly generational. When we re-interviewed managers during the pandemic, one manager from Palestine mentioned that his father initially felt the business could survive without using technology. However, when it was time to make a serious business decision, his father would ask: "Can you send an email or do something?" What advice can you share for managers of international tech teams? Other research shows challenges in inter-cultural teams include violations of respect or hierarchy, prejudice and lack of common ground. Communication styles vary – in East Asia, it's more indirect, but in Latin America and the Middle East, it's more direct. Don't leave anything to chance. While putting together this charter, your conversations will help define how you'll deliver. If someone doesn't show up to a meeting, what happens next? A shared team mental model about what to expect reduces uncertainty. Nothing is perfect, but the charter negates some pitfalls by getting collective agreement.
earning customer trust

Earn customer trust with ‘inside out’ business values

  • min read
    • I've particularly noticed two business trends since the pandemic. First, people aren't rushing back to work – whether it's called the Great Resignation or Great Reshuffle, we're thinking hard about where and why we work. Second, we've become more dependent on, and aware of, technology and how it's shaping narratives in society. Tech can earn business gains in efficiency and productivity, but there's no shortcut to earning trust. Fuelled by mistrust in media and government, public trust is declining. There's an opportunity for businesses to lead in regaining public trust, and I believe they should start with their employees. Distrust has become the default The pandemic sparked fears about personal and societal issues. There are existential concerns like climate change and growing worries about personal freedoms and economic security. This anxiety and insecurity make it hard to trust. The Edelman Trust Barometer surveys 36,000 respondents in 28 countries on their relationship with business, government and the media. The 2022 Barometer shows distrust has become the default, especially distrust of government and media. Who people trust has become more local, like co-workers and neighbors, and distrust of outsiders has risen. The business of raising trust Trust has long been weak in media, but the Edelman Trust Barometer showed trust in government has fallen around 25 percent between 2020 and 2022. Trust in business meanwhile stayed at about the same level. People are looking to business to tackle big issues rather than their governments. It's an opportunity for business leaders, but not those who picture nothing more than trust-promoting marketing operations and communications ploys. Cutting through the fake The public sees CEOs and business leaders with a wary eye. Between 2021 and 22, those who said they worry business leaders are intentionally misleading people went up to 63 percent. Similar concerns about journalists (67 percent) and government leaders (66 percent) have risen too. Build trust from the inside out The Edelman Trust Barometer found employees tend to give credence to their CEO. But what about your employees? It's worth doing an anonymous internal survey to find out how much they trust your company. Internally, transparency is an excellent way to earn confidence. Show faith in your employees and give them accurate information about your strategy and intentions. There are, of course, limits to how transparent businesses can be. You can't divulge intellectual property secrets or make big announcements before an earnings report as a publicly-traded company. But the way you operate and communicate internally must be consistent with how you want customers and stakeholders to see you. I call this the 'inside-out' model: What goes on at the core radiates out through the value chain. The core is your executive and employees. Moving out from the core are your ambassadors, distributors and suppliers. The next level is customers. Demonstrating consistency over time – from the inside out – will mean greater trust. Gain trust the old fashioned way: Earning it I have seen these three leadership attitudes matter when it comes to instilling trust throughout your organization and value chain. First, when possible, under-promise and over-deliver – for example, in marketing promises, delivery dates and product performance. Second, have a karmic attitude – giving without expecting anything in return. A transactional approach, based on equal exchange, means no margin for 'extras,' and can rapidly decline into an adversarial relationship. A karmic attitude builds up credit. Marcus Sheridan built a successful swimming pool business by giving away relevant and honest content. Credit is important over the long haul if you need forgiveness for an error. Unexpected things happen, and there are unavoidable, big-picture issues like global supply chains breaking down and wholesale price rises. Third, bring your company's purpose to life and ensure it impacts your behavior, language and decision-making. The most important audience is your employees: Ensure they clearly understand and experience the company purpose and vision – many employees say they don't fully understand theirs. However, avoid overselling your purpose – it's better to understand your limits than to promise something you can't deliver. Strive to live up to what you say. Admit mistakes and be honest about your failings. This will help build trust and engender loyalty. Overcoming the challenges of tech and trust As businesses grow, they need more tech to help manage many customers and workflows. Many organizations are starting to use artificial intelligence (AI) to support customer relationship management (CRM,) customer service and eCommerce. While there are great uses for AI, issues around data privacy, invasive personalization and bias are legion. You need a solid ethical framework to manage these. Using empathy to understand the employee and customer journey better is vital. And to be trusted, especially with AI, you must have a firm grasp on the outcomes you want. For example, when using chatbots to augment customer service, tell your customers what kind of agent they're dealing with (bot or not) and be alert to when a human agent must step in to ensure the best customer experience. There's no shortcut to building trust. It takes a concerted effort across the organization. If you've built a loyal and trusting partnership with your employees and stakeholders, they'll be your best ambassadors and be more forgiving of your mistakes. Be vigilant when trust starts to erode: Trust is hard-earned and quickly lost.
trust customer privacy

You need these two ways to win customers’ data privacy trust

  • min read
    • Business sees trust in data privacy as a panacea. Companies that foster customer trust see more customer engagement and willingness to share valuable personal information. But what do we mean when we talk about trust in data privacy? What are privacy experts advising companies to do when they recommend building trust? It's one of the driving questions behind my book, The Intelligent Marketer's Guide to Data Privacy: The Impact of Big Data on Customer Trust. Most guidance around instilling trust doesn't adequately explain what trust is, or how to develop it. In researching companies that use privacy as a competitive advantage, I found two types of trust are key. First, customers must trust the company is competent and skilled in protecting their data. Second, they must trust the company's reasons for protecting their data are customer-centered. Although each type of trust is valuable alone, developing both is optimal for customer and business outcomes. Be capable of delivering what you promise The Oxford English Dictionary says trust is "belief in the reliability, truth, ability or strength of someone or something." This definition links trust with data privacy capabilities. For a company to position itself as strong on data privacy, it must have the skills and competencies to be effective in security and protection. For enterprises, this means having resources like data security teams or systems in place, and a talented chief privacy officer (CPO.) You should find it relatively easy to implement (and exceed) privacy regulations. For smaller firms, demonstrating responsible data handling across all interfaces and processes strengthens customer trust in your privacy capabilities. Trust in your company's data privacy abilities also involves your history with data protection. Strong claims about protecting customer data privacy seem suspicious if you've had a well-publicized data breach in the past. But my research found organizations that have suffered a data breach can recover trust by giving customers transparency and control. Ensure you're honest about past lapses when encouraging customers to trust your data protection capabilities following a breach. Be privacy-conscious for the right reasons Customers must also trust your data privacy position is for the right reasons. If trust in your ability to uphold privacy is the cold, rational side of trust, trust in your intentions is the warm, fuzzy side. Ways to build trust in your company's data privacy motivations are less clear and may take longer. This kind of trust is linked to reputation, so just one negative event can deteriorate it, with a long, hard road to redemption. My research found many prominent technology companies suffer from this deficiency in trust. Large firms with ample resources for strong data protections may not necessarily find customers like their privacy stance. For example, even before the Cambridge Analytica scandal, Facebook (now Meta) wasn't well regarded for its privacy practices. When companies like this talk about privacy, customers tend to distrust their reasons. This trust deficit around big tech may present opportunities for small or new tech companies to make a mark, differentiating themselves through customer-centered privacy values. Building customer trust is key to creating value through smooth exchange of personal information and building long-term, mutually beneficial relationships. Businesses of all sizes should pursue customer trust. But, before devoting resources to building trust in data privacy, your business must understand what trust involves. Trust implies distinct company behaviors and practices. Carefully managing trust and not taking for granted what trust you already have, is key to leading on privacy.
global transparency

The tech industry can’t go on this way. Here’s how it must change.

  • min read
    • If you're creating or investing in new technologies, today's landscape – with increasingly complex data regulation – can be daunting. What if shared technology standards and cooperation could help make things safer and better? These perspectives from global digital policy and tech leaders are highlights from Kaspersky's Shaping the Digital Future Summit 2020. Transparency protects technology users Tyson Johnson, CEO, CyberNB "Transparency is fundamental to critical infrastructure like utilities, telecommunications and healthcare working together. We need transparency to build a society that protects the technology user. "Lack of trust in the supply chain is a barrier to adoption, particularly for Incident Command Systems (ICS) and industrial internet of things (IIoT) systems. A trustworthy supply chain needs unifying, global standards to decide what technology is allowed. We need to look at cyberspace as a global commons needing global standards." Tech and policy leaders debate transparency in cybersecurity at Shaping the digital future summit, 2020. Welcoming the new tech entrepreneurs Cory Doctorow, journalist and science fiction writer "Interoperability in tech is understood narrowly, but it can be mystical – it's embedded in our world. We can wear different socks and shoes by different makers without asking their permission to swap. "Today, we see the erosion of competitive compatibility. New products that plug into existing products without the maker's permission. Apple reverse-engineered Microsoft's formats to make the iWork suite in 2005. Since then, they've blocked similar attempts from others at interoperable systems with their products. "With the rise of tech monopolies, technologists' horizons have shrunk, but India, the US and the EU all show interest in breaking monopolies. Tech entrepreneurs should set their sights high to dethrone big tech and own a piece of a smaller pie. "Every pirate wants to be an admiral. The state's role is to make sure the tools that made yesterday's upstarts successful are available for the next generation of entrepreneurs. "Would we ever have imagined the internet becoming just five dominant websites? If we don't imagine beyond, we can only try to get them to pull up their (interoperable) socks and behave themselves. We need to learn from former monopolies like AT&T and British Telecom. It's not that executives aren't good at accommodating billions of people's needs – no one can do that. "We need pluralism in services shaped by people who use them. GBWhatsApp, an East African WhatsApp clone with enhanced privacy, is maintained by local people to meet their needs. That's better than transparency – it's transparency plus autonomy. "An overseeing organization can help with standardization. But the answer isn't to try and make Zuckerberg (Facebook CEO) be the best overlord of six billion people he can be. It's to reduce his power. "Anti-competitive business models treat customers as adversaries, like a medical firm that patents an insulin pump that only works with their own-brand insulin. You can't override a policy set by the manufacturer. If a hack causes a malicious act, you can't change it, like this exposed vulnerability in Johnson & Johnson product that could lead to a dangerous overdose. "It's like the 'trolley dilemma' about who a self-driving car would save or kill in an accident. If we ever have a situation where a car may choose to hurt its owner, you're in deep security trouble." Transparency is no silver bullet Jon A Fanzun, Special Envoy, Switzerland's Federal Department of Foreign Affairs "Transparency isn't a silver bullet solution. It's a prerequisite that helps build trust. "Businesses report lack of uniform demand for cybersecurity products. There's a greater need in niche areas, but products are chosen on price and ease of use. In our Geneva Dialogue discussing responsible behavior in cyberspace, we hear concerns about complex regulatory frameworks. "We must develop a baseline of cybersecurity requirements that every organization can apply, and build capacity to help them meet regulatory demands. We need incentives to encourage developers to make more secure technologies, but there also needs to be incentives to buy more secure over lower-cost products." Securing the cyber age Eugene Kaspersky, CEO, Kaspersky "We're living in a world that's becoming more connected. From the Stone Age to the plastic age, technology is taking us into the cyber age. Our precious commodity is no longer physical resources – it's data. "Researchers at Kaspersky see threats increase in number and sophistication. To protect ourselves, we can make products less attractive to hackers as they're so secure the cost to attack outweighs the gain. We call this cyber-immunity. "We're building a world that depends on cyber to support its critical infrastructure, like healthcare and utilities. These systems are vulnerable in their design and deployed as a 'black box' – we don't know what's inside. But cybercriminals can open the box and take what they want. We'll face more cyberthreats if we rely on non-transparent frameworks. Without nations cooperating, it's hard to investigate cybercrime gangs working across borders. "Business leaders tell me they want to store their data in-house, so in case of a leak, they have access. They don't want a 'black box' – they want it to be transparent and accessible to their customers. "Some data should be kept and processed locally, as we've done by opening international data centers with our Global Transparency Initiative. These centers let customers review source code, as cybersecurity is critical for business transparency." Developing a toolkit for global cooperation Ghislain de Salins, Policy Analyst, OECD "The biggest threat of all is ourselves. There's limited cybersecurity awareness in society, but also little cooperation between stakeholders. Ethical hackers or security researchers can be threatened by big corporates when they reveal technology vulnerabilities. This doesn't help build a more secure world. "Cooperation is crucial. We need to shift responsibility to the supply side. A lot of the burden is on consumers to secure their devices, but we now see 'security by design' principles emerging that put the emphasis back on suppliers. "To establish standards, our challenge is an absence of norms. If you sell your product to 13 markets, you need to comply with 13 regulatory frameworks. It dilutes rather than improves security efforts. "Designing policy is like designing software – it's iterative. Try something, and if it fails, change tack. Transparency policy isn't an end in itself. It's a means to empower stakeholders to hold each other accountable. It's not about regulatory frameworks or rigid regulation. At OECD, we prefer to adopt a 'toolkit' with different tools that best fit your policy objective, like voluntary standards and self-certification. We see an appetite for governments to do more, which happens when voluntary frameworks don't go far enough." Build cyber-resilience as businesses go digital Evgeniya Naumova, Vice President of Global Sales Network, Kaspersky "Cybersecurity isn't just about protecting hardware or software. It's about protecting people. Cybersecure systems help protect our workplaces, data and health. Recently, the world was shocked by the first patient death related to a cyberattack. Perhaps it's no surprise – TV and movies have long played out this threat. "Business and society rely on IT systems to function. They need to be cyber resilient. A compromised system causes more than cybersecurity damage – it hemorrhages data, money and customer trust. "You need to strengthen your infrastructure and supply chain, like monitoring your vendor's data usage. We regularly review our ecosystem and give our partners tools to protect themselves. We choose reliable software and security-assessed third-party applications through our Cyber Capacity Build Program. "You can earn trust by being more transparent. Kaspersky asked people in 15 countries if transparency is essential. One in two think governments should be transparent about how they process data. A transparency policy helps, which may contain independent test results and data processing information. Our 2020 survey of businesses found nearly 2 in 5 have no transparency policy. Telecoms and utilities are advancing faster; 68 percent have a policy. But healthcare (57 percent) and government (54 percent) are falling behind. There's more work to be done." Opinions reflect an edited version of those expressed by the speaker at the event.
trust management

Businesses need trust, and trust management is here to help.

  • min read
    • Trust is crucial to personal and professional decisions. It determines which brands we'll share our data with or work with and allows managers to let employees work flexibly. But could trust help us make better decisions about sharing corporate information and IT network access? Workplace mental health expert Dr. Joti Samra says pandemic life has given us "new co-workers:" Those we live with 24 hours a day, seven days a week. My partner Dr. Theo Dimitrakos is a world-leading expert in trust management, currently working in the Trustworthiness Theory, Technology and Engineering Lab, Huawei Europe. He's a much-cited author, Professor of Computer Science at the University of Kent, where he chairs the advisory board of Kent Interdisciplinary Research Centre in Cyber Security and founder of an international trust management research community. Between lockdown chores and deciding who should load the dishwasher – while we wait for Samsung's futuristic new kitchen robot – we had a cup of tea and chat about trust management. Dr. Theo Dimitrakos, Trust Management expert Susi O'Neill: Trust management, from what I hear between the walls, seems complex. What are the basics – how would you explain it to your mother? Theo Dimitrakos: Before retiring, my mother ran an olive oil business in Greece. I learned many skills by helping the family business. In the 1980s, I installed an Amstrad computer in our Athens shop window, showing 8-bit animations to amazed passers. My parents would produce print packaging slips giving measurements of the olive oil's pureness from the state chemical analysis agency. This was before standard classifications like 'virgin' and 'extra virgin' olive oil. Central to trust management is reliability assessment, so parties can trust each other to share data. If I claim my olive oil is 100 percent unrefined virgin oil, you need to be able to check my claim. It helps if I give you a trust statement, like the oil purity label. You need to validate the assessor – in this case, seeing proof from the state agency who is an authority qualified to assess the oil. I can verify your mother's olive oil is delicious. What are some more key concepts in trust management? In the olive oil example, recognizing authority is a key concept which underpins trust assessment. Different methods of measuring trust are also important. My colleague Professor Audun Jøsang, who invented subjective logic, created a calculus for computing in trust networks. It's now combined with decision networks to measure trustworthiness in neural networks. Trust-based decisions inform how an intelligent agent program makes final purchasing decisions using data. Professor Harrison McKnight, my co-editor for Trust Management VI, developed a cognitive model to explain the process. Another fundamental of trust management is trust negotiation: Incremental information disclosure. Organizations must take care of what they disclose, to whom and how. Releasing information over time can help reach a trust level to share more valuable data for a common goal. Trust negotiation can help decide how to share credentials to achieve the least-privilege principle (users can only access the parts of the system or data they need for their job) to implement the zero-trust security model. Trust negotiation algorithms do this and more. Before you let someone have privileged information, you may want to check their security clearance. In an IT system, you may want to share as little information as possible for the task, then let the system ask for more information when you need higher-level access. How did you become interested in trust management? After gaining my Computer Science Ph.D. at Imperial College, London, I worked at a UK government computing lab. We experienced the first dot-com bubble crash around 2001. People lost trust in tech businesses. I felt I had to take action, so I got involved in an international partnership between government, academics and industry to improve trust between customers and companies. In 2002, with the late Christos Nikolau (IBM and University of Crete,) we established iTrust, an interdisciplinary network including experimental economists, philosophers, and cybersecurity and access management specialists. Trust management previously meant identity and access management for IT networks. We broaden it to include models for measuring and increasing trust and consumer confidence. I found the experimental economists' research particularly interesting. Microeconomics Professor Claudia Keser wanted to look at giving incentives for supplying data. We now see that in practice as people trade their data for free online services. In 2004, I led an international applied research project that developed a framework for managing trust when sharing sensitive data between organizations. The research informed web services trust protocols in use and created a start-up that's now a market leader in dynamic authorization. My interest in trust management continues. At the forthcoming IFIP conference, I will present new methods to authorize and change a person's access depending on their situation. For example, if they're working at home and others are present who shouldn't have access to sensitive documents, or they're trying to evade detection when taking photos of confidential documents on their computer screen. How has trust management evolved since then? There have been significant developments and new identity verification models, virtual organizations and consensus-based decisions. There are now more decentralized ways to create digital identities, share and verify them without violating privileges, nor the identity provider needing to track who's used them. How does this relate to decentralized data models like blockchain? Blockchain's decentralized trust model has distributed credentials and verifiers. It can be used to implement a trust model, but it's not the only way to implement trust management today. Credentials verification is a model promoted by W3C – the community that sets global open web standards – for verifying web information. It has nothing to do with blockchain but can be used alongside it. My colleague Professor David Chadwick, a co-editor of the standard, highlights this distinction. Blockchain or not, it means someone can prove your credentials without assuming a centralized authority, the party and identity provider issuer know each other. And you could use someone's credentials without the identity provider tracking what you do – for example, when you share your identity documents to open a new bank account or use a trust-led community like Airbnb. If credential verification becomes popular, big tech firms like Google will be less able to track us. How can businesses establish a suitable trust management model? Knowing your business means understanding its processes and data flows with suppliers, incentives for users and which authorities regulate your data or services. Understand your relationships, model them, design your system, then make it secure. Apply security from concept to deployment. How can businesses use trust management to improve IT security? Trust management predates zero trust and will probably outlive it. Zero trust integrates different decentralized trust models. It's becoming popular because of how technology has evolved: Our work environment has become more decentralized with cloud computing, remote working and data sharing. Zero trust is about decentralized trust models, fusing trust authorization and verification versus reliability. It means you need to check your assertions about someone rather than rely on another authority to validate them. You need to examine the subject and score them, then use that score and the outcome of your trust algorithm to decide what systems and information they can access. Now we can measure trust, so your decisions must be calculated. You can have verification like digital signatures, behavior analysis, biometrics, or a combination. This creates a trust score for each entity that should be linked to your access management policies. Authorization becomes dynamic and continuous. This is often overlooked when considering zero trust strategies for security and access control that only focus on prevention. As trust values change over time, authorization levels and access must change. You may need to increase, reduce or revoke authorization previously given. With Dr. Fabio Martinelli, Vice-Chair of the European Cybersecurity Organization, we recently developed a lightweight enabling technology for network gateways and consumer internet of things (IoT) devices that combine dynamic authorization with an evaluation of trust levels. I hope this helps zero trust models go beyond corporate networks to smart homes and data usage control. Excellent! Now I feel suitably informed about trust. So in place of the dishwasher robot, can I use a trust management model to make sure you do this? Yes, but we first need to set up an algorithm and scoring method, agree on incentives and maybe a consensus protocol. Perhaps technology models can't solve all our challenges yet. Opinions are those of the interviewee and do not represent his employers (corporate or academic).
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries