Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
10/13/2016
11:42 AM
Carl Woodward
Carl Woodward
Partner Perspectives
50%
50%

Access, Trust, And The Rise Of Electronic Personal Assistants

App and device makers are working hard to deliver user control over privacy.

“You should leave in five minutes for your next appointment.”

“Traffic is heavy, leave at 11:30 for your flight to San Francisco.”

“Remember to buy bread and eggs.”

All of these reminders are commonplace today, thanks to electronic personal assistants on your phone, tablet, and computer. These aides get information from your emails, calendar entries, location, and other observations about you, your environment, and the immediate context. The more integrated they are with other apps and sources of data, the more effective they can be. But what about your privacy?

A human personal assistant can be the most valuable and trusted person in your life. The ultimate assistant not only knows your preferences, but can anticipate your needs. Like the emerging electronic ones, human assistants read all of your correspondence, know the full details of your calendar, and are privy to most aspects of your business and personal lives. But they have also been a source of gossip and intimate details for centuries. Non-disclosure agreements and lawsuits are still no guarantee of trust or confidentiality, and they cannot un-publish the tell-all book or interview. Trust is developed over time, based on experience and our personal judgment.

Electronic assistants are not really much different. What is different is their level of access and our control over the information and privacy settings. How do you give access and trust to a personal assistant app and its extended ecosystem, especially one whose priorities may be different from yours?

A fun and only slightly futuristic example could be asking your assistant to “Please book a skydiving experience for my anniversary.” In order for the personal assistant to make a good choice, it needs to know:

  • How much money you have in your bank accounts
  • If you have any bills or commitments coming up
  • What your calendar looks like for the suggested date
  • If you have any health issues that would prevent you from participating safely
  • If your partner is likely to think this is a good way to celebrate

Obviously, a security breach when there is this much data involved could be catastrophic.  App and device makers are working hard to deliver user control over privacy. There is a long list of settings available, as well as pop-up approvals for some types of data access. Using this power is an essential part of building a trustworthy relationship.

Next is data sharing among the ecosystem. Unlike your human assistant who is paid by you, your electronic one generates income from multiple sources, including ads, sales commissions, and selling your information to third parties. When you ask for dinner reservations, travel bookings, or other services, are you getting the best deal for you or the optimal deal for the ecosystem of partners? Does your assistant isolate different types of data, or are advertisers able to determine what you are doing, where, and with whom, perhaps to your detriment or embarrassment?

Finally, there is the role of personal assistant as gatekeeper. We are all familiar with human assistants that have controlled access to their principals, unnecessarily influenced information flow, or isolated them from their surroundings. An electronic assistant may be able to do this not only more subtly, but at the direction of ecosystem partners to their benefit.

Carl builds the future with the Office of the CTO's Innovation Pipeline Team in Intel Security. He is a security veteran with five years of top secret UK government experience, five years with his own company Sanctuary Software Limited, and over six years with McAfee/Intel. ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/1/2020
9 Tips to Prepare for the Future of Cloud & Network Security
Kelly Sheridan, Staff Editor, Dark Reading,  9/28/2020
Attacker Dwell Time: Ransomware's Most Important Metric
Ricardo Villadiego, Founder and CEO of Lumu,  9/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-24860
PUBLISHED: 2020-10-01
CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website.
CVE-2020-24861
PUBLISHED: 2020-10-01
GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is executed when you create and open a new page
CVE-2020-25990
PUBLISHED: 2020-10-01
WebsiteBaker 2.12.2 allows SQL Injection via parameter 'display_name' in /websitebaker/admin/preferences/save.php. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
CVE-2020-8109
PUBLISHED: 2020-10-01
A vulnerability has been discovered in the ace.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. This can result in denial-of-service. This issue affects: Bitdefender Engines version 7.84892 and prior vers...
CVE-2019-20902
PUBLISHED: 2020-10-01
Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from before version 3.4.6 and from 3.5.0 before 3.5.1.