Information Security Risk Assessment of Smartphones using Bayesian Networks

Abstract

The amount of smartphones in use has grown exponentially during the last decade, and with this growth, users have become vulnerable to a new realm of information security threats. Although the security of desktop and laptop computers is relatively common knowledge, smartphone security is not as well understood among end-users, and has not been studied extensively. This thesis comprises an information security risk assessment of smartphone use in Finland using Bayesian networks.
\n
\nThe primary research method in this thesis is a knowledge-based approach to building a causal Bayesian network model of information security risks and consequences. The risks, consequences, probabilities and impacts are identified from domain experts in a 2-stage interview process with 8 experts as well as from existing research and statistics. This information is then used to construct a model which is flexible and lends itself to different use cases such as sensitivity and scenario analysis. This model can also be extended when new data becomes available.
\n
\nThe results show that smartphone use is accompanied by a wide variety of different information security risks such as advanced shoulder surfing techniques and unintentional data disclosure through legitimate applications. Although some risks are difficult or impossible for the user to control, most risks discussed in this thesis are strongly dependent on the user’s actions. Therefore, there is a need for increasing security awareness among smartphone users.