Tanja Ažderska

Jerman Borka
email: borka@e5.ijs.si

Blažič

Trust as an organismic trait of e-commerce systems

Keywords: trust, e-commerce, organismic, complex, responsibility, context

The behavior patterns resulting from the interactions of many trusting entities in e-commerce systems are often more complex than the performance of each of the individuals separately; thus, simple rules of trusting behavior give rise to complex, emergent patterns. A major reason these emergent properties were neither successfully captured nor adequately treated by the current formal models is the global trend of addressing technical issues in a mechanistic mannerconsidering the system merely as a sum of its components and neglecting the interactions between those components. This work introduces the concept of an organismic property of human-centric e-commerce systems and reveals new areas of applicability of trust as an organismic system-trait. We find that the current schemes of modeling trust in e-commerce systems disregard the role of diversity, complexity, and a service provider's responsibility, concentrating mainly on the relationship among the service consumers. The higher purpose, however, is to provide a novel view of analyzing trust-related design-issues, and to give notice of the possible consequences from a systemic ignorance of these issues in e-commerce systems.

Introduction

An inherent "misfortune" related to social trust-phenomena in e-commerce and marketing systems is that:

 Trust is generally too complex to be even intuitively grasped, let alone formally analyzed; and  When it comes to representing its properties through various technicalities and formalities, they are often greatly simplified for the sake of practical feasibility.

Marketing phenomena represent the collective result of many individual entities (consumers, sellers, distributors) whose motivations and actions, although combined by simple behavioral rules, manifest in a manner that produces surprising patterns of global and group behavior [START_REF] Granovetter | Threshold Models of Collective Behavior[END_REF], [START_REF] Axelrod | The evolution of cooperation[END_REF]. Moreover, these aggregate patterns feed back to affect the individuals' choices. Thus, consumers can make buying decisions based on their acquaintances' advice or their social network's recommendations, which affects the diffusion of products and ideas, and in turn influences the dominance of a brand in a market. However, the predominant brands also affect an individual's decisions as to which product to purchase or which idea to adopt. The diffusion patterns that result from the interactions of many entities may be, and in fact ARE more often than not, much more complex than the behavior rules of the individuals. There are many reasons why such emergent properties are not captured and adequately treated by the current computational and formal models. Among those with highest relevance, but also greatest subtlety, is the trend of addressing technical design issues in a mechanistic manner, considering the properties of a system as a whole to be traceable to the properties of its parts. On the other hand, there is another, even more pronounced trend of merging together aspects of systems of different nature into a single operational whole. The purpose is to produce human-centric systems that would integrate the functionality of the emerging technologies with the self-organizing nature of human societies. In its most obvious manifestation, this trend can be viewed in the advent of social networks, electronic services, e-commerce systems, and smart cities, all coming under the umbrella of the Internet of Services and Things. The earlier, mechanistic, view on computational systems is rooted in the engineering contexts in which a system's behavior could be predicted by knowing the behavior of the system's components and their operational ranges. Such systems are, for e.g., the factory plants, or wireless sensor networks, consisting of many devices with known physical characteristics and specifications, and predetermined communication protocols. However, for the later trend, this approach is rendered useless, and moreover, points to a possibility of a serious systemic ignorance if the mechanistic view was to continue. An example for this would be: providing a platform for user to interact, contribute content, and even create new products, but not accounting for how the collaborative, competitive, and monetary elements implemented by the providers affect the users' actions and their interaction with the system.

What constitutes an emergent property; what are the conditions in e-commerce systems that give rise to such properties; how their manifestation affects the system; and what trust has to do with all this; are some of the questions that this work tries to answer. Hence, one of our contributions to the current research on e-commerce trust systems is the detection and analysis of the factors that bear responsibility for the emergence of some unintuitive patterns in those systems. More importantly, our work reveals trust as a core aspect of the solutions for the issues of increased complexity, non-accountable authorities, and user bias.

To meet the stated goals, the paper is organized as follows: we first define some basic terms and give a multi-disciplinary overview of the efforts to tackle trust-related issues in an online, particularly e-commerce setting. As we fit our work into the state of the art, we outline the major issues that dictate the need for an organismic view on trust and point out the significance and benefits of such a view. We then detect new key-roles that trust can play in dealing with the identified issues. Section 4 concludes with constructive summary, pointing towards some future directions.

Basic Concepts and Related Work

For the sake of clarity, we now briefly define the basic terms that will be employed throughout the remainder of the paper.

Basic Concepts

Large body of work have shown and analyzed the intricacies of understanding and making trusting choices [START_REF] Kahneman | Maps of Bounded Rationality: Psychology for Behavioral Economics[END_REF][START_REF] Ariely | Predictably Irrational: The Hidden Forces That Shape Our Decisions[END_REF][START_REF] Castelfranchi | Trust Theory: A Socio-Cognitive and Computational Model[END_REF]. Complementing this with what we elaborated above explains the hard time researchers have to incorporate trust into online settings analogous to those from the traditional networks. However, following Gambetta [START_REF] Gambetta | Can We Trust Trust?[END_REF], we give:

Definition 1a. Trust is the subjective probability that an entity will perform in an expected and beneficial manner, restraining from doing unexpected harm.

Considering trust only as a subjective probability leaves out risk as an important concept related to trust. This fact has catalyzed a vigorous debate between economists and social psychologists [START_REF] Castelfranchi | Trust Theory: A Socio-Cognitive and Computational Model[END_REF]. When one entity relies on another, trust choices are inevitably coupled with risk. Thus, borrowing from Josang [START_REF] Josang | A survey of trust and reputation systems for online service provision[END_REF]: Definition 1b. Trust is the extent of willingness to depend on others' decisions and actions, accepting the risk of undesired outcome.

Despite the generally interchangeable use of trust and reputation, we differ between the two and recognize the role of reputation mechanisms as technical facilitators for managing trust.

Definition 2a.

Reputation is the general standing of the community about an entity's trustworthiness, based on entities' past behavior, performance, or quality of service, in a specific context.

Definition 2b.

A system that facilitates the reputation foresight and the trust management is called a reputation mechanism.

Next, we provide an interdisciplinary overview of the approaches for tackling trust issues in e-commerce context, and identify the major issues that will be tackled by our work.

Related Work

Trust and the Need for Accountable Providers. Significant amount of the efforts for formalizing trust-based interactions employed to design and analyze e-commerce systems is rooted in Game Theory, where concepts like risk, cost, and utility are formally defined [START_REF] Chin | On application of game theory for understanding trust in networks[END_REF]. There, the fundamental trust-related problems are captured by the Prisoner's Dilemma; it is a principle that demonstrates the tradeoffs in people's decisions to behave either in their own interest, or in a manner that contributes to the overall community welfare [START_REF] Fudenberg | Game Theory[END_REF]. Prisoners' Dilemma has been extensively used to analyze the incentives for accumulating social capital, as well as the importance of repeated interactions in inducing cooperation. However, Prisoner's Dilemma per se is not able to account for the eventual presence of an 'authority figure' that might impose its controls or affect the decisions of the system entities, regardless of the given payoffs for their actions. Therefore, additional insights are required into how the presence of an authority and the actions made by that authority affect the decisions and interactions of the individuals that are part of the same system hierarchy. In the case of e-commerce, it implies a need to account for the strategic games between different service providers, as well as the policies they establish within their platforms, in addition to analyzing the actions of and the interactions between the users. In the effort to account for these issues, we bring to the front another type of Game Theory problem known as the Colonel Blotto game [START_REF] Roberson | The Colonel Blotto game[END_REF]. The Colonel Blotto captures strategic situations in which players attempt to mismatch the actions of their opponents by allocating limited resources across domains in competitive environments. The game consists of the following: two players allocate resources to a finite number of contests (fronts); each front is won by the player who allocates the greater number of resources to it, and a player's payoff equals the number of fronts won. Thus, a player's goal is to strategically mismatch the actions of its opponent. In short, if lower amount of resources are available compared to the opponent, it pays off to increase the numbers of fronts. Despite the desirable characteristics of altruism and cooperativeness in the interactions between two parties, it is reasonable, especially in an e-commerce context, for competition to be analyzed by different means than those used for studying altruistic cooperation. In this work, we attempt to connect such games of strategic mismatch to the current trends of development of e-commerce systems in order to reveal a new role trust can take in e-commerce systems.

Moving the scale from an individual's to a societal perspective, Ba argues that it is often the actions driven by the people's sense of community that contribute to outcomes that improve the community welfare [START_REF] Ba | Establishing online trust through a community responsibility system[END_REF]. Moreover, if members are held responsible for their actions, there is a much greater pressure to adhere to the rules. Fehr and Gächter have shown that, if given the opportunity, individuals vigorously punish selfishness, even if inducing punishment is costly [START_REF] Fehr | Fairness and Retaliation: The Economics of Reciprocity[END_REF]. This reveals the potential of trust mechanisms for sanctioning undesired behavior, especially when the possibility of post-contractual opportunism creates a context of moral hazard. On the other hand, distributing the control only among the community members and entrusting them the role of a regulation mechanism of the system evolution forces the system to rely on their subjective view-points, interpretations and actions. Exposing the community welfare to the subjective views of the entrusted members is not a negative thing in and of itself. However, without the means for monitoring and accountability, such an ideology is often considered as the ultimate cause of degradation of the system's work and hierarchy. Makridakis and Taleb have already elaborated on the limited predictability and the high level of uncertainty in various areas of science, and life in general [START_REF] Makridakis | Decision making and planning under low levels of predictability[END_REF]. There is a remarkable body of empirical evidence speaking about the disastrous consequences of inaccurate forecasts that are distinguished by three types of predictions: those relying on patterns for forecasting, those utilizing relationships as their basis, and those for which human judgment is the major determinant of the forecast. Online trust systems are designed to rely on all the three.

Trust and Complexity Reduction. When it comes to traditional societies, one of the crucial roles of trust is reducing the complexity that may arise in social interactions [START_REF] Luhmann | Trust and power: two works[END_REF]. In that regard, the potential of employing trust mechanisms for dealing with information asymmetry was recognized long ago. As argued above, in the context of moral hazard, trust mechanisms are employed for sanctioning undesired behavior. However, there is another type of information asymmetry, which arises when an entity is required to choose a transaction partner whose behavioral type (for e.g., good or bad) is unknown in advance, i.e., adverse selection. In his seminal work, Akerlof analyzed the effect of social and trading reputation on transaction outcome and market maintenance [START_REF] Akerlof | The Market for 'Lemons': Quality Uncertainty and the Market Mechanism[END_REF]. He demonstrated that goods with low quality can squeeze out those of high quality because of the information asymmetry present in the buyers' and sellers' knowledge about the productsthe problem of the so called "lemon markets". Trust mechanisms would balance this asymmetry, helping buyers make betterinformed decisions by signaling the behavior-type of sellers, but at the same time they would provide an incentive for sellers to exchange high-quality goods. Thus, Akerlof makes an instructive distinction between the signaling and the sanctioning role of trust systems, which was only recently considered in computer science [START_REF] Dellarocas | The Digitization of Word of Mouth: Promise and Challenges of Online Feedback Mechanisms[END_REF]. However, all the models that deal with information asymmetry in an online environment rely on probabilistic signals, but also output uncertain values of the variables representing the entities behavioral characteristics. This reveals that it is absolutely non-trivial to determine and appropriately aggregate the different types of signaling information that can be obtained from trust systems. Furthermore, it points to the need to account for the signals from online trust systems through various mechanisms, depending on the nature of those signals. In this paper, we set the ground for how such analyses could be carried out, although we leave the formal justification as future work.

Trust and Collective Wisdom. Despite the significant work done on signaling in economics and contract theory, the online environment poses additional requirements if the same ideas are to be employed. The operation of online market places depends highly on the collective actions of the individual entities (agents, consumers, sellers, distributors, etc.). Incorporating human elements into the technical workings of ecommerce systems leads to the emergence of complex patterns of group behavior that are not necessarily a product of the rules governing the individuals' behaviors. The high discrepancy between the users' expectations and the e-commerce system performance still sustains and is resembled by different forms of bias manifested in the results obtained from the trust systems [START_REF] Chevalier | The Effect of Word of Mouth on Sales: Online Book Reviews[END_REF][START_REF] Kramer | Self-Selection Bias in Reputation Systems[END_REF][START_REF] Dellarocas | The Sound of Silence in Online Feedback: Estimating Trading Risks in the Presence of Reporting Bias[END_REF][START_REF] Shen | eBay: an E-commerce marketplace as a complex network[END_REF]. However, biased results may not come from biased inputs by the individual entities. The whole chain of dependencies in the e-commerce system has to be considered to determine the causal loops that appear between the system inputs and outputs and to prevent reinforcement of this bias in a cascade manner. Our work will establish the bond between computational trust and the exploitation of "the wisdom of crowds" in e-commerce systems [START_REF] Surowiecki | The Wisdom Of Crowds[END_REF].

Moreover, it will detect the detrimental role of dependent and non-diverse opinions in exploiting the benefits of "the wisdom of crowds" and the emergence of user bias.

Despite the early work on trust relations and conflict resolution in Game theory, the notion of computational trust appears significantly later, when Marsh established its formal basis in distributed artificial intelligence [START_REF] Marsh | Formalising trust as a computational concept[END_REF]. Although distinguished by its simplicity, Marsh brings the substantial finding about the agents' tendency to group into robust clusters with similar trustworthiness and interests. However, he makes no distinction between groups and individuals and the different properties they exhibit, considering groups as entities that equally encounter and resolve trust choices as the individuals comprising them. Thus, the micro-behavior of the system entities are considered to resemble the macro-effects of the overall behavior.

The following section introduces the notion of an organismic property of trust systems, analyzing its importance for the design of human-centric e-commerce systems dependent on the trusting choices of their entities.

3

The organismic nature of trust

In a previous work of ours [START_REF] Ažderska | A novel systemic taxonomy of trust in the online environment[END_REF], we analyzed trust systems through the General Systems Theory [START_REF] Bertalanffy | General System Theory: Foundations, Development, Applications[END_REF]. Based on the Jordan's System Taxonomy [START_REF] Jordan | Themes in Speculative Psychology[END_REF], we categorized trust systems as functional, organismic, and non-purposive (Table 1), and showed the implications of such a categorization on the overall system's functionality.

Organismic (densely connected)

Here, we concentrate on the organismic property of trust systems, as we consider that the trend of neglecting it endangers the sustainability of any human-centric system, of which e-commerce systems are a major representative.

A main characteristic of organismic (or densely-connected) systems is that they change even when a single connection between their components changes. In contrast, mechanistic systems are not affected by the removal of parts or connections in the remaining components. Remarkable proofs of the organismic nature of social systems can be found in Granovetter's threshold model of collective behavior [START_REF] Granovetter | Threshold Models of Collective Behavior[END_REF], and Shelling's models of segregation [START_REF] Schelling | Micromotives and Macrobehavior[END_REF], both of which show the mismatch between the micro-behavior of the individuals and the macro-effects that appear as a result.

E-commerce trust systems depend highly on the entities' choices and interactions. Their complex nature makes it extremely hard, if not impossible, to predict the impact of these interactions on the system performance. The different types of entities and their differing interests require for each design issue to be analyzed from multiple perspectives.

We now proceed with presenting the major scenarios that dictate the need for an organismic approach of designing trust systems for e-commerce purposes, and define the role that trust plays in tackling the encountered issues.

Reduction of complexity

Luhmann has long ago recognized trust as a means for reducing complexity in traditional social systems [START_REF] Luhmann | Trust and power: two works[END_REF]. However, it is not that trivial to generalize this as an implication for online systems, which are much more dynamic and especially more scalable. Although most of the proposed trust models provide some discussion or evaluation of their scalability (among other performance criteria), scalability is mainly considered a technical nuance of a given solution and is analyzed from the interactions between the system entities. However, it is clear that no system can grow infinitely. Thus, the life-span of the natural (organismic) systems spreads through two major and subsequent phases: growth and maintenance [START_REF] Odum | Fundamentals of Ecology[END_REF]. The resources systems use in the first phase are mainly intended for growth; in the second phase, on the other hand, the systems' resources are employed for maintaining the state and preserving/improving the quality of operation (a quick recall of the human as a system would suffice to realize this). This transition from quantity to quality-based operation is often seamless, prospectively unpredictable, and only retrospectively realizable, which is why the mechanistic trend of resolving systemic issues continues. Hence, the question arises: following Luhmann's view of trust as a means for complexity reduction in a society, can we detect ways in which computational trust reduces complexity in e-commerce systems? One thought in that direction is reducing the complexity of negotiating a transaction, as having a trust system in place implies: finding someone (or information about them), looking at the community's standing (as a signaling device) about their reputation, and deciding whether to transact or not without any prior interaction. But in addition to reducing the complexity, it is clear that it is also the cost of negotiation that is reduced, as the protocol of starting a transaction is significantly simplified. However, this holds only if the information is accurate enough, and is also considered reliable by those who should act upon itin other words, if entities are able to trust the trust information. Therefore, it is not sufficient to only decide what type of information should be loaded into the aggregation mechanisms that compute trust, but also to provide mechanisms that show if the information generated from the system is perceived appropriately by the users. In our future work, this concept will be formalized using a framework of interpreted and generated signals [START_REF] Hong | Interpreted and generated signals[END_REF], which will allow matching the adequate types of trust signals with the various contexts of embedding trust-information in e-commerce systems.

Enrichment and Diversity

The consumer preferences are directly related to the marketing strategies of the service providers. The change in the former often imposes necessary change in the later.

However, users are often unaware of their taste, even for experiences from previously felt outcomes [START_REF] Kahneman | Maps of Bounded Rationality: Psychology for Behavioral Economics[END_REF], [START_REF] Ariely | Predictably Irrational: The Hidden Forces That Shape Our Decisions[END_REF], [START_REF] Kahneman | Subjective probability: A judgment of representativeness[END_REF]. Not only does this mean that taste is much more subtle than preference, but it also shows that preference itself is not a stable property of human reasoning [START_REF] Ariely | Tom Sawyer and the construction of value[END_REF]. In online trust systems, experiments on persistency of user preferences about identical items at different instances of time proved significant fluctuation in the repeated preferential choices [START_REF] Cosley | Is seeing believing?: how recommender system interfaces affect users' opinions[END_REF]. To preserve the dynamics of fluctuating preferences, it is important that an e-commerce system maintains diversity in terms of market strategies, choices offered to their users, the users' behavioral types, their opinions, and the actions they undertake. Surowiecki included diversity as one of the key criteria crucial for exploiting the so called "wisdom of crowds", together with independence, decentralization, and aggregation of opinions (Table 2) [START_REF] Surowiecki | The Wisdom Of Crowds[END_REF]. Although deceptively different, the same analogy holds for evolutionary phenomena; namely, that fertilization leads to enrichment (of a certain species), but also to the loss of diversity of species [START_REF] Odum | Fundamentals of Ecology[END_REF].

As discussed in the Related Work section, a great deal of research has shown that the following major issues are common to all e-commerce systems:

 The largest percentage of provided resources comes from the minority of users [START_REF] Dellarocas | The Sound of Silence in Online Feedback: Estimating Trading Risks in the Presence of Reporting Bias[END_REF], and most of the users act only as "content-consumers", providing negligible amount of resources [START_REF] Pouwelse | A Measurement Study of the BitTorrent Peer-to-Peer File-Sharing System[END_REF];  Small number of system entities drive the general population's opinion [START_REF] Chevalier | The Effect of Word of Mouth on Sales: Online Book Reviews[END_REF];  The presence of the so called herd behavior or bandwagon effect [START_REF] Kahneman | Maps of Bounded Rationality: Psychology for Behavioral Economics[END_REF] is manifested as a group polarization in the individual's online actions [START_REF] Yardi | Dynamic Debates: An Analysis of Group Polarization Over Time on Twitter[END_REF];  The aggregated results from the feedback mechanisms (through trust and reputation metrics) exhibit a high level of positive bias, even in their steady state [START_REF] Kramer | Self-Selection Bias in Reputation Systems[END_REF];  The marketing strategies employed by the companies and media are very often directed towards creating such biased effects in order to gain a large percentage of consumers (be it tangible goods or content as a product) [START_REF] Lieberman | First-mover advantages[END_REF], [START_REF] An | Visualizing Media Bias through Twitter[END_REF].  Current trust systems do allow for obtaining a local view on the entities' knowledge about the behavioral types of their transaction partners, thus ensuring decentralization in the process of inferring trust;  There is a significant body of work on defining a formal apparatus for aggregating trust information. Subjective Logic is among the most prominent, and also one that resembles many of our views about what constitutes a suitable way to cope with the subjective nature of trust [START_REF] Jøsang | A logic for uncertain probabilities[END_REF];  However, the manifestation of group polarization and user bias as a steady-state phenomenon in all the e-commerce systems that are equipped with trust mechanisms implies a clear lack of diversity, and moreoverlack of independence in the entities' actions (including opinions, decisions, etc.).  Finally, the marketing strategies of the various companies and the media additionally amplify the effects of initial mismatch between the users' expectations and online services, contributing to cascading effects of biased behavior resembled by the bandwagon effect.

All of the above observations are a strong testimony for the organismic nature of ecommerce trust systems, as they all show that a single action or change of the systems entities can have a huge impact on the overall system behavior and performance. They also show that exploiting the wisdom of crowds can be strongly inhibited by the externalities that the human element brings into the trust system. This, together with the causal loops through which user bias is amplified in the system [START_REF] Wolf | Feedback Mechanisms, Judgment Bias, and Trust Formation in Online Auctions*[END_REF], point to the need of more subtle mechanisms for capturing trust as an emergent, and not an inherent entity's property.

In a recent work of ours, we performed experimental studies of the factors that influence the users' actions and decisions in online reputation, rating and recommendation systems [START_REF] Ažderska | Co-evolving Trust Mechanisms for Catering User Behavior[END_REF]. We found that increasing the granularity of the Likert-scales (analogous to increased diversity of offered user-choices) and adding a "positive spin" to the presented choices for user evaluations in e-commerce systems can act as an incentive for providing more diverse, but also more accurate feedback. These findings and the theoretical analysis presented in the current paper provide a framework for the formal modeling and analysis of diversity as a requirement for efficient trust systems. This formal model will have as its foundation the Diversity Prediction Theorem [START_REF] Page | The Difference: How the Power of Diversity Creates Better Groups, Firms, Schools, and Societies[END_REF], which connects the crowd's prediction error to the individuals' prediction errors and the crowd's diversity.

Provider's Accountability

In this section, we connect the notion of 'strategic mismatch' represented by the Colonel Blotto game [START_REF] Roberson | The Colonel Blotto game[END_REF] to the current development trends of e-commerce systems and determine the benefits that the accounting for the provider's trustworthiness have for trust elicitation. To do that, we analyze some microeconomic strategies in ecommerce systems, identify the need for a distributed responsibility scheme, and establish trust as a basic accountability measure to respond to this need.

Since the basic setting of Colonel Blotto defines a zero-sum game (one party's benefits equal the other party's losses) in which the winner gets everything, and requires that the opponents have equal amount of resources, using the original model would be misrepresentative of the true nature of market interactions. Therefore, the reasoning employed here follows the generalized analog of Colonel Blotto -"General Blotto game" [START_REF] Golman | General Blotto: games of allocative strategic mismatch[END_REF]. General Blotto's trait of realism lays in the fact that it allows that an opponent has advantage in the number of resources available. Furthermore, it accounts for the additional externalities that can affect the game flow, such as changing circumstances and non-independent fronts. Finally, it extends to an arbitrary number of N players, unlike the original game defined for two players. Because of space constraints, but also because the formal approach deserves special attention and more indepth justification, we leave these analyses for a subsequent work. In what follows, we directly give our analysis based on the insights from the General Blotto game, but we refer the interested reader to [START_REF] Roberson | The Colonel Blotto game[END_REF] and [START_REF] Golman | General Blotto: games of allocative strategic mismatch[END_REF] for justification of the reasoning included here.

Amazon1 and eBay2 are the two largest e-commerce companies, and according to the Web Information Company Alexa3 , their sites are also the two top-ranked ecommerce sites (with overall rank of 10th and 21st place respectively). Among the 100 top-ranked sites, there are only four to five e-commerce sites (this number varies on a daily basis). With highest rank are the ones that are not constrained to a unique product offer (books only or movies only) and that provide a wide specter of products and services. These statistics of the general standing of e-commerce sites among other site-types shows that only a handful of e-commerce sites are prevailing on the Internet. Intuitively, this resembles the network effect of the economies of scale, and is arguably similar to the same effect in the traditional world: big stores squeeze the little stores out of the market by providing a more stable and a more convenient offer with a wider range of available products [START_REF] Sundararajan | Local Network Effects and Complex Network Structure[END_REF]. This is also the reason that we connect these providers' strategies to the games of strategic mismatch. Thus, the same products on Amazon and eBay have been put within a different range of contexts (i.e., fronts), which creates an opportunity for them to be valued differently by the consumers. For example: on Amazon, a book is possible to be published by Amazon, reviewed on Amazon, rated, recommended, sold, bought, stored and backed up, made available on Kindle, shipped by Amazon, processed in some desired way through Amazon's Mechanical Turk 4 , etc. On eBay, on the other hand, the same book can be sold, maybe bid for, bought, rated, or shipped (by a seller). This shows two different strategies of allocating the same resource over various contexts, and has proved to affect the companies' revenues in a different manner. However, it is not only the revenues that are being affected. To support our reasoning, we extracted the concrete feedback about the user's satisfaction from Amazon and eBay. Figure 1 shows that, despite the high popularity of the two companies, the general estimates of their platforms differ to a great extent. This is not to illustrate a lower reputation of eBay compared to Amazon; the purpose of the two systems differs sufficiently for them to be incomparable to one another in many aspects. However, the high percentage of positive feedback and the users' reluctance to leave negative feedback within the eBay and Amazon platforms [START_REF] Chevalier | The Effect of Word of Mouth on Sales: Online Book Reviews[END_REF] [20], points to a discrepancy between the users' adoption of e-commerce services, their satisfaction of those services, and the feedback they provide within the platforms that offer the services. Considering that trust is an emergent property of a system, and a system designer can only provide the circumstances under which trust can flourish, it is reasonable to state that the basic type of trust required for a functional system is trust in the platform provider. Current trust models do not consider combining this form of accountability trust with the trustworthiness traits of the system entities. Yet, there have been important arguments for the benefits that such an approach can have for the reliability of both security systems [START_REF] Schneier | Schneier on Security[END_REF] and socio-technical systems [START_REF] Taleb | How to Prevent Other Financial Crises[END_REF]. This intuition was confirmed by simply querying the web for the "top 25 e-commerce sites". The top two results showed that the user preferences are much better inclined for more specialized sites, with respect to both their offer and their design 5 . Hence, considering such accountability trust as an implicit feedback can provide a distribution of responsibility among all the system entities, including accountability for the service providers. This is especially important as e-commerce systems scale up, because in the transition from growth to maintenance, trust will increasingly act as an emergent qualitative signal.

Discussion

The analyses in this paper contribute to the well-known debate on how people are tuned to think in terms of linearity: to expect growth where there has been a long trend of past growth and to assume double output if there was doubling in system's input. While it is apparent that an organism or a human does not grow infinitely, it is also reasonable to assume that a five-year old (human) is not half a ten-year old one. Also, maintaining a city that has doubled in size requires more than double of the resources spent before its growth, as there is an additional cost of maintaining the interconnections between the system components. The same stands for any humancentric system, regardless of whether it is technical, social, or hybrid. The inclusion of the human element acts as an opening valve of the system towards its environment of deployment, adding complexity in the way the internal structure of the system is maintained. This gives rise to the ascribed non-linearity, expressed as 'the whole not being equal to the sum of its parts'. Thus, an organ exhibits additional properties to those of the cells that comprise it, a human is not a simple sum of organs, a city is more than the sum of its households, and a technical system is neither a mixture of nodes, nor just a union of agents. Among the properties that emerge from the interactions between these entities, trust takes a central place in maintaining quality as the system scales up. However, it should be stressed that neither of these properties is possessed by an entity in isolation of its environment, or of the rest of the (entity's) world; all of them emerge from the entities' interactions in a particular context, at a particular instance of time, under particular cognitive and affective dispositions of the interacting parties. In the same manner, although we can speak about trust relationships between technical systems entities (humans, agents, items, peers, etc.), we should not ascribe to any externality the role to breath trust into a computational setting, or to any internal force the right to preset an entity's disposition to perceive or act upon trust. Otherwise, we would sacrifice the natural diversity that arises in an organismic system, and inhibit the diffusion of opinions and ideas that the system could cherish. Although we may recognize the external and internal factors as such, it is the entities' awareness of the contextual traits of their environment that will determine their trusting abilities and allow the emergence of trust per se. It would not be an exaggeration to therefore state that a mature e-commerce system is one that accounts for the trusting phenome-na emerging from and joining the entities' transactions. Moreover, the efforts to capture these trusting phenomena must also exhibit awareness for the responsibility schema of the actions of all involved entities, regardless of the hierarchical level they have in a system.

Clearly, the interdependency between the human factor and the trust system operation requires additional, more exhaustive and cross-disciplinary research that will confirm and extend the analyses presented here across other types of online systems as well.

Conclusion and Future Work

Despite presenting a multidisciplinary overview of the efforts to tackle trust-related issues in e-commerce systems, this work pointed out the significance and benefits of seeing trust as an organismic trait of e-commerce systems. We revealed novel roles that trust can play in dealing with the issues of complexity reduction, diversity of crowd's opinions, and responsibility distribution, and pointed to the providers' trustworthiness as an important property that should be considered as e-commerce systems transit from scaling to maturing. Finally, we again stress the futility of incorporating trust as an inherent property of online system entities; it is only reasonable to think of creating the conditions under which trust can emerge and flourish. Context is, therefore, a major factor that would inevitably gain attention in the design of future computational trust systems. Although this paper is more a taxonomy of identified factors rather than a modeling effort, it nevertheless bares crucial importance in establishing the borders within which the formal resolution of the problems addressed here is meaningful to be done. All of the identified issues are, therefore, lendable to formal modeling and justification, which will be provided in a consequent and broader study of each of the topics outlined here.

Our future work will also consider an agent-based approach of modeling and resolving trust-related issues in e-commerce systems. Continuing on the same "organismic" note, we will explore the role of redundancy and distribution in the provision of robustness of trust systems, and formalize diversity and conflict as a means for dealing with the issue of user bias. This is especially significant if we recall that a small number of entities drive the public opinion, implying that although current ecommerce systems are robust to failure, they are extremely fragile to targeted attacks.

Fig. 1 .

 1 Fig. 1. Alexa review summary for a) Amazon and b) eBay

Table 1 .

 1 Organizing principles of Jordan's Systems Taxonomy (bolded and italicized are the categories to which trust systems are ascribed).

	Rate-of-change	Purpose	Connectivity
	Structural	Purposive	Mechanistic
	(static)	(system-directed)	(non-densely connected)
	Functional
	(dynamic)

non-purposive (environment-directed)

Table 2 .

 2 Key criteria that separate wise crowds from irrational ones

	Criteria	Description
	Diversity of opinions	Each person should have private information even if it is an eccentric interpretation of the known facts
	Independence	People's opinions are not determined by the opinions of those around them
	Decentralization	People are able to draw on local knowledge
	Aggregation	Some mechanism exists for turning private judgments into a collective decision
	By mapping the above issues onto Table 2, the following can be observed:

http://www.amazon.com/

http://www.ebay.com/

http://www.alexa.com/topsites (this list is based on one-month average traffic rank)

https://www.mturk.com/mturk/welcome

http://kaleazy.com/top-25-best-e-commerce-sites-of-2011/, http://www.smashingmagazine.com/2010/01/22/35-beautiful-and-effective-ecommercewebsites/

Acknowledgments. The author wishes to thank Stuart Clayman, Tomaž Klobučar and Dušan Gabrijelčič for their opinions, critiques, and devoted time for discussions regarding the topics of this work.


Ahlmann Nyre
email: nyre@idi.ntnu.no

Martin Gilje

Usage control in inter-organisational collaborative environements -a case study from an industry perspective

Sharing information between collaborators without relinquishing control of that information has for many years been a tantalizing goal in the research community, but despite application support, the concept of usage control has failed to take hold in the business community. In this paper we present the results of a case study in the Norwegian oil & gas domain. The purpose of the study is to better understand the reasons for the slow adoption rate of usage control technology to control shared information. To this end we investigate risk perception, existing control measures and the attitude towards usage control technology. The study shows that although participants in the case study do not think their information is properly protected, there are several practical challenges that prevent them from adopting usage control technology as a means to improve protection.

Introduction

The extensive collaboration across system boundaries facilitated by the Internet is unfortunately also increasing the potential for misuse of shared information. While mechanisms to protect assets from active attackers (such as firewalls, intrusion detection systems and anti-virus software) are commonplace, the availability of commercial software to protect information from misuse remains limited.

From the research community, usage control has been proposed as a potential remedy to let businesses retain control of information beyond their systems' boundaries [START_REF] Park | The UCONABC usage control model[END_REF]. Since the initial proposition from Park and Sandhu [START_REF] Park | The UCONABC usage control model[END_REF], several usage control models have been proposed, with different strategies of enforcement. Some of the models have even been implemented as prototypes and tested for computational overhead [START_REF] Nyre | Usage control enforcement -a survey[END_REF]. From a researcher's perspective, it seems obvious that usage control would help those that share potentially sensitive information with others. There are even some commercially available products that offer some of the concepts of usage control. Examples in this respect include the EMC 2 Documentum Information Rights Management client 3 , which basically extends the access control policy of the Documentum repository to include all receiving devices. The client verifies in real time that the subject has access to the documents, regardless of whether the document is a copy or not. Similarly, the Microsoft Information Rights Management system for the Office suite integrates with Sharepoint server and offers the same kind of functionality.

However, despite the belief of researchers and the fact that there are commercially available tools to help, the industry seems to be reluctant to adopt usage control technologies. A natural response therefore would be to ask "why"? What is it that makes this seemingly attractive technology not attractive enough? It is exactly this question that formed the basis for our case study.

This paper contributes new knowledge on the perceived usefulness of usage control technology within the oil and gas sector. More specifically, the target of investigation is the vision of Integrated Operations of the oil and gas sector, and thus this is the domain where we will elicit requirements for such mechanisms to ease the transition to technology-based enforcement of usage control. To this end, the study will identify the current measures used to control and restrict shared information together with the perceived threats and opportunities provided by usage control enforcement mechanisms.

The remaining parts of this paper is organised as follows: Section 2 provides a brief introduction to the concept of usage control and distributed enforcement. Section 3 gives an overview of the context of the study -Integrated operations in the oil and gas industry. The design of the case study is detailed in Section 4, including procedures on data collection, analysis and measures to mitigate threats to validity. Section 5 presents our analysis and findings from the study, before we give our concluding remarks and possible future directions in Section 6.

Usage control

Usage control has been proposed as a means to remedy the information misuse problem by extending common security mechanisms beyond single systems such as PCs, servers or entire corporate systems. The idea is to provide a model for expressing and enforcing restrictions on how the information is to be used . Current mechanisms such as access control, Digital Rights Management, confidentiality and privacy protection all attempt to restrict information in one way or the other. The focus of usage control is to create a holistic approach to restricting information, and thus it may be used for any of the purposes listed above.

When introducing usage control Park and Sandhu stressed the notion of a continuous access decision and mutability of attributes as the two most important factors of what they called the UCON ABC -model [START_REF] Park | The UCONABC usage control model[END_REF]. Later, Pretschener et al. included obligations as a fundamental concept of distributed usage control [3]. Unlike the UCON model, the authors define obligations to be concerned with the future, e.g. "data d must not be further distributed" [3]. For the purpose of this study, we focus on the enforcement of usage control policies, particularly with respect to these three central aspects of usage control:

-Continuity of access decision: The decision on whether the subject should be granted access to the requested object is not considered a discrete-time event when requesting access to the object. Instead, the access decision is considered to be continuous, so that any context change (e.g. attribute values) may immediately affect the access decision. -Mutability of attributes: The usage decision may alter attribute values of both subject and object. This will allow for frequency limitations on usage, such as "use at most 3 times". -Obligations: Upon granting usage rights to an object, constraints may be imposed on future usage. Examples include having to delete the information within x days, not being able to forward the information, etc.

One of the fundamental questions when identifying users' attitudes towards usage control is how to enforce it? How can the aspects described above be enforced for distributed information? While there are several proposed enforcement models [START_REF] Nyre | Usage control enforcement -a survey[END_REF] , we focus on the two main strategies of enforcement: proactive and reactive enforcement [START_REF] Nyre | Usage control enforcement -a survey[END_REF]. That is, whether enforcement should attempt to prevent misuse of information or merely detect it. The proactive approach is the predominant strategy for current access control mechanisms as well as commercial Digital Rights Management (DRM) systems, and since usage control may be viewed as an extension of both, proactive enforcement is a natural choice. However, unlike common DRM systems, usage control may also be reactive. The analogy to law enforcement is apparent and also companies' use of Non-Disclosure Agreements (NDAs) follow this principle. Hence, the industry is well acquainted with the reactive approach from existing protection measures. Usage control may contribute a more accurate and cost-effective way of detecting violations.

Context -Integrated Operations

Integrated Operations is a term used in the oil and gas industry in Norway to denote a future state in which work processes, information and people are integrated across geographical and organizational boundaries. Thus, information can flow without unnecessary obstacles from one organisation to another. This is not to say that everything should be open and accessible to everyone; on the contrary, the vision is that the flow of information is secure and only accessible to authorized personnel.

To reach this state of collaboration is not trivial, especially since the relationships between companies are extremely complex and dynamic. To provide a glimpse of this complexity, we provide a brief overview of the main categories of companies.

1. Operators are commonly oil companies and are responsible for the actual production of an oil or gas field. Due to the specialised expertise required for oil field development and production, operators to a large extent use integrators and suppliers to perform specified tasks. 2. Licence owners are oil companies that own a share of the license to develop an oil field. Commonly licences are shared between several oil companies. Thus both costs, risks and future revenue are divided according to the license share. 3. Integrators (sometimes called contractors) deliver complete products and services to operators by combining solutions from different suppliers. 4. Suppliers develop and deliver a specialised product or service for specific tasks, sometimes by incorporating products or services from other suppliers. The distinction between integrators and suppliers is blurred, however the term supplier is used when most of the development effort is done in-house. 5. Consultancies or consultancy firms may be used by any of the above-mentioned actors as support for their activities. For example as ICT developers, technical assessments or advisors.

These categories are by no means exhaustive nor mutually exclusive, and therefore there may be companies that do not fit any description, while others fit several. Still, they serve the purpose of illustrating the complex business relations that currently exist in the oil and gas sector. For example oil companies are competing to gain market share, but at the same time they are collaborating to explore and produce oil. There are even circumstances in which the Norwegian government demands cooperation in order to exploit minor oil fields, that would not be profitable if requiring a separate installation. Similarly, there are several companies that interchangeably between projects acts as both suppliers and integrators. Hence, integrators often find themselves in the position that they are dependent on one of their competitors for delivering according to their contract.

There are certainly other sectors where situations occasionally occur where you have to collaborate with your competitors, but here, this happens constantly. We both cooperate and compete with them simultaneously.

(Engineer from the study)

In addition to the constant collaboration with competitors, there is also a struggle among the companies to extend their product portfolio to get a bigger slice of the cake. With the amount of money involved in the industry, both oil companies, suppliers and integrators may be looking to increase their share of the operation at the others' expense, making the climate for trust a very fragile one.

4 Case study design

Research questions

The main goal of this study is to identify the factors influencing adoption of usage control enforcement mechanisms in collaborative environments.

1. What are the main perceived threats to shared information? 2. Which measures are currently deployed to protect shared information from misuse? 3. To what extent are the current protection schemes believed to be adequate? 4. What are the main opinions on usage control enforcement technology?

These research questions are inspired by the main principle of the Protection Motivation Theory [4,[START_REF] Rogers | A protection motivation theory of fear appeals and attitude[END_REF]. That is, the perceived risk and the perceived efficacy of the mitigating measures influence the decision to adopt the mitigating measures, which in our case is usage control technology. However, since we anticipate that there may be existing mechanisms in place, we have also considered the relative advantage of usage control technology compared to the existing measures [START_REF] Rogers | Diffusion of Innovations[END_REF]. As the focus of this paper is the case study outcome, we will not elaborate more on theoretical underpinnings of the study. For a more complete discussion of the relations to existing theory on technology adoption, we refer to [START_REF] Nyre | On the adoption of usage control technology in collaborative environments[END_REF].

Rationale for case selection

A case selected for a case study is often either a typical case or an extreme case. With our goal of attempting to understand why companies adopt (or don't adopt) usage control technologies in collaborative environments, we chose the extreme case. The rationale behind this was the idea that companies that extensively share potentially sensitive information are more likely to have a conscious opinion on the risks involved. Hence, we assume that in the extreme cases we are more likely to actually identify factors influencing adoption, than in more moderate settings. Indeed, as described in the previous section, the oil and gas industry in Norway in general (and Integrated Operations in particular) fits this description.

Data collection procedure

This study has used interviews as the data collection method. Other options we considered were workshops and focus group interviews. However, requiring people to participate at a certain time and place seemed to be a major obstacle to recruiting participants. This, coupled with our worry that group interviews potentially could prevent people from being sincere about their perception of risk, caused us to settle for individual interviews. We followed a semi-structured interview type on four main topics; shared information, risk perception, current security measures and attitude towards usage control enforcement technology. The interview guide given in Appendix A was used both as a starting point of discussion and as a means to ensure that all four topics were addressed.

Six companies, both national and international, within the oil and gas industry in Norway were selected to ensure a good coverage of categories of actors. Table 1 shows the distribution of participants with respect to both company category and the role of the participants in their company. We sought to cover the

Analysis procedure

All interviews were recorded and later transcribed in full. The transcribed interviews were then analyzed and coded using the constant comparison method [START_REF] Seaman | Qualitative methods[END_REF] to extract the collective view on risks, existing measures and attitude towards usage control enforcement. The process of coding and labeling text was assisted by the use of NVivo TM , a software tool for qualitative analysis.

Validity, bias and limitations of the study

There are several aspects of this study that potentially could have a negative impact on the result. Here we outline the most important ones, and describe our efforts to neutralize the negative effect they would have.

Bias from theory may result in a bias in favour of data supporting the theory on the expense of the data contradicting it [9]. We have therefore refrained from detailing our theoretical framework in advance, in order to reduce the likelihood of theory bias in the interpretation of the results.

Truthfullness of participants' answers may be questioned since the topic of information security by many is regarded as sensitive. There is a chance that participants restrain themselves from revealing problems or anything that might be bad for their reputation. We have therefore made it clear up front that neither participants nor companies would be identified when publishing results. Additionally, since the interviewer is a security , there is a chance that participants may adapt answers to what they believe the interviewer would like to hear or seek confirmation from the interviewer. We have therefore stressed to participants in advance, that the important part of this study is their subjective beliefs. During the interviews we have also strived to remain as neutral as possible (without appearing uninterested), to any of the statements made by the interviewees.

The generalisability of the case may be limited since, as described in Section 4.2, it is an extreme case of sharing sensitive information. That being said, we argue that the size of the oil and gas industry could still provide a great impact even if only considering internal generalisation [9], i.e. generalization within the setting of the study. Admittedly, generalizing on the basis of a relatively small study is not without danger, which is why we have chosen to interpret most of our findings as views rather than facts. A larger scale study or survey based on our findings are likely to provide more statistically sound data for generalization.

Analysis

In this section we present our findings from the case study on the four main topics addressed; information sharing, risk perception, existing security measures and attitude towards usage control enforcement technology. In order to assess the outcome of this study, we also provide a profile of the interviewed participants.

Participant profiles

Table 1b provides an overview of the participants according to the roles they currently have in their company. Notice however, that the distinction between the three types of roles are in some cases a bit blurred. For example, within the engineering discipline there are also managers, and hence separating managers from engineers may not be trivial. We have however attempted to distinguish managers as the ones whose primary role is to manage others. The same table also indicates that only two people interviewed were considered security professionals, i.e. where information security was their primary task. That being said, there were several of both the engineers and managers that had prior experience from securing information systems as part of product development.

Participants' experience from the oil and gas industry ranged from 2 to 20 years, with an average of approximately nine years. Further, all participants had at least a bachelor's degree or equivalent, while the majority additionally held master's degrees.

In terms of security awareness, the participants reported they would rate their security awareness in the upper end of the scale. As one of the managers stated "I am professionally paranoid".

Shared information

The kind of information that is shared among partners within Integrated Operations vary considerably depending on the production phase and the type or category of company. Although the information in itself is perhaps not essential to understand attitudes towards usage control enforcement technology, it does help to understand the risk perception of participants.

For integrators and suppliers the most sensitive information is shared either prior to a project contract or in the planning phase of the project. The most important information shared is information on pricing, offers and technical details required by the operators or partners in the bidding process. Additionally, integrators and suppliers may be required to share technical details and product information in order to integrate their solutions with others.

For operators and license owners, the most sensitive information is shared during the operational phase of the project, whether it is exploration or production of oil fields. Integrators and suppliers will often collect a vast amount of data on the operational status through their systems and transport this information to the operator. Although the data in several cases originates from suppliers and integrators, the data is still considered owned by the operators and is shared with other partners at the operators' discretion. Thus, integrators and suppliers consider it to be information shared by the operators, rather then by them. There is a tremendous amount of real-time data on the status of the operation, such as production volumes, pipeline capacities, disruptions or other events, and status of sensors and actuators and for exploration activities also geological information. Some of which may influence stock prices for oil companies while others may be devastating in terms of company reputation.

Risk perception

Users' perception of risk is believed to influence their motivation for protecting themselves and therefore constitutes the cornerstone of the Protection Motivation Theory [START_REF] Rogers | A protection motivation theory of fear appeals and attitude[END_REF]. The idea is that without any risks, there is no need for protection either. In this section we aim to identify the specific risks related to sharing potentially sensitive information with business partners.

Potential impact There are fundamentally four kinds of potential impact from misusing shared information that seem to be causing concern:

-Reduced competitive power -Shared information on products and technology may be utilized by competitors to improve their products and technology, and thereby reducing the competitive power of the owner of the information. -Reduced market share -Shared information on pricing, tender details and strategies may be utilised by competitors to adapt their pricing in order to gain an advantage in the bidding process. -Reduced reputation in the industry -Especially suppliers and integrators are concerned with the devastating effect it would have if they were responsible for leaking information obtained from customers and partners. Operators also see this as a concern, since it could reduce their suppliers willingness to collaborate to solve future problems. The industry is very much built on trust, and thus if the basis for this trust should disappear, the effects could be dramatic. -Reduced reputation in general -Security incidents resulting from lack of control of information could potentially be very damaging to the reputation of a company from the viewpoint of citizens, government and the world at large. This is particularly due to the potential environmental hazard of oil production. Own and partner employees

Any information Any of the above

Table 2: Identified threats, agents, sources and their potential impact Table 2 lists the main threats with corresponding threat agents (attackers), threat source and potential impact as seen by the participants. Industrial espionage is the single threat that is mentioned most frequently by the participants. It occurs when companies take advantage of technology or product specific information received directly or indirectly from its competitors. The primary effect is that companies lose their competitive advantage relative to their competitors and thus potentially also their market share. For integrators and suppliers, the degree of severity vary with the kind of information abused. According to one of the participants, even interface descriptions might reveal functionality that can be copied. However, acknowledging the need for open interfaces in a competitive industry, the effort is placed on preventing descriptions of the inner workings of their products from being misused by their competitor. Some of the participants have even experienced attempts from foreign national intelligence agencies trying to steal sensitive information.

Participants also highlight the threat of corporate espionage, which is not about IPR or theft of new technology, but rather information on bids, pricing and strategies. Thus, for competitors to gain market share they can adapt their product pricing, bid requirements and strategy to their competitors. While on the one hand participants argued the probability of this occurring, they simultaneously argued that this kind of information was treated with the utmost discretion. Even project members in a bidding process did not know the pricing of the products they were to deliver.

Economic espionage is when the actors exploit operational data and other knowledge of the companies to predict future pricing in the stock market. While participants noted that this threat meant that the operational data was treated as sensitive data, none of them argued that it would be particularly devastating for the company.

Similarly, hacking and activism was not seen as a great threat, at least not to shared information. While this could cause some reputation problems, it was considered to be improbable. One participant noted however that although a lot of the sensitive information would be impossible for hackers to exploit, they could potentially sell the information to competitors that could exploit it.

Several participants however argued both for the probability and possible impact of unintended disclosure of information. That is, that authorized personnel, either in their own company or their partners, would release sensitive information by mistake. For instance by releasing an entire specification rather than just the interface specification to customers. One of the subjects even claimed that "if we could only get rid of the human mistakes, we would probably reduce the incident occurences by 80%", although not all of these incidents would be related to shared information. Another stated that when treating sensitive information "What is really challenging for me is to keep track of the people that already know the secret, and with whom I can discuss matters". Hence, unintentional disclosure may result from simple mistakes, not necessarily lack of security awareness. For integrators and suppliers, it is perhaps even worse if this should occur with an operator's data. As noted earlier, during the production phase much of the data shared by these companies are actually owned by the operator. Being liable for misuse of information is potentially more damaging to companies as it may damage the trust of the customers they are dependent on.

Current security measures

In order to properly assess the relative advantage of any new security measures it is important to know existing mechanisms and understand their strengths and limitations. Thus, we asked respondents to name existing mechanisms for controlling shared information usage.

We have no control, as far as I know, of information and what happens to it, other than agreements and mutual trust.

(Participant in the study)

This statement is representative for all participants in the study. As one of them noted "there are access control mechanisms, but once you have access we have no [usage] control, technical control that is". The predominant strategy is the use of Non-Disclosure Agreements (NDAs) or other contractual agreements restricting the usage of information. Some company policies will not even allow discussions of cooperation without a signed NDA. They are therefore used extensively, and particularly whenever companies share product information. However, for integrators and suppliers this tends to be less important towards new customers.

NDAs used within Integrated Operations are to a large extent kept general and signed on management level, but occasionally, depending on the sensitivity of the data, NDAs are also signed by individual employees for a certain specific project. Needless to say, the employees' knowledge of the actual content of an NDA signed at the company level is not very good. Still, participants claim to have a fairly good idea about what is acceptable and what is not, and that this to a large extent boils down to common sense and contents of security policies.

Within research and development projects, where new technology is developed in collaboration, descriptions of Intellectual Property Rights (IPR) is an important part of the contracts. By explicitly stating the owners of IPR for each component in the system any doubts regarding the ownership are removed and the climate for sharing expertise considerably improved.

Contractual measures seem to be the norm throughout the industry, since only one of the participants had ever experienced that other partners had required any form of usage control technology to be used prior to information disclosure. That being said, one of the companies have introduced usage control technology internally, but this has thus far not been widely used.

The contractual measures are in general viewed to be appropriate and not excessive. However, the process of getting NDAs signed can be time-consuming and tedious, particularly in situations were there are disagreements between companies. And although they provide legal protection from misuse, most participants state that it is not enough. It is considered very difficult to get someone convicted for violating an NDA. As one of the participants argue that "you would have to misuse patentable techology if you were to be convicted in court for telling your new employer". This is also backed up by the fact that none of the participants had ever been involved in either prosecuting or being prosecuted for violation of NDAs or other such contracts. To some extent they therefore do question the practical consequences of protecting information using solely "social and legal measures". That being said, utilizing sanctions as a means to coax people into complying with policies has been shown to effective [10].

Attitude towards usage control enforcement technology

I want to help protect the information by helping users so that they do not have to think for themselves. Use technology in such a way that endusers cannot make mistakes.

(Security specialist)

Based on an introduction to the concept of usage control enforcement, similar to that of Section 2, participants were asked to provide their opinion as to whether this could actually improve the control of shared information.

Apparent benefits Most participants state that usage control enforcement technology definitely would improve control of information, but that these benefits always must be viewed in context with the challenges introduced. We treat the risks and challenges of usage control technology below, but first we outline the main benefits of the technology, as seen by the participants.

-Relieve employees of the need to think.

-Prevents employees from being tempted to misbehave or take short-cuts.

-Ease the process of invalidating obsolete information.

-Revoke usage rights automatically.

-Restrict actual usage of information as opposed to mere access to it.

-Effective detection/prevention of usage policy violations.

Several participants mention that the reliance on employees to enforce usage policy is not optimal. Therefore, it is no surprise that allowing for automatic enforcement is seen as a benefit. Also, participants seem to think that people might be tempted by circumstances to take short cuts or circumvent systems for convenience. Revoking usage rights of potentially distributed information is something that several participants find interesting, since it reduces the gap between centralized and local information. The exact same functionality may be exploited to invalidate obsolete information distributed to partners. Several participants state that one of the fundamental problems of shared information is ensuring that all collaborating partners have the latest revision of it. Hence, if one could invalidate information that would force people to obtain the latest revision.

Restricting usage (e.g. printing, forwarding, copying) is also mentioned as a clear benefit together with the improved effectiveness of detecting or preventing (depending on the type of enforcement) usage policy violations. Some participants argue that although the benefit is clear, there are other things that are more pressing than usage control enforcement. For instance access control policies could be improved. Participants have experienced collaboration projects where the entire document repository was accessible to all, since managing access control policies was considered a burden. As a result, a lot of sensitive information could not be stored in the repository, and hence alternative parallel systems had to be established for this kind of information exchange.

Risks and challenges

There are a few strengths, but there are also some extreme inconveniences (Engineer in the study)

The greatest potential risk of utilising usage control enforcement technology, according to participants, is that information may not be available to personnel when they need it. That is, that usage rights have been revoked, or network connectivity prevents you from obtaining necessary authorizations. There is a fear that such a system would be more strict than existing access control systems and additionally extended with ubiquitous enforcement. Since the technology to some extent resembles Digital Rights Management (DRM) systems, many also draw parallels to some of the unfair restrictions that commonly apply to downloadable media files. Thus, participants foresee information lock-in as a direct consequence of adopting usage control technology. And then there is the management of usage rights. Participants point to the management overhead and costs of specifying, maintaining and deleting usage rights and usage policies. In the event that authorised personnel cannot access information, then either the assigned usage rights are wrong or the policy is incorrect. One of the participants stated that even with their current four-scale classification scheme for sensitive information ". . . the probability that a document is correctly classified is about 50%".

Another serious issue with usage control technology is the handling of realtime data and legacy systems. Operational data collected at an oil field need to travel through a wide range of different systems for analysis, some of which are legacy systems that are difficult, not to say impossible, to change. As illustrated by one of the security specialists: " We have state of the art systems, but it is state of the art from 1985 in some cases". Additionally, with real-time remote control of operations, there is a general fear that latencies caused by the additional security may be intolerable.

While using information in unforeseen ways or contexts are commonly regarded a threat, it is also how creative solutions to difficult problems come about. One of the participants fear that creativity may suffer as a result of stricter usage control enforcement.

On a general basis, the lack of flexibility that participants see in usage control technology is of great concern and many fear that as a result employees will go to great lengths to bypass the technology.

Regarding whether the enforcement strategy should be proactive or reactive, the participants tend to disagree. To some, the entire value in the technology lies in the prevention of information misuse. The majority however sees the reactive strategy as a way to mitigate most of the challenges identified above, particularly regarding information being unavailable. This of course comes at the price of not being able to prevent misuse. Additionally, by introducing logging mechanisms for all handling of sensitive information, several participants express great concern of being subject to surveillance by both their own and collaborating companies. Furthermore, by being held accountable for their actions, some employees fear that if being ordered to violate a policy, they are accepting the responsibility of the commanding officer.

Conclusions and future work

Through this case study of a collaborative environment with extensive sharing of sensitive information, we have shed some light on the reasons why usage control technology adoption is not picking up the pace. From our analysis it seems clear that the participants are conscious about the risks and the shortcomings of existing measures to restrict usage of shared information. Still, the study demonstrates some of the practical challenges that needs to be tackled in order for the industry to embrace the technology. Some of this might be alleviated through adding flexibility to the enforcement mechanisms, while others require other enabling technology such as decision support on policy specifications.

It seems however, that there is no silver bullet for usage control technology either. There are situations in which proactive designs are superior to reactive designs, and vice versa. Still, the lessons learned from this cases study is the need to focus on practical issues that need to be addressed in order to promote all variations of this technology to great masses.

This case study forms a basis for which a more quantitative approach may be taken to gain insights into the relative importance of the different risks and features of usage control technology. Additionally, we believe that it will be worth while to investigate further the effect of decision support systems for both policy specifications and handling of sensitive information.

Table 1 :

 1 Distribution of participants with respect to company category and participant role

	Category	Companies Interviews
	Operator	1	3	Role	Interviews
	Licence owner	1*	1*
	Integrator	1	3	Engineer	6
	Suppliers	3	5	Security professional	2
	Consultancy	1	1	Manager	4
	Total	6	12	(b) Number of interviews for each
				participant role
	(a) Number of organisations and inter-
	views per category of actor
	*) The operator was also a licence owner. Hence these numbers are duplicates of the
	above

three different viewpoints from Engineers, Security Professionals and Management. However, it may sometimes be difficult to separate these three, especially for intermediate managers within R&D departments. The interviews were all held during the winter and spring of 2012, nearly half were conducted face-toface while the rest were done by telephone interview. Although we initially tried to avoid telephone interviews, it turned out to be difficult to schedule multiple interviews on a single day, as would have been required due to travel costs and time.

http://www.emc.com/products/detail/software/information-rightsmanagement.htm

Acknowledgements

We would like to express our sincerest gratitude to the participants in this study. As part of the research project Integrated Operations in the High North (IOHN), this study has received funding from the Research Council of Norway.


Martin Gilje
email: martin.g.jaatun@sintef.no

Hunting for Aardvarks: Can Software Security be Measured?

When you are in charge of building software from the ground up, software security can be encouraged through the use of secure software development methodologies. However, how can you measure the security of a given piece of software that you didn't write yourself? In other words, when looking at two executables, what does "a is more secure than b" mean? This paper examines some approaches to measuring software security, and reccommends that more organisations should employ the Building Security In Maturity Model (BSIMM).

Introduction

When discussing secure software engineering, the main argument for employing a secure software development lifecycle is that it makes the software "more secure" -but exactly what that means isn't entirely clear.

One way of measuring security could be to count the number of security bugs/flaws/attacks against a given software product over time, which is generally the service offered by the Common Vulnerability and Exposures (CVE) [START_REF]CVE: Common Vulnerabilities and Exposures (CVE)[END_REF] and the National Vulnerability Database (NVD) [START_REF]NVD: National Vulnerability Database Home[END_REF]. You could argue that this gives an after-the-fact comparison between different products, with the products with the least number of vulnerabilities claiming the "most secure" title. However, these kind of statistics can easily degenerate into the "damn lies" category [START_REF] Clemens | Notes on 'innocents abroad': Paragraph 20[END_REF], since they do not take into account the following factors:

-What is the distribution of the software product? -What is the attacker's incentive for breaking the product? For instance, an obscure piece of software could easily go for decades without making it into any vulnerability databases even if it were riddled with security flaws, whereas one reason for the high number of discovered security flaws in Microsoft products can be that due to its large user base, Microsoft remains the target of choice among the hacker population. Also, to quote Fred Brooks: "More users find more bugs." [START_REF] Brooks | The Mythical Man-Month[END_REF].

The remainder of this paper is organized as follows: In section 2 we1 present some other approaches toward measuring software security. In section 3 we discuss how different development methodologies might affect software security, and in section 4 we briefly consider what role testing might play in measuring software security. In section 5 we outline the Building Security In Maturity Model (BSIMM), and argue why it could be a good approach to software security metrics. We discuss our contribution in section 6, and offer conclusions in section 7.

Background

We will in the following present some previous work on measuring software security, all of which has been presented at the MetriCon series of workshops.

A Retrospective

Ozment and Schechter [START_REF] Ozment | Milk or wine: does software security improve with age?[END_REF] studied the rate of discovered security flaws in OpenBSD over a span of 7 years and 6 months. Unsurprisingly, they found that the rate of new bugs discovered in unchanged code dropped toward the end of the period (i.e., the number of latent security flaws are presumably constant, and as time goes by, more and more of the flaws will be found). However, new code is continually added to the code base, and this means that also new vulnerabilities are introduced -Ozment and Schechter found that comparatively fewer vulnerabilities were introduced through added code, but attributed this to the fact that the new code represented a comparatively small proportion of the total code base (39%). In fact, that 39% of code had 38% of the total security flaws, which is within the statistical margin of error.

This contrasts with Brooks' contention that "Sooner or later the fixing ceases to gain any new ground. Each forward step is matched by a backward one. Although in principle usable forever, the system has worn out as a base for progress." [START_REF] Brooks | The Mythical Man-Month[END_REF] It is possible that different rules apply to operating systems than application programs -or that we still haven't reached the "trough of bugginess" in OpenBSD.

The MetriCon Approach to Security Metrics

The MetriCon workshop was held for the first time in August 2006, in conjunction with the USENIX Security Symposium. Since this workshop doesn't publish regular proceedings, details are a bit hard to come by for those that did not attend, but luckily the workshop publishes a digest2 of the presentations and ensuing discussions, reported by Dan Geer [START_REF] Geer | MetriCon 1.0 Digest[END_REF][START_REF] Geer | MetriCon 2.0 Digest[END_REF][START_REF] Geer | MetriCon 4.0 Digest[END_REF] and Daniel Conway [START_REF] Conway | MetriCon 3.0 Digest[END_REF].

MetriCon covers a wide swath of what can be called security metrics, but is a reasonable place to look for contribtutions to measuring software security. A discussion at the first MetriCon [START_REF] Geer | MetriCon 1.0 Digest[END_REF] touched upon code complexity as a measure of security. This is an approximate measure, at best, since complex code is more difficult to analyze (and may thus help to hide security flaws); but correctly written complex code will not in itself be less secure than simple code. However, if proof of secure code is needed, complexity is likely to be your downfall -it is no coincidence that the highest security evaluation levels typically are awarded to very simple systems.

Comparing Software Development Methodologies

Traditional approaches to developing secure software have been oriented toward a waterfall development style and "Big Requirements Up Front" -see e.g. the documentation requirements of a Common Criteria evaluation [START_REF]Evaluation criteria for it security part 1: Introduction and general model[END_REF].

However, the jury is still out in the matter of the security of code produced using e.g. agile methods vs. waterfall. There are proponents who claim that XP works just dandy in safety-critical environments (and, presumably, by extension with great security), while other examples demonstrate that an agile mindset purely focused on "let's get this thing working, and let's worry about security later" does not present the best starting point for achieving secure code.

Eberlein and Leite [START_REF] Eberlein | Agile requirements definition: A view from requirements engineering[END_REF] state that the main reason agile methods result in poor security requirements is that the agile methods do not provide verification (are we building the product right), only validation (are we building the right product). Beznosov [START_REF] Beznosov | eXtreme Security Engineering: On Employing XP Practices to Achieve "Good Enough Security" without Defining It[END_REF] thinks XP can be good enough, while Wäyrynen et al. [START_REF] Wäyrynen | Security engineering and eXtreme programming: An impossible marriage? In: Extreme Programming and Agile Methods -Xp/ Agile Universe[END_REF] claim that the solution to achieving security in an XP development is simply to add a security engineer to the team.

Beznosov and Kruchten [START_REF] Beznosov | Towards agile security assurance[END_REF] compare typical security assurance methods with generic agile methods, and identify a large number of the former that are at odds with the latter (in their words: mis-match). Unsurprisingly, this indicates that it is not possible to apply current security assurance methods to an agile software development project. The authors offer no definite solution to this problem, but indicate two possible courses of action:

1. Develop new agile-friendly security assurance methods. The authors concede that this will be very difficult to achieve, but are not able to offer any insights yet on what exactly such methods could be. 2. Apply the existing security assurance methods at least twice in every agile development project; once early in the lifecycle, and once towards the end.

Siponen et al. [START_REF] Siponen | Integrating security into agile development methods[END_REF] believe that all will be well if think about security in every phase. While Poppendieck [START_REF] Poppendieck | XP in a Safety-Critical Environment[END_REF] argues that agile methods (specifically: XP) are just as suitable as traditional development methods for developing safety-critical applications. Kongsli [START_REF] Kongsli | Towards agile security in web applications[END_REF] opines that agile methods provide an opportunity for early intervention in connection with securing deployment, and argues for collective ownership of security challenges. However, a security specialist is still required as part of the team.

Testing for Security

There exist various static analysis tools that can analyze source code and point out unfortunate content, but just like signature-based antivirus products, these tools can only tell you about a set of pre-defined errors [START_REF] Mcgraw | Software [In]security: Comparing Apples, Oranges, and Aardvarks (or, All Static Analysis Tools Are Not Created Equal[END_REF].

The ultimate challenge is to be presented with an executable and trying to figure out "how secure is this?". Jensen [START_REF] Jensen | A Novel Testbed for Detection of Malicious Software Functionality[END_REF] discusses several approaches to evaluate an executable for unwanted side-effects, but this only covers software with hostile intent, not software that is poorly written.

Fuzzing [START_REF] Miller | An empirical study of the reliability of unix utilities[END_REF] is a testing technique based on providing random input to software programs, and observing the results. This is an automated version of what used to be referred to as the "kindergarten test"; typing random gibberish on the keyboard. Unfortunately, while it may be possible to enumerate all intended combinations of input to a program, it is not possible to do exhaustive fuzz testing -even if you leave the fuzzer running for weeks, it will still not have exhausted all possible combinations. Thus, fuzzing is not a suitable candidate for a software security metric -if you find flaws, you know the software has flaws; if you don't find flaws, you know . . . that you didn't find any flaws -but there may be flaws hiding around the next corner.

BSIMM and vBSIMM

The Building Security In Maturity Model (BSIMM) [START_REF] Mcgraw | Building Security In Maturity Model[END_REF] and its simpler "younger brother"3 BSIMM for Vendors (vBSIMM) were introduced by McGraw as an attempt to bypass the problem of measuring software security; arguing that if you cannot measure the security of a given piece of software, you can try to measure second-order effects, i.e. count various practices that companies that are producing good software security are doing.

The BSIMM Software Security Framework

BSIMM defines a Software Security Framework (SSF) divided into four domains each covering three practices (see Table 1). Each practice in turn covers a number of activities grouped in three levels (see below).

-

Maturity is one of the M-s in BSIMM

Each BSIMM practice contains a number of activities grouped in three maturity levels. Each maturity level is given a textual description, but it's not entirely clear if all the activities in a lower level need to be in place to progress to the next level -it may be assumed that the BSIMM "auditors" employ some discretion here when collecting the interview data.

To take a random example, we can look at the Security Testing (ST) practice within the SSDL Touchpoints domain. ST level 1 is labeled "Enhance QA beyond functional perspective", and comprises the activities:

-ST1. The BSIMM authors reccommend that if using BSIMM as a cookbook, an organization should not try to jump to the third level all at once, but rather implement the first-level activities first, and then move on only once the first level is truly embedded. This is partly because some higher-level activities build on the lower-level ones (e.g., ST2.1 and ST1.1), but also because the higher-level activities typically are more difficult and require more resources.

BSIMM in Practice

The BSIMM documentation is freely available under a Creative Commons license, and in theory there is nothing to stop anyone from using it to compare new organizations to the ones already covered. However, it is clear that the raw data used in creating the BSIMM reports is kept confidential, and BSIMM is no interview cookbook -it is safe to assume that participants are not asked directly "do you use attack models?", but exactly how the BSIMM team goes about cross-examining their victims is not general knowledge, and is thus difficult to reproduce.

Using the BSIMM as a research tool may therefore be more challenging than using it as a self-assessment tool, and the latter is certainly more in line with the creators' intentions.

Discussion

It is unlikely that we'll see any "fire and forget" solution for software security in the near future, but we may aspire to a situation of "forget and get fired", i.e. where software security becomes an explicit part of development managers area of responsibility.

Recently, we have seen in job postings for generic software developers that "knowledge of software security" has been listed as a desired skill -this may be a hint that the software security community's preaching has reached beyond the choir.

If you want a job done right, you have to do it yourself -but if you can't do it yourself, you need other evidence. It seems that for lack of anything better, the BSIMM approach of enumerating which of the "right" things a software company is doing is currently the best approach to achieve good software security. It is true that past successes cannot guarantee future happiness; but on the other hand, a company that has demonstrated that it cares enough to identify good software security practices is more likely to follow these in the future than a company that does not appear to be aware of such practices in the first place.

Conclusion and Further Work

There is currently no good metric which can easily decide which one of two executable is better from a software security point of view. It seems that currently, the best we can do is is to measure second-order effects to identify which software companies are trying hardest. If we are concerned about software security, those are the companies we should be buying our software from.

More empirical work is needed on comparing software produced by different methodologies, e.g. agile vs. waterfall. Intuitively, the former may seem less formal and thus less security-conscious, but an interesting starting point may be to compare the number of secure software engineering practices employed in the different organizations. Retrospective studies may also compare the track record of various methodologies over time, but the main challenge here may be to identify software that is sufficiently similar in distribution and scope to make the comparison meaningful.

Table 1 .

 1 The Governance domain includes practices Strategy and Metrics, Compliance and Policy, and Training. -The Intelligence domain includes practices Attack Models, Security Features and Design, and Standards and Requirements. -The SSDL Touchpoints domain refers to McGraw's approach to a Secure Software development Lifecycle [23], and includes practices Architecture Analysis, Code Review, and Security Testing. There are more touchpoints listed in McGraw's book, but these three have been identified by McGraw as the most important. -The Deployment domain includes practices Penetration Testing, Software Environment, and Configuration Management and Vulnerability Management. The BSIMM Software Security Framework

	Governance	Intelligence	SSDL Touchpoints Deployment
	Strategy and Metrics Attack Models	Architecture Analysis Penetration
				Testing
	Compliance and Policy Security Features	Code Review	Software En-
		and Design		vironment
	Training	Standards and Re-	Security Testing	Configuration
		quirements		Management
				and	Vul-
				nerability
				Management

  1: Ensure QA supports edge/boundary value condition testing. -ST1.2: Share security results with QA. -ST1.3: Allow declarative security/security features to drive tests. ST level 2 is labeled "Integrate the attacker perspective into test plans", and currently has only two activities: -ST2.1: Integrate black box security tools into the QA process (including protocol fuzzing). -ST2.3: Begin to build/apply adversarial security tests (abuse cases). Perform fuzz testing customized to application APIs. -ST3.3: Drive tests with risk analysis results. -ST3.3: Leverage coverage analysis.

	-ST3.2:
	The third ST level is labeled "Deliver risk-based security testing", and has
	four activities:
	-ST3.1: Include security tests in QA automation.

The reader is free to interpret this as the "royal we".

At least for the first four events.

In a way the opposite of Sherlock Holmes' smarter older brother Mycroft -"When I say, therefore, that Mycroft has better powers of observation than I, you may take it that I am speaking the exact and literal truth."[START_REF] Doyle | Memoirs of Sherlock Holmes[END_REF]

Acknowledgment

The title of this paper is inspired by an InformIT article by Gary McGraw and John Stevens [18]. Thanks to Jostein Jensen for fruitful discussions on software security for the rest of us.