Building trust through risk management in computer science

International audienceTrust in computer science mostly relies on evaluating the risks of using a tool (software or hardware) or, more generally, any other form of digital service (i.e. a website). This evaluation and its reliability are all the more critical as stakes get higher: they are most important when dealing with an organisation's Information Systems Security (ISS). There are two main approaches to risk qualification. The older method regards products delivering ISS (software and hardware) and implementing security functions, and trust service providers (e.g. providing timestamps, signatures, electronic certificates). Often, public authorities are involved in the process of qualifying the level of risk. Here, trust is assumed to be transitive: if users trust the qualifying entity or the electronic certificate, they will also trust the object that is qualified. Qualifying products or providers is not always mandatory, but it is unavoidable when designing critical security solutions or competing for public procurement, among other cases. Therefore, such risk management approach is, together with the reliability level it is associated with, an external sign aiming to reinforce the trust of individuals and companies (4.1.). The second and more recent approach relies on the large and growing number of data points available in IT system. It works by scoring the security performance of individuals and services. This score, used as a risk indicator, is based on a behavioural analysis that benchmarks one behaviour with a reference behaviour. It is likely to have a direct influence on trust (4.2.). These approaches - product and provider qualification and behavioural analysis - can be used jointly, for instance in order to authenticate a user based both on an electronic certificate and on their behaviour