PTMOL - Uma linguagem para modelagem de ameaças de privacidade orientada a Redes Sociais Online

Abstract

Online Social Networks (OSNs) have become one of the main technological phenomena on the Web, gaining eminent popularity among its users. With the growing worldwide expansion of OSN services, people have begun to dedicate time and effort to maintaining and manipulating their online identity in these systems. However, the processing of personal data through these networks has exposed users to various types of privacy threats. Consequently, new solutions need to be developed to deal with the threat scenarios to which a user is potentially exposed. In this sense, this work proposes PTMOL \textit{(Privacy Threat Modeling Language}), a language for modeling privacy threats in OSNs. Through a systematic mapping of the literature, it was possible to identify and analyze the main gaps not covered by the current solutions. From this mapping, it was possible to develop a new solution, which was refined and adapted to the context of privacy in OSNs. The proposed language aims to support the early search for threats to which a user may be exposed and what privacy controls an OSN needs to define to reduce the effects and consequences of these threats. The language was evaluated by conducting a set of empirical studies that allowed carrying out the proposal's validity and reliability procedures. The results of the studies indicate that the use of language is potentially useful for identifying real threats to privacy due to its exploratory and reflective nature. Therefore, PTMOL can be incorporated into the development of OSNs during the design level and can help designers and software engineers to introduce threat modeling into their projects, without requiring a high level of expertise in the area of privacy.