PTMOL: A Privacy Threat Modeling Language for Online Social Networks - Rodrigues, Andrey Antonio de Oliveira; Villela, Maria Lúcia Bento; Feitosa, Eduardo Luzeiro (Anais do Simpósio Brasileiro sobre Fatores Humanos em Sistemas Computacionais (IHC), 2024)
Online Social Networks (OSNs) have become one of the main technological phenomena on the Web, gaining significant popularity among users. With the growing global expansion of OSN services, people have begun to dedicate time and effort to maintaining and manipulating their online identities in these systems. However, the processing of personal data through these networks has exposed users to various types of privacy threats. Consequently, new solutions need to be developed to address the threat scenarios to which users are potentially exposed. In this context, this work proposes PTMOL (Privacy Threat Modeling Language), a language for modeling privacy threats in OSNs. Through a systematic mapping of the literature, it was possible to identify and analyze the main gaps not covered by current solutions. From this mapping, a new solution was developed, refined, and adapted to the context of privacy in OSNs. The proposed language aims to support the early identification of threats to which a user may be exposed and to determine what privacy controls an OSN needs to implement to mitigate the effects and consequences of these threats. The language was evaluated through a set of empirical studies that validated the proposal’s validity and reliability. The results of these studies indicate that the use of PTMOL is potentially useful for identifying real privacy threats due to its exploratory and reflective nature. Therefore, PTMOL can be incorporated into the development of OSNs at the design level and can help designers and software engineers introduce threat modeling into their projects without requiring a high level of expertise in the area of privacy.