Chatbots are becoming increasingly popular as intelligent assistance in shopping, food delivery, healthcare, banking, etc. But the use of chatbots brings several additional security risks and challenges to the users due to increasing security threats, such as spoofing, tampering, repudiation, information disclosure, denial of service, the elevation of privileges and many more.
The only solution to prevent security risks is to decrease the weaknesses and vulnerabilities, which can be exploited by attackers, and build protective mechanisms, ensuring the properties of the chatbot, like integrity, authenticity, availability, authorization, confidentiality, etc.
To well-handle the threats and vulnerabilities, many chatbots use cloud computing services, but the cloud may not always be sufficient due to human errors and system vulnerabilities. This post will explore three popular methods that can be implemented to ensure an additional layer of security for your chatbot.
Authentication and authorization
Authentication or the confirmation of the user identity may not always be mandatory, especially when a user asks for assistance, for example, on a shopping website. However, when a user wants to access the user’s data, like personal information or account balance, authentication and authorization become necessary to identify that a user is verified with valid and secure login credentials. The authorization ensures that the correct person has access to the right data and services.
The most common credentials are a username, network address, phone number, system ID, biometric identification, certificate, password, and other credentials. The user sends these credentials to the system, which generates a secure authentication token used throughout the user’s session. These security tokens are only temporary, and the system must generate a new one after a certain amount of time has passed.
Two-factor authentication ensures that a user’s data and communications are more secure. The user can confirm account credentials authentication via email and text message. There are also (higher) multi-factor authentication schemes used during the login process and during a chatbot conversation.
End-to-End Encryption
End-to-End Encryption (E2EE) is a communication system in which only the parties involved can read the messages. The conversation is encrypted so that only the message’s unique recipient can decrypt it, not anyone in between. As a result, it’s crucial to ensure that only the parties involved have access to the cryptographic keys needed to decrypt the conversation.
Many website chatbots use only Hypertext transfer protocol secure (HTTPS), which encrypts data and sends it through a Secure Sockets Layer (SSL) or Transport Layer Security (TLS). Instead of end-to-end encryption, HTTPS uses ‘point-to-point encryption. The user’s connection to a load balancer is secure, but the data is decrypted and returned to plain text. As a result, all services after the load balancer are vulnerable to attack. Only E2EE ensures secure data transfer between participants.
Companies are required to pseudonymize and encrypt personal data under Article 32 (a) of the GDPR. Many chatbots are linked to popular messaging apps like WhatsApp, Facebook Messenger, Telegram, and Slack. Due to GDPR’s requirement that personal data be encrypted, many chatbots on these networks support data encryption. For example, Facebook Messenger has a ‘Secret Conversations’ feature that enables E2EE using Open Whisper Systems’ Signal Protocol.
Self-destructing messages
Self-destructing messages are a practical solution in many cases when sensitive PII (personally identifiable information) is transmitted. It means that messages containing PII are automatically deleted after a certain time has passed. Both the user and the chatbot may be involved. In communication with financial (banking) and healthcare chatbots, self-destructing messages are important security practices. As a result, Article 5 (e) of the GDPR states that personal data must be kept no longer than necessary for processing purposes.
Conclusion
Chatbots have undisputed advantages: they work 24/7, lower costs, communicate in natural language, and manage various tasks. Chatbots are more user-friendly than in email or web form. Chatbots can also operate on social media, websites, mobile phones, computers, etc. Users can use chatbots in communication with banks, healthcare assistants, online shops, cars, insurance companies, airports, etc. Hence, secure communication with the chatbot is essential to keep the user’s data safe.
