Sicherheitsaspekte in virtuellen Welten: IT-Sicherheitsanalyse und Anforderungsdefinition unter Berücksichtigung der Faktoren für Unterhaltungserleben

Virtual Worlds are socio-technical systems, which means that they are IT-systems that are specifically catered to the users. This PhD thesis provides a systematic IT-Security analysis for Virtual Worlds with a client-server architecture and defines security requirements taking into account the different factors for perceived entertainment. IT-Security focuses on the protection of digital assets against threats und provides security mechanisms that are able to protect these assets. Virtual Worlds with a client-server architecture are made accessible via the Internet. Due to the Internet being an insecure network by design, a number of threats arise targeting the assets of Virtual Worlds. In order to recommend appropriate protection mechanisms it is however important to conduct a systematic security analysis in a first step. Virtual Worlds are designed for an interactive dialogue between the user and the system. The installation of security mechanisms requires that these mechanisms are accepted in absolute terms by the user. This dissertation therefore applies an interdisciplinary view on the IT-Security of current/modern media applications, such as Virtual Worlds. In a first step different perspectives on the motivation for the usage of Virtual Worlds are depicted and the elements for experiencing entertainment such as gratification, fun and flow are identified. By means of the social science perspective regarding user motivation an analysis the actual assets in Virtual Worlds is possible. The social science perspective is followed by an information technology perspective throughout which an IT-Security analysis is conducted, including the analysis of threats and the definition of security objectives for the specific subject of the protection. On this basis a systematic selection of security requirements is possible. The author defines a Protection Profile according to the Common Criteria for Information Technolgy Evaluation which is an international ISO/IEC standard. The Common Criteria are a well-accepted and approved instrument for the security evaluation of IT products. With a Protection Profile independent and accredited laboratories are able to equally evaluate IT products and offer a certain level of quality assurance. Finally, recommendations for the design and integration of security mechanisms are provided. Moreover, the author depicts how the technical measures can be integrated into Virtual Worlds so that users are not disturbed during their perception of entertainment which in turn leads to a higher acceptance of the security measures.