## 4 Findings
### Providing Security Metadata
platform modules (TPM) and relevant information for trusted computing were considered. Experts emphasized the need to include information related to trusted execution, secure boot, secure enclave, and secure attestation in provenance graphs to ensure reliability and prevent hacked devices from inserting fake security metadata. **Expert-3** noted,  
_\"So basically, I think all the health data need to be processed in the trusted room. Furthermore, if they are not being processed, they have to be staying in encrypted form always so that it will be the cipher-text, and there will be no use for other apps or attackers. Hence, the key for encrypting this host data must always be stored in this secure enclave.\"_  
While explaining trusted enclaves and secure boot in various applications (apps) in smartphones, **Expert-1** mentioned  
_\"When you want to open up that app, that app should not function, it should immediately alert that your phone is not secured.\"_  
Experts also pointed to adding demographic information, metadata relevant to encryption, and policy/regulation perspectives while discussing policy and human-centric security evidence (see in the fourth column of the first row of Table 2), while discussing policy and human-centric security evidence, **Expert-4** mentioned,  
_\"You can have your point of view, you can do background checking, like police checks and clearance. Furthermore, from a technological point of view, you can do significant activity monitoring for behavioral analytics over time.\"_  
Relevant security metadata identified during end-to-end system discussion are included in the second row of the fourth column of Table 2, while experts argued on authentication mechanisms for implanted devices, some proposed including IEEE standard 802.1 AR for secure device identity. Additionally, two-factor authentication (2 FA) and multi-factor authentication (MFA) were highlighted repeatedly as crucial components. The discussion also covered the importance of S/MIME (Secure/Multipurpose Internet Mail Extensions) and PGP (Pretty Good Privacy) for providing cryptographic security services for electronic messaging applications. **Expert-5** added in this regard, _\"I obviously would recommend documenting information related to PGP for data transfer.\"_ Interestingly, AI-based authentication was raised by Expert 6. However, others countered that due to various undisclosed security vulnerabilities, an AI-based authentication system might not be the best option. Furthermore, the discussion included details about application-level protocols, TLS version, mode, and parameters, operating system version, and flags indicating whether specific data pass through certain security controls, such as firewalls or intrusion detection systems. All of these were deemed relevant pieces of security evidence. The experts' opinion on auditing services is recorded in the second row of Table 2. Some experts noted auditing services as another security control for identifying attacks occurring at different points. They considered various configuration targets and output from auditing services to be added to provenance graphs as security metadata. Although a majority of the experts indicated the cloud services to be the most trusted, they also talked about cloud security-related information as prospective security metadata. These contain cloud contractual specifications, information on security or crypto-engineering auditing, various policies or specifications, and certificate authority-related evidence, as recorded in the third row of Table 2.  
During the exercise, information related to device standards and updates was discussed as potential security metadata to identify device-specific attack risks.