Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/17/2016
03:30 PM
Lysa Myers
Lysa Myers
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

User Ed: Patching People Vs Vulns

How infosec can combine and adapt security education and security defenses to the way users actually do their jobs.

I spend a lot of my work hours fretting about the effects of people who don’t specialize in computer and network security making security-related decisions. It hadn’t fully struck me how much of a deficit exists because people who are making business decisions about how to "do" security aren’t necessarily expert in education, usability, or linguistics.

At the recent Black Hat 2016 in Las Vegas, there were a few sessions in particular that brought this message home for me. The first talk was “Exploiting Curiosity and Context”, which was presented by Zinaida Benenson from the University of Erlangen-Nuremberg. The next one was “Security Through Design,” presented by Jelle Niemantsverdriet from Deloitte. The last was “Language Properties of Phone Scammers” by Judith Tabron from Hofstra University.

These three presenters dug into human error from different perspectives: how context can deceive, how poor design choices can lead people to make dangerous decisions, and how we can easily explain detectable patterns in telephone scams.

Benenson’s research involved a phishing test on a number of individuals, after which she surveyed them about the event. Most notably, many of the people who clicked were unaware that they’d done so, or had forgotten. Of those who were aware that they’d clicked, there was a variety of relatively unsurprising reasons given: they thought they knew the sender, they were curious, or they thought their software choices would protect them.

Niemantsverdriet discussed how design succeeds or fails depending on how well it addresses the way people actually use a thing. He listed a variety of ways that security companies could make changes to find and fix problems that exist in present products, such as: A/B testing, making user interfaces more intuitive, simplifying wording in products, and using strategic placement of options to influence user’s choices.

Tabron’s presentation analyzed recordings of scam calls to search for linguistic patterns that would help indicate when a caller is a scammer. She discovered that there are patterns that can be discerned by looking for irregularities -- such as in the caller’s speech pacing, excessive use of tag questions, or redirecting conversation to avoid answering questions and create a sense of urgency.

All of these speakers cautioned that while it is possible for people to be constantly in a “James Bond” mode of hypervigilance, it is not beneficial for the individual or for harmonious group dynamics to be in a constant state of distrust. The idea is not so much to eliminate security failures completely – even security experts make mistakes – but to find ways that make it easier for people to make better security decisions more often.

The first two speakers also highlighted the need to communicate with users so that those of us creating security policies and products can better understand their experiences. That way, education and security defenses can be adapted to how people actually do their jobs.

There is a tendency among security practitioners to get rather jaded and bitter; we assume, because our efforts to improve security are frequently unheeded or thwarted, that most users are so clueless that education is a lost cause. We often design products as if they are to be used by people who are security experts, or run once and never touched again. And when people fail to make good security decisions because they’re following (or creating) the path of least resistance we throw up our hands in disgust and declare, “You can’t patch stupid.”

In reality, creating a patch that doesn’t break existing functionality or create new vulnerabilities is a time-consuming and difficult task requiring people who are skillful coders -- and it’s something we often get wrong. Likewise, “patching” users requires skillful and thorough education by security professionals who understand how their users are expected to function and do their jobs.

Related Content:

 

Lysa Myers began her tenure in malware research labs in the weeks before the Melissa virus outbreak in 1999. She has watched both the malware landscape and the security technologies used to prevent threats from growing and changing dramatically. Because keeping up with all ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25137
PUBLISHED: 2020-09-25
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via the alert_name or alert_message parameter to the /a...
CVE-2020-25138
PUBLISHED: 2020-09-25
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via /alert_check/action=delete_alert_checker/alert_test...
CVE-2020-25139
PUBLISHED: 2020-09-25
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via la_id to the /syslog_rules URI for delete_syslog_ru...
CVE-2020-25140
PUBLISHED: 2020-09-25
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur in pages/contacts.inc.php.
CVE-2020-4531
PUBLISHED: 2020-09-25
IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the sy...