docPDF 2 - MSU - Michigan State University
download 
Report Transcription
PDF 2 - MSU - Michigan State University
MENTAL MODELS OF SECURITY Rick Wash Assistant Professor Communication Arts and Sciences Michigan State University wash@msu.edu PROBLEM: Better technology doesn’t help if users choose not to use it Discretionary Security Install Anti-virus? Disable automatic updates? Choose an ‘easy’ password? Give everyone write permission? Click on links in email? How do non-experts make security choices? How do non-experts learn about security? How can we help non-experts make better choices? How do non-experts make security choices? Folk Models of Security How do non-experts learn about security? How can we help non-experts make better choices? How do non-experts make security choices? Folk Models of Security How do non-experts learn about security? Stories from Other People How can we help non-experts make better choices? How do non-experts make security choices? Folk Models of Security How do non-experts learn about security? Stories from Other People How can we help non-experts make better choices? Better models? Better technology? How do people think about security? How do people make security decisions? Credit: flickr.com/photos/jason_coleman VALVE VALVE FEEDBACK INTERVIEW STUDY INTERVIEW STUDY Round 1: 23 home users Round 2: 10 home users Snowball Sample THREATS Viruses Hackers VIRUS MODELS VIRUS MODELS Viruses are Generically Bad Viruses are Buggy Software Viruses Cause Mischief Viruses Support Crime VIRUS MODELS Viruses are Generically Bad VIRUS MODELS Viruses are Generically Bad General notion of bad things happening ‘Catch’ viruses like a cold Unspecified creator, purpose VIRUS MODELS Viruses are Buggy Software VIRUS MODELS Viruses are Buggy Software Same problems as bugs in software, but worse Must be manually downloaded and run Created by `bad’ people VIRUS MODELS Viruses Cause Mischief VIRUS MODELS Viruses Cause Mischief Created by mischievous teenagers with technical skills Cause annoying problems Caught by visiting shady websites or opening shady emails VIRUS MODELS Viruses Support Crime VIRUS MODELS Viruses Support Crime Created by criminals to gather identity information No direct harm to computers Spread automatically, installed by hackers Support Crime Mischief Buggy Software Viruses are bad VIRUS MODELS Use anti-virus software Regular anti-virus scans Care in visiting websites Care in downloads Don't do Ok, not necessary Definitely HACKER MODELS HACKER MODELS Hackers do Digital Graffiti Hackers are Burglars Hackers Target Big Fish Hackers are Contractors to Criminals HACKER MODELS Hackers do Digital Graffiti HACKER MODELS Hackers do Digital Graffiti Young technical geeks trying to impress friends Causes mischief Anyone can be a target; it doesn’t matter HACKER MODELS Hackers are Burglars HACKER MODELS Hackers are Burglars Some criminal “breaks into” your computer Looking for personal / financial information Targets are chosen opportunistically HACKER MODELS Hackers Target Big Fish HACKER MODELS Hackers Target Big Fish Similar to burglar model Criminals target rich or important people Likely to be professional, part of organized crime HACKER MODELS Hackers are Contractors to Criminals HACKER MODELS Hackers are Contractors to Criminals Young technical geek Looking for ID theft info for resale Targets big databases Contractor Big Fish Burglar Graffiti HACKER MODELS Use security software Keep patches up-to-date Make regular backups Don't do Ok, not necessary Definitely “Technical experts will evaluate folk theory from this perspective [correctness] -- not by asking whether it fulfills the needs of the folk. But it is the latter criterion[...] on which sound public policy must be based.” - Willett Kempton, 1986 FOLK MODELS • Home Computer Users make decisions based on the threats they perceive they face • These threats, even if incorrect, can induce good behaviors from users VIRUS MODELS HACKER MODELS VIRUS MODELS •Viruses are Bad •Viruses are Buggy Software •Viruses Create Mischief •Viruses Suppport Crime HACKER MODELS VIRUS MODELS HACKER MODELS •Viruses are Bad •Digital Graffiti •Viruses are Buggy •Opportunistic Software Burglars •Viruses Create •Hackers Target Big Mischief Fish •Viruses Suppport •Contractors to Crime Criminals How do non-experts make security choices? Folk Models of Security How do non-experts learn about security? Stories from Other People How can we help non-experts make better choices? Better models? Better technology? How do non-experts learn about security? Stories from Other People Security Education? Interacting with Technology? News? Stories from their Friends? SURVEY Undergraduates in intro comm/telecom classes 301 Responses (41%) Tell us a story you heard about security SECURITY STORIES #377: My friend decided he wanted to watch some inappropriate videos and went to a shady site. He did not have a firewall or any sort of anti virus so his computer got infected. His computer slowly got worse and worse until he couldn't handle it and took it to his parents. His parents did not know what to do and before they could figure it out, the computer died. #3: It appears that Facebook has gotten yet another virus and people are posting weird things onto their friends walls without them knowing. So if you get a notification about someone posting on your wall be careful and not directly click on it or else your Facebook might get hacked or a virus. STORIES are about security incidents PC Effects Spam Break-ins Theft Phishing STORIES are heard informally from family and friends 70% heard in informal settings (home, friend's house) 55% told face-to-face 64% told by family or friends 71% more than a month old STORIES are lessons about everyday people facing moderately serious threats 55% about family and friends 51% auto-biographical 72% contain a lesson 95% believe the story is true STORIES convey important security lessons The Internet is a dangerous place Beware of specific threats (shady email, shady webpages) Keep person information private CHANGING THINKING AND BEHAVIOR 94% report changing how they think about security 52% report changing behavior CHANGING THINKING AND BEHAVIOR Lessons are important Over doubles the odds of influencing behavior Significantly larger increase in change in thinking CHANGING THINKING AND BEHAVIOR People perceived as knowledgable change behavior 40% increase in odds of changing behavior Very small effect on change in thinking CHANGING THINKING AND BEHAVIOR Stop, Start, and Pay Attention Completely stop doing risky behaviors Start using more security technologies Pay attention to useful information #412: Don't click on sketchy links; #3: Don't click on weird links. STOP #44: Making sure my computer did not remember any of my passwords. #428: Make sure you choose a well-trusted antivirus program to protect your computer from spyware and virus threats. #448: Started scanning torrent contents before opening. Also reading torrent comments. #121: To not be stupid and recognize when a virus is attempting to harm your computer. #356: Reading more carefully the subject line in emails. START PAY ATTENTION STORIES ARE RETOLD 45% of respondents retold the story 90% retell within a week Casual (87%), Face-to-face (89%), to family and friends (97%) FOUR IMPLICATIONS • People’s choices about security are interconnected • Influential sources stories come from familiar, trusted seem to convey the complexity of security, but not what to do about it • Stories seem to help with reactive security, but not with proactive security • Stories •
