Effective Communication of Cyber Security Risks Addressing the

Effective Communication of Cyber Security Risks: Addressing the Human Element in Security Jason R. C. Nurse (Ph. D, MSc, BSc) Cyber Security Centre, Department of Computer Science University of Oxford, UK http: //tease-project. info/ 7 th International Scientific Conference Security and Protection of Information 22– 24 May 2013 Trade Fairs Brno, Czech Republic

Outline Why focus on humans and not technology? Addressing the human-related issues Recommendations for communicating risks Next steps… Open Day: 5 May 2012 1

Outline Why focus on humans and not technology? Addressing the human-related issues Recommendations for communicating risks Next steps… Open Day: 5 May 2012 2

Why focus on the human element? Increase in attacks that exploit humans Spamming § Phishing, spear phishing § Social-engineering threats § Malicious applications § Open Day: 5 May 2012 3

Why focus on the human element? End-user systems tend not to design for usable security “Why Johnny can’t encrypt? ” (1999) § “It’s too complicated so I turned it off!” (2010) § Countless other system examples… § q q Configuring home routers and firewalls Forced to using complex passwords, that are to be changed monthly Open Day: 5 May 2012 4

Why focus on the human element? Usability also important for security professionals § Task workload, time factors and increasing complexity of security systems Sax 2 Intrusion Prevention and Intrusion Detection System screenshots of event viewers, typical interaction screens (http: //www. ids-sax 2. com) Open Day: 5 May 2012 5

Why focus on the human element? In summary, the problems… § § § § For end-users, security is usually a secondary goal Interfaces tend to be too confusing and clumsy Lack of quality feedback to users when performing security tasks Strain on users to remember several security settings, configurations / passwords Abundance of technical terminology Forcing uninformed security decisions on users For security professionals, interfaces are difficult to use Task workload and increasing complexity of security systems Open Day: 5 May 2012 6

Outline Why focus on humans and not technology? Addressing the human-related issues Recommendations for communicating risks Next steps… Open Day: 5 May 2012 7

Addressing the human element in security Three-pronged approach How to building trust in interfaces and information? § What are the key practices in designing for usable security? § How to effectively communicate cybersecurity risks to end-users and security professionals? § Trust Usability Open Day: 5 May 2012 Cybersecurity risk communication 8

Addressing the human element in security Trust Usability Cybersecurity risk communication Efficient interface design, support user decision-making, reduce use of technical jargon and always provide help functionality, … Open Day: 5 May 2012 Key factors: Interface and information presentation, relevance, supporting understanding, … Inspiration from risk communication field – importance of format in presenting risk message, understanding user perceptions 9

Outline Why focus on humans and not technology? Addressing the human-related issues Recommendations for communicating risks Next steps… Open Day: 5 May 2012 10

Recommendations for communicating risks § § § Planning how cybersecurity risks will be communicated is crucial. Be clear on the goal, messages and strategies most useful, and characteristics of typical system users The meaning of information presented in security / risk messages should be clear. Information should be specific and unambiguous, or risks being disregarded Users should be presented with clear and consistent directions for action i. e. , options for responding to a security risk. Narratives might be provided in helping users to visualise outcome of decisions http: //i. msdn. microsoft. com/dynimg/IC 107028. gif Open Day: 5 May 2012 11

Recommendations for communicating risks § § § Design with the understanding that humans possess a limited processing capacity. Reduce cognitive effort. E. g. , present key security / risk information first, optional details later Make security functionality visible and accessible, while also making users aware of the system’s current security state. Provide accessible help, advice and documentation for security. Open Day: 5 May 2012 12

Recommendations for communicating risks § § § For visual communication of security risks, note (i) stick with established colours and use known real-world metaphors (ii) no single visual will be perfect in all situations, etc. To communicate risks numerically, note, users with high-numeracy levels are likely to pay more attention to risk figures, while lownumerate users may rely more on emotions, mood states and guidance When communicating risks verbally, may be best to use additional means (e. g. , numbers) to adequately communicate the risk. “This site is likely to be malicious” – interpretation of likely is subjective Enterasys Dragon: Intrusion Prevention System Log Analysis (http: //blog. tmcnet. com/advanced-netflow-traffic-analysis/2012/12/enterasys-dragon-intrusion-prevention-system-log-analysis. html) Open Day: 5 May 2012 13

Outline Why focus on humans and not technology? Addressing the human-related issues Recommendations for communicating risks Next steps… Open Day: 5 May 2012 14

What’s next? Evaluating recommendations § § § Identification of case scenarios where recommendations can be adequately assessed Development of a prototype system and/or add-on functionality (to existing system, e. g. , browser) in line which scenarios to supply practical basis for analysis User studies to critically evaluate the trustworthiness and effectiveness of communications with and without recommendations proposed Open Day: 5 May 2012 15

What’s next? § Crisis Management – Realising value from open-source information (e. g. , Twitter, Facebook, Blogs) 1 Approach and model Real name § Risk exposure Security and Privacy risks in the use of social media – understanding and communicating the serious risk faced by oversharing 2 Published research 1 “Building Confidence in Information-Trustworthiness Metrics for Decision Support”, Trust. Com 2013 Data-Reachability Model for Elucidating Privacy and Security Risks Related to the Use of Online Social Networks”, Trust. Com 2012 2 “A Open Day: 5 May 2012 16

What’s next? Cyber. Vis – Visualise attacks on business processes 1 NFlow. Vis – University's Computer Network Under Attack 2 Meer. CAT® – Visual tool for Wireless Security Analysis 3 http: //www. cs. ox. ac. uk/projects/cybervis/index. html http: //ff. cx/nflowvis/ 3 http: //securedecisions. com/products/meercat/ 4 http: //5 thsentinel. wordpress. com/2009/10/19/inappropriate-content-visualization-mark-ii/ Circos – Inappropriate content visualisation 1 2 Open Day: 5 May 2012 17 4

Conclusions Reflected on why it’s important to focus on the human element of security § Three-pronged approach to addressing the issues § Recommendations for effectively communicating cybersecurity risk § Next steps for our work § Open Day: 5 May 2012 18

Thanks! Any questions? Open Day: 5 May 2012 19