Usable security and the human in the loop Michelle Mazurek Some - - PowerPoint PPT Presentation

▶
usable security and the human in the loop
SMART_READER_LITE
LIVE PREVIEW

Usable security and the human in the loop Michelle Mazurek Some - - PowerPoint PPT Presentation

Oct 11, 2022 171 likes •574 views

Usable security and the human in the loop Michelle Mazurek Some slides adapted from Lujo Bauer, Lorrie Cranor, Rob Reeder, Blase Ur, and Yinqian Zhang 1 The human threat Malicious humans Humans who dont know what to do

slide-1
SLIDE 1

1

Usable security and the human in the loop

Michelle Mazurek

Some slides adapted from Lujo Bauer, Lorrie Cranor, Rob Reeder, Blase Ur, and Yinqian Zhang

slide-2
SLIDE 2

2

The human threat

  • Malicious humans
  • Humans who don’t know what to do
  • Unmotivated humans
  • Humans with human limitations
slide-3
SLIDE 3

3

Key challenges

  • Security is a secondary task

secondary task

– Users are trying to get something else done

  • Security concepts are har

hard

– Viruses, certificates, SSL, encryption, phishing

  • Human capabilities are limited

imited

slide-4
SLIDE 4

4

Are you capable of remembering a unique strong password for every account you have?

slide-5
SLIDE 5

5

Key challenges

  • Security is a secondary task

secondary task

  • Security concepts are har

hard

  • Human capabilities are limited

imited

  • Habituat

Habituation ion

– The “crying wolf” problem

  • Misaligned priorit

priorities ies

slide-6
SLIDE 6

6

Security Expert User

Keep the bad guys out Don’t lock me out!

slide-7
SLIDE 7

7

Key challenges

  • Security is a secondary task

secondary task

  • Security concepts are har

hard

  • Human capabilities are limited

imited

  • Habituat

Habituation ion

  • Misaligned priorit

priorities ies

  • Act

Active adversaries ive adversaries

– Unlike ordinary UX

slide-8
SLIDE 8

8

slide-9
SLIDE 9

9

GREY AND USER BUY GREY AND USER BUY-IN

  • IN

Case study #1:

slide-10
SLIDE 10

10

Grey: Smartphone-enabled doors

  • Access control system for doors in

the CMU CyLab offices

  • Based on formal proofs of access

– Allows users to grant access to others remotely

  • Year-long interview study

– 29 users x 12 accesses per week

  • L. Bauer, L.F. Cranor, R.W. Reeder, M.K. Reiter, and K. Vaniea. A User Study of Pol

A User Study of Policy icy Cr Creat eation in a Flexible Access-Contr ion in a Flexible Access-Control System.

  • l System. CHI 2008.
  • L. Bauer, L. F. Cranor, M. K. Reiter, and K. Vaniea. Lessons Learned fr

Lessons Learned from t

  • m the

he Deployment of a Smartphone-Based Access-Contr Deployment of a Smartphone-Based Access-Control System.

  • l System. SOUPS 2007.
slide-11
SLIDE 11

11

Users complained about speed

  • Videotaped a door to

understand how Grey is different from keys

slide-12
SLIDE 12

12

Average access times

Getting keys 3.6 sec 5.4 sec Stop in front of door Door

  • pened

Total 14.7 sec

σ = 3.1 σ = 3.1

5.7 sec

σ = 3.6 σ = 5.6

Door Closed Door Closed 8.4 sec 2.9 sec 3.8 sec Stop in front of door Getting phone Door

  • pened

Total 15.1 sec

σ = 2.8 σ = 1.5 σ = 1.1 σ = 3.9

Grey is not noticeably slower than keys!

slide-13
SLIDE 13

13

“I find myself standing outside and everybody inside is looking at me standing outside while I am trying to futz with my phone and open the stupid door.”

Takeaway: Misaligned priorities

slide-14
SLIDE 14

14

PASSWORD EXPIRA ASSWORD EXPIRATION AND TION AND USER BEHA USER BEHAVIOR VIOR

Case Study #2

slide-15
SLIDE 15

15

Does password expiration improve security in practice?

  • Observat

Observation ion

– Users often respond to password expiration by transforming their previous passwords in small ways

[Adams & Sasse 99 … we’ll talk about this later]

  • Conjectur

Conjecture

– Attackers can exploit the similarity of passwords in the same account to predict the future password based

  • n the old ones

[Zhang et. al, CCS 2010]

slide-16
SLIDE 16

16

Empirical analysis

  • UNC “Onyen” logins

– Broadly used by campus and hospital personnel – Password change required every 3 months – No repetition within 1 year

  • 51141 unsalted hashes, 10374 defunct accounts

– 4 to 15 hashes per account in temporal order

  • Cracked ~8k accounts, 8 months, standard tools
  • Experimental set: 7752 accounts

– At least one cracked password, NOT the last one

slide-17
SLIDE 17

17

Transform Trees

s→$

p→ P

s→$

p→ P

s→$

p→ P

“password” “pa$sword”? “Password”? “pa$$word”? “Pa$sword”? “Pa$sword”? ┴

  • Approximation algorithm for optimal tree

searching

slide-18
SLIDE 18

18

Location Independent Transforms

CATEGORY EXAMPLE

Capitalization tarheels#1 → tArheels#1 Deletion tarheels#1 → tarheels1 Duplication tarheels#1 → tarheels#11 Substitution tarheels#1 → tarheels#2 Insertion tarheels#1 → tarheels#12 Leet Transform tarheels#1 → t@rheels#1 Block Move tarheels#1 → #tarheels1 Keyboard Transform tarheels#1 → tarheels#!

slide-19
SLIDE 19

19

Evaluation

  • Pick a known plaintext, non-last password (OLD)
  • Pick any later password (NEW)
  • Attempt to crack NEW with transform tree

rooted at OLD

slide-20
SLIDE 20

20

Results: Offline Attack

depth 1 depth 2 depth 3 depth 4 0% 10% 20% 30% 40% 50% Edit Dist Edit w/ Mov Loc Ind Pruned 26% 28% 25% 17% 39% 41% 37% 24% 41% 28% 30%

Success rate

Within 3 Seconds !!

Takeaways: Memory limitations matter Convenience always wins

slide-21
SLIDE 21

21

Understanding the human

  • Who wants to practice good security but doesn’t

know how

  • Who is indifferent to security but will comply

– If it’s easy – If it’s the default – If it doesn’t interfere with the primary task

slide-22
SLIDE 22

22

Human-in-the-loop framework

  • Based on Communication-Human Information

Processing Model (C-HIP) from Warnings Science

  • Models human interaction

with secure systems

  • Can help identify (non-malicious)

human threats

  • L. Cranor. A Framework for Reasoning About the Human In the Loop. Usability, Psychology and Security 2008.

http://www.usenix.org/events/upsec08/tech/full_papers/cranor/cranor.pdf

slide-23
SLIDE 23

23

Human-in-the-loop framework

Human Receiver

Intentions Motivation Attitudes and Beliefs Personal Variables Knowledge & Experience Demographics and Personal Characteristics Capabilities

Communication Behavior Communication Impediments

Interference Environmental Stimuli

Communication Processing

Comprehension

Knowledge Acquisition Application Knowledge Retention Knowledge Transfer

Communication Delivery

Attention Switch Attention Maintenance

Communication Communication Impediments

Interference Environmental Stimuli

Human Receiver

Intentions Motivation Attitudes and Beliefs Personal Variables Knowledge & Experience Demographics and Personal Characteristics Capabilities

Communication Processing

Comprehension

Knowledge Acquisition Application Knowledge Retention Knowledge Transfer

Communication Delivery

Attention Switch Attention Maintenance

Behavior

slide-24
SLIDE 24

24

Human threat identification and mitigation process

Task Identification Task Automation Failure Mitigation User Studies Failure Identification Human-in- the-loop Framework User Studies

Identify points where system relies on humans to perform security-critical functions Find ways to partially or fully automate some

  • f these tasks

Identify potential failure modes for remaining tasks Find ways to prevent these failures

slide-25
SLIDE 25

25

Human-in-the-loop framework

Human Receiver

Intentions Motivation Attitudes and Beliefs Personal Variables Knowledge & Experience Demographics and Personal Characteristics Capabilities

Communication Behavior Communication Impediments

Interference Environmental Stimuli

Communication Processing

Comprehension

Knowledge Acquisition Application Knowledge Retention Knowledge Transfer

Communication Delivery

Attention Switch Attention Maintenance

Comprehension

slide-26
SLIDE 26

26

slide-27
SLIDE 27

27

Internet Explorer cookie flag

slide-28
SLIDE 28

28

Human threat identification and mitigation process

Task Identification Task Automation Failure Mitigation User Studies Failure Identification Human-in- the-loop Framework User Studies

Identify points where system relies on humans to perform security-critical functions Find ways to partially or fully automate some

  • f these tasks

Identify potential failure modes for remaining tasks Find ways to prevent these failures

slide-29
SLIDE 29

29

slide-30
SLIDE 30

30

slide-31
SLIDE 31

31

Users are not the enemy

  • “These observations cannot be disputed, but

the conclusion that this behavior occurs because users are inherently careless — and therefore insecure — needs to be challenged.”

  • Study methods:

– Online survey, primarily from organization A – Interviews at organizations A and B – Grounded theory

slide-32
SLIDE 32

32

Discussion questions

  • This paper is “classic” (from 1999). What do you

think might be different today? What questions would you add or change?

  • Are these participants representative (of what)?

– What other groups could you ask? How might the results be different?

slide-33
SLIDE 33

33

Discussion questions

  • “Users identified certain systems as worthy of

secure password practices, while others were perceived as ‘not important enough.’”

– How do you motivate users? – How do you treat users as partners? – What about when this behavior is rational/correct?

  • What solutions are suggested?

– Do you think these would work? Why / why not? – Other suggestions?

slide-34
SLIDE 34

34

(One) Hierarchy of solutions

  • Make it “just work”

– Invisible security

  • Make security/privacy

understandable

– Make it visible – Make it intuitive – Use metaphors that users can relate to

  • Train the user
slide-35
SLIDE 35

35

Automation considered harmful?

Problems:

  • Insufficient flexibility
  • Imposition of values
  • Impact on user experience

– Especially in failure cases

  • Examples from your home domain?
slide-36
SLIDE 36

36

Considerations for automating

  • Accuracy
  • Stakeholder values
  • Information overload?
  • Implicit instead?
  • Keep human informed?
  • Fail gracefully?
  • Do you agree with all of these?
  • Are there others we should add?
slide-37
SLIDE 37

37

Suggested research directions

Suggested directions:

  • Exposing system behavior
  • Causality and contextualization

– Moving system -> application

  • Social identity and decisionmaking
slide-38
SLIDE 38

38

Discussion questions

  • This one is from 2007. How do you think these

issues have evolved in the meantime?

  • Problems/solutions in your home domain

– How do they fit into this framework?

  • Problems/challenges in the suggested directions?