1. Effective Communication of Cyber Security Risks: Addressing the Human Element in Security Jason R.C. Nurse (PhD, MSc, BSc) Cyber Security Centre, Department of Computer Science University of Oxford, UK 7th International Scientific Conference Security and Protection of Information 22–24 May 2013 Trade Fairs Brno, Czech Republic http://tease-project.info/

2. Open Day: 5 May 2012 Outline Why focus on humans and not technology? Addressing the human-related issues Recommendations for communicating risks Next steps… 1

3. Open Day: 5 May 2012 Outline Why focus on humans and not technology? Addressing the human-related issues Recommendations for communicating risks Next steps… 2

4. Open Day: 5 May 2012 Why focus on the human element? Increase in attacks that exploit humans  Spamming  Phishing, spear phishing  Social-engineering threats  Malicious applications 3

5. Open Day: 5 May 2012 Why focus on the human element? End-user systems tend not to design for usable security  “Why Johnny can’t encrypt?” (1999)  “It’s too complicated so I turned it off!” (2010)  Countless other system examples…  Configuring home routers and firewalls  Forced to using complex passwords, that are to be changed monthly 4

6. Open Day: 5 May 2012 Why focus on the human element? Usability also important for security professionals  Task workload, time factors and increasing complexity of security systems 5 Sax2 Intrusion Prevention and Intrusion Detection System screenshots of event viewers, typical interaction screens (http://www.ids-sax2.com)

7. Open Day: 5 May 2012 Why focus on the human element? In summary, the problems…  For end-users, security is usually a secondary goal  Interfaces tend to be too confusing and clumsy  Lack of quality feedback to users when performing security tasks  Strain on users to remember several security settings, configurations / passwords  Abundance of technical terminology  Forcing uninformed security decisions on users  For security professionals, interfaces are difficult to use  Task workload and increasing complexity of security systems 6

8. Open Day: 5 May 2012 Outline Why focus on humans and not technology? Addressing the human-related issues Recommendations for communicating risks Next steps… 7

9. Open Day: 5 May 2012 Addressing the human element in security Three-pronged approach  How to building trust in interfaces and information?  What are the key practices in designing for usable security?  How to effectively communicate cybersecurity risks to end-users and security professionals? 8 Trust Usability Cybersecurity risk communication

10. Open Day: 5 May 2012 Addressing the human element in security 9 Trust Usability Cybersecurity risk communication Key factors: Interface and information presentation, relevance, supporting understanding, … Inspiration from risk communication field – importance of format in presenting risk message, understanding user perceptions Efficient interface design, support user decision-making, reduce use of technical jargon and always provide help functionality, …

11. Open Day: 5 May 2012 Outline Why focus on humans and not technology? Addressing the human-related issues Recommendations for communicating risks Next steps… 10

12. Open Day: 5 May 2012 Recommendations for communicating risks  Planning how cybersecurity risks will be communicated is crucial. Be clear on the goal, messages and strategies most useful, and characteristics of typical system users  The meaning of information presented in security / risk messages should be clear. Information should be specific and unambiguous, or risks being disregarded  Users should be presented with clear and consistent directions for action i.e., options for responding to a security risk. Narratives might be provided in helping users to visualise outcome of decisions 11 http://i.msdn.microsoft.com/dynimg/IC107028.gif

13. Open Day: 5 May 2012 Recommendations for communicating risks  Design with the understanding that humans possess a limited processing capacity. Reduce cognitive effort. E.g., present key security / risk information first, optional details later  Make security functionality visible and accessible, while also making users aware of the system’s current security state.  Provide accessible help, advice and documentation for security. 12

14. Open Day: 5 May 2012 Recommendations for communicating risks  For visual communication of security risks, note (i) stick with established colours and use known real-world metaphors (ii) no single visual will be perfect in all situations, etc.  To communicate risks numerically, note, users with high-numeracy levels are likely to pay more attention to risk figures, while low- numerate users may rely more on emotions, mood states and guidance  When communicating risks verbally, may be best to use additional means (e.g., numbers) to adequately communicate the risk. “This site is likely to be malicious” – interpretation of likely is subjective 13 Enterasys Dragon: Intrusion Prevention System Log Analysis (http://blog.tmcnet.com/advanced-netflow-traffic-analysis/2012/12/enterasys-dragon-intrusion-prevention-system-log-analysis.html)

15. Open Day: 5 May 2012 Outline Why focus on humans and not technology? Addressing the human-related issues Recommendations for communicating risks Next steps… 14

16. Open Day: 5 May 2012 What’s next? Evaluating recommendations  Identification of case scenarios where recommendations can be adequately assessed  Development of a prototype system and/or add-on functionality (to existing system, e.g., browser) in line which scenarios to supply practical basis for analysis  User studies to critically evaluate the trustworthiness and effectiveness of communications with and without recommendations proposed 15

17. Open Day: 5 May 2012 What’s next?  Crisis Management – Realising value from open-source information (e.g., Twitter, Facebook, Blogs) 1 16 1 “Building Confidence in Information-Trustworthiness Metrics for Decision Support”, TrustCom 2013 2 “A Data-Reachability Model for Elucidating Privacy and Security Risks Related to the Use of Online Social Networks”, TrustCom 2012 Published research Approach and model Real name Risk exposure  Security and Privacy risks in the use of social media – understanding and communicating the serious risk faced by oversharing 2

18. Open Day: 5 May 2012 What’s next? 17 CyberVis – Visualise attacks on business processes 1 1 http://www.cs.ox.ac.uk/projects/cybervis/index.htmlhttp://www.cs.ox.ac.uk/projects/cybervis/index.html 2 http://ff.cx/nflowvis/http://ff.cx/nflowvis/ 3 http://securedecisions.com/products/meercat/ 4 http://5thsentinel.wordpress.com/2009/10/19/inappropriate-content-visualization-mark-ii/http://securedecisions.com/products/meercat/http://5thsentinel.wordpress.com/2009/10/19/inappropriate-content-visualization-mark-ii/ Circos – Inappropriate content visualisation 4 MeerCAT® – Visual tool for Wireless Security Analysis 3 NFlowVis – University's Computer Network Under Attack 2

19. Open Day: 5 May 2012 Conclusions 18  Reflected on why it’s important to focus on the human element of security  Three-pronged approach to addressing the issues  Recommendations for effectively communicating cybersecurity risk  Next steps for our work

20. Open Day: 5 May 2012 Thanks! Any questions? 19