The Human Firewall Is a Myth: Designing Security for Actual Human Behavior - Endurance Imasuen

Yeah, my name is and I'll be speaking on human firewall is a need designing security for actual human behavior. Yeah. Over the last two decades, infosc has repeated a mantra and um it's been that um humors are actually the weakest link. I believe everyone of us here we all familiar with that. But uh today I want to say to you that humans are not actually the weakest link. Why? I'll tell you why. Millions or thousands of pounds have been spent on um designing different trainings to train people about social engineering. But yet despite the fact that millions has been spent or billions over the couple of decade or Yeah. despite that people still fall victim.

So um I had an opportunity to actually work with someone. She's very very intelligent. She's brilliant. She works in the accounting department in XYZ company. She was given a training and after she was given that training, you know, normally the quiz section, she went through the quiz and she got her 100%. None missing. [snorts] Guess what? days after the penetration guys decide to carry out some pain testing in company and in the process guess what she felt victim despite the fact that she did excellently well she scored in 100% she fell for it so that been said, if awareness um training works, why are we still getting fished? I know a speaker a speaker spoke about

fishing, but I'm coming in in another dimension. Um yeah, we are going somewhere. So yeah, if awareness training really works, why people still get caught in the process?

in most establishment at the beginning of the year. Yeah. Yeah. Yeah. Happy new year everyone. Um let's quickly go through what we need to do. They follow the normal procedure. They do a training. Everyone is being trained on security resilience. And after the training comes what? Quiz. And after the quiz then you are left on your own. When do this attack when does it normally happen? Attackers they have different vector and they have different ways in which in which they think you know um they have different um yeah yeah I said that already have different techniques. So [laughter] one thing that normally help them basically is that they use more of human factor. They use more of psychology.

But organizations what organization do? Organiz organization they follow a structured pattern. They follow the normal um traditional pattern. Yeah. These are what organizations do. technical controls,

the adding network parameters, firewalls and endpoint protection. Then after we've introduced the um awareness um section whereby they have to train their staff. Okay, now everything has been everything is done. We have all the firewalls in place. We have all the end points here. Um we are believing that there would be no attack. So yeah the whole thing is now left for human expecting users to function as a deterministic packet filters but forgetting the process in which these various attacks happen.

Basically in a working environment you are given a task you are given a goal and that goal is that you should be able to meet up the target right you should be able to do all your deliverables and yeah just before the stipulated time forgetting about completed workload >> [clears throat] >> Take for instance you are given an assignment you are given a task to meet to to to you are given a deadline in a project and it's already Friday you are you are working tirelessly calls are coming in emails are flying all around and then all of a sudden you get an email you get an email mimicking the manager or the CEO and he's almost at the end of the at the

end of the day. Let's say you finish at half half five or let's say you finish at 5 and that email may just come in at um half 4 and you've got that task to be limited.

you've got um your cognitive is overloaded and then you just receive a sudden email and the email looks exactly like the one that your boss normally sent to you that hey you've got to meet up this task then what should you do I work with um someone when she's working under pressure. She's always scared. You see her hands will just be vibrating. She just want to get everything done so that she doesn't get blamed. In different environments, in different working environment, we have so many persons like that. What about if it happens that that person got that email and that person is just in a rush? Because how did this social engineer how does it work? We all know we all know

about curiosity. We don't know about time pressure. We all know about authority. Now the email is coming from the boss which carries authority. You are being curious because you've got something to quickly do and then you just have to get it done. The truth is that users don't wake up wanting to compromise the company. They're trying to get their work done under immense deadline pressure. Security that determines 100% vigilance is 100% no um is guaranteed to fail honestly. So that being said, so that being said, um we'll just look at Yeah. Um we'll just quickly look at acting the brain first or um authority fear and reward. They got the email and the email is act

is asking you to act within the 15 minutes. Now just take a look at this. Everything at the end of the day still points on the first one which is urgency. based on the authority you have to act fast you have to comply and then the fear come in what if I cannot comply I'm going to get the start or maybe something is going to happen I'm going to get all the blame so I need to I need to quickly act quick and then the reward if you act quickly yeah your boss will know that yeah you are really active you are really doing the So yeah, just take a have a look at how

this all points it points to urgency.

The reason why people make um bad decisions in um working environments is that is not maybe they are not smart. Yes, they are very smart. One of the reason is actually um decision fatigue. You know, you've got to make decision when you are tired and at the end of the day just make that decision based on the fact that you're tired. Then another one is attention switching. You've got you've got a lot going on your head that um you've got so many tasks to meet to meet up with then time pressure and social trust. If mistake is predictable is system flaw not a personal flaw. When the users click a malicious link while juggling three task under a deadline, the system

fails to protect them. How does how does the system fail to protect them? The system normally forget that the attackers what they normally what they normally do and their ways of operating is that they operate under psychology. They operate using the human factor. But most of the training that we normally have, we don't factor it in a human factor. We are going to be looking at most of those training soon. Yeah. Each time something happen in an environment. If John is responsible for clicking, you know, John is being blamed. At least John should have known better. Why would John click after he's been trained and he even passed the quiz? Why would he click? You know, yeah, that's the BL paradigm.

Whereas the systems paraly why was the system vulnerable to one click in the first place? So that being said, we're going to be looking at the next slide which is the um system versus the blame. Now these are the traditional approach. [snorts] You know traditional approach you've got to do the training, you've got to do it repeatedly, annually and sometimes you got to do it like quarterly. Whereas the human centered approach is continuous microlearning embedded in workflows as you are working you know you can just be a slide can just come up on your on your screen you know teaching you some of those things you need to be conscious of fishing simulations in public um leaders

boards frictionless yeah the human centered ones frictionless um one click incident reporting and praise. It's normal. It's normal for someone to get caught. But the um the what makes people to fail is staying in the process of that failure. What about if a company designs a system whereby stuff can easily be reported very easy and when it's reported you don't start blaming the victim that oh you should have done better at least that person should be praised at least just for reporting the incident. Then another one is complex policies changing every um 90 days. Oh sorry complex password policies changing every 90 days. Yes, it's good for compliance sake. Yeah, it's good. But the best should be f2

which is embedded under cryptography. That one does not run on the network. It stays there in your system. Take for instance like a pass key and passwordless authentication. There's no way. What does this what what are attackers looking for? attackers are looking for one your password to be able to gain access into your into the system. Right? So if they don't have your password, if they don't have your credentials, how would they be able to gain such access? Then another one is um the traditional method is generating ambiguous popup warning and dialogue. Then the human center is contest aware actionable security prompts. Then the last one is blame the user when credentials are stolen. One is FFA binding

conditional assets and quick recovery. If this is reported it should quickly be recovered.

Yeah. Um yeah, security design which we've talked about the passwordless and fi2 pass key the contest aware MFA the clear security prompt the frictionless recovery. Now what does the better security look like? This is what better security looks like. Instead of 45 minutes compliance modules, a two minute contextual micro lesson delivered directly inside Slack or teams during relevance workload is better. Punishing users who fail fishing simulations. Then um the better one is praising detectors and providing one click. Oh yeah, one click [clears throat] report suspicious email button with feedback. If anything doesn't look right, say it and report it and at the end of the day resulted. Is that better? Now this four shift move

your security program from passive compliance to operational capability. Now just notice how this shift reduces frustration while increasing a uh while increasing an actual protection.

The strongest security culture rewarding not protection. Normally in every establishment what people are looking at is the protection right I mean perfection sorry the strongest security should start rewarding reporting and however the reporting but should be made visible should be made more visible if anything if you see anything that doesn't feel right that doesn't feel safe just report it and an investigation will be carried out dually. Now these are the core five security principles. The first one is designed for cognitive limit. Never assume unlimited user attention or working memory. Then the second one is to reduce the friction. We've got to make the user path the easiest and fastest way to work. expect mistakes to happen. Yeah, anybody can

forfeit him. It happens. But if the mistake is made, what's the next step to take? The other one is measure behavior. Track reporting speed and dwell time, not quiz scores. Empower and don't blame. However security um security is better when it begins with um a design for for actual human behavior. A better security is is better and is good when it's been designed for actual human behavior. So um that being said, I think I've exhausted almost all my time. Does anyone have any question please? Yeah, go ahead. >> Thank you for the presentation. I have my question about social engineering. So what in your opinion?

Yeah. One of the strongest ways to equip the human mind is to make sure that there's a switch from the traditional way down to the human factor way. I don't know if you understand now what's the traditional way the non traditional ways that we all know is at the beginning of the year we get trained on security matters and then we do our quiz after we've done the quiz then yeah everyone is good once you're able to pass the quiz that means you know despite that a lot of people still fall victim now the human centered way is that you level down to everybody's level. There are ways it can be it can be disseminated. It can be disseminated in

for instance in a video contest. People can most people can easily learn when is being designed in a video contest. Do you get than just the you read then you take your quiz you pass you're good that's just one example. >> Thank you. Yes sir. He's not other good examples related to your home life instead of your work life about protecting your parents and children to that is boring work.

[snorts] >> Sorry I didn't get sorry. So you said all your examples in your answer just now about work. >> Yeah. >> And your time as an employee, that place you go to where you're trapped for seven, eight, nine hours a day to do work that whoever is paying you not only fishing but happens in your real life, your outside life. >> Yeah. So if you aim your training at how people protect their banks and worry about their bank accounts, how you can protect their families, how they protect their families, that brings training home to people in a better way, a more emotional way than training at work. >> Perfect. >> Yeah, for sure. For sure. Um

you can always bring this training to your home um to your parents or to your children and understand the fact that the way the adult learn is different from the way a child learn. The way teenager learn is different from the way a 7year-old boy would learn. Like I said, you've got to narrow every lesson down to appropriate age. That was why I said that the traditional ways should be should be taken off. It should be improved in the in the sense that the um human centered um learning um ways should be introduced and should increase rather than just the normal traditional ways. >> I'm not screwing with your message at all. I'm just saying also

>> Yeah. Yeah. Yeah. Take it down more. Yeah. Yes. Yes. Yes. Yes. >> Exactly. Yes. Yes. That that's the that's the point I'm trying to that's the point I'm trying to raise as well that even as much as you do it in your own working environment you can also you know bring it down home but in a human centered way. Thank you. >> Yes. I was wondering if you had any advice for convincing maybe um people higher up to adopt some of the tips that you mentioned. >> Um sorry, just a quick announcement while you take questions. Uh there's the rapid draw at 5:30 and track one. So if you guys could head over there.

>> Okay. Thank you. Sorry for your question. >> I was wondering if you had any tips on how to convince leadership to adopt this. >> Yes. Um, one of the ways to advise the people in leadership to adopt this system is

is creating is creating more awareness and um showing them actually talking to them oneonone and letting them know the reason why they should adopt this kind of models. Thank you. Any further questions please? Yes sir. >> So first question I was kind of confused because at the start you said that humans are viewed as like the most or that's not true. But if it's the most common way to get into an organization then is it not fundamentally true? >> Yeah. The reason why I said humors are really not the weakest link is that if you take a look at what has been going on for years, same pattern of teaching and same pattern of disseminating

informations to them. After you teach them, they go on take the quiz and then they good once they able to pass the quiz. for Yates this fishing persist. >> That's not that's not a comment about them not being the weakest link. That's again strengthening the argument that they are the >> No, I think we had decades of trying yeah to me I think >> to me sorry I think that the weakest link is the way that the teaching is being Yeah. Yeah. Yeah. The teaching is being um Thank you very much. the way they are being taught, the way their education is being disseminated. I think that's the other point about something like replacing training with micro training.

Is that is that [snorts] backed by like studies and statistics that it's more viable? As in personally, I know that if I if I'm given a choice between one training or I know that I'm going to get a bunch of different messages at random times that are going to make me content switch, I'm going to find a way to bypass those many tasks so that I don't do them because that's more of a pain. So, should the approach not be more truly human centered around understanding the way different people respond to things specifically to them? >> Yes. Different people respond to things differently. But the more you see stuff, the more you visualize things, the more

it sink into the brain and the mind, the more the mind begin to dwell dwell on it. So take for instance in a team meeting you know is repeated and stuffs they are seen it all the time. So the more they see it even whilst sleeping they can still remember and when social attack comes up it's much more easier to detect than just having the training once in a year or once in or once in 3 months. >> I guess my point is realistically I suppose the actual uh more human or like correct human centered approaches some are individual tailored to the individual right? >> Yeah opposed to one or the other. >> Yeah yeah

thank you thank you very much. Thank you everyone. Thank you. I really do appreciate your time. Thanks.