How can we get into the user's mindset?

Question

As security folk, we tend to over- or under-estimate the capabilities and educatedness of our users, especially in terms of resistance to social engineering attacks.

Stereotypically, this is due to us all being basement-dwelling social rejects, but more often it's a case of us not interfacing with our users very often. This can be a problem, especially with social engineering attacks, because we might miss critical problems or direct our attention and resources into the wrong thing. We might think of users as people to train, but often the reality is that we need to train ourselves instead.

How can we better understand our users, in terms of security awareness?

• Are there cost-effective ways of interviewing users within a business environment?
• Any particular questions we should ask them?
• Any other tips to improve our understanding?

Answer 1

I think you have hit the nail on the head when you say, "...not interfacing with our users very often"

You absolutely must work with the end users to understand their view - most end users have no interest in understanding what 0-day even means, let alone why they should care.

A lot of what I do is that interface between technical security teams and non-technical clients, and the best approach, in my opinion, is to sit down with the user and understand what their job demands of them. What are the easy and difficult aspects?

• As an example, do they have old laptops which take ages to boot? If so, you will find they will not want to do a full shutdown every night but instead may just hibernate their machines. Which will obviously break the protection offered by full disk encryption. So your essential security feature is wiped out despite everyone knowing it is valuable. The solution then requires liaison with more senior levels to articulate the problem, possibly referring to data protection legislation, and then with IT.

Do you understand the drivers for your users? If you don't talk to them, you won't - and by talk I really don't mean evangelising about security. I mean listen to them, listen to their rants about IT not working, listen to what they think they need to do as part of their day job, then go away and analyse what impact their drivers and aspirations have on your security aims.

Because at the end of the day in many organisations security is seen as a blocker, something that just stops people being able to work; and then when the organisation is hacked it is the security team's fault for not making them secure.

Awareness at grass roots level first - then build your security strategy to support the IT strategy and business strategy. Support at user level will make it much simpler to have security built in to improvement projects and BAU.

Answer 2

I know this is more like a comment then an answer, but... (in addition to Rory's answer)

Smalltalk, smalltalk, smalktalk!!!

The best approch it to talk to them, especially when they have break. Interfering with they work routine can be VERY counter productive. Start with completely unrelated topic (I found great app on the Market. It's about...) and slowly lean into topic you want to discuss.

And, from my experience, I would recommended to avoid formal interveiws - they put too much stress on person and usually you won't get as much data as you would want simply due to fear of failling / doing something wrong.

Answer 3

Usability, usability, usability.

If you want the user to behave in a secure fashion, it has to be the easiest path for them to follow. Security generally doesn't make things easier. Much of that is our fault for giving them difficult requirements.

Something as simple as prompting the user "Key in your new passphrase of three words or more" instead of prompting them "Select a password of at least 10 ASCII printable characters containing at least one upper case letter and either a digit or special character, excluding ampersand, apostrophe, and quotation marks" will help encourage secure behavior without being hard-to-use. Psychologically, three words is shorter than 15 characters, so people are less likely to be frustrated.

Answer 4

It can be really important for an organization to have staff that is security minded enough to be resistant to different kind of attacks against both person and the systems they are using.

In order to find the users awareness in regards to security, but also help foster and make security mindset an inherent property for all employees, I recommend that you have management commit to having security minded staff. Give proper training to management on what is important factors and let them know that security knowledge of your staff may be a performance indicator. This is a vital first step, in my opinion, in order to properly anchor the need to measure/discover our users mindset.

For example, how do you answer these questions?

• How well does an employee perform in his job function? Compared to others and compared to KPI.
• What does the employees think of the company?

If you already have ways to answer the above questions then I think you need to bake in security awareness into those processes. My point is that the process in knowing the mindset of our users should be baked into the process to answer the above questions. Some examples in how you could answer your question and also the above:

• Create a employee survey that consists of important questions for the organization. Have these annually.
• Have HR bake in security minded questions for job interviews.
• In your annual employee talk be sure to question your employee on what they think about the currrent stance on security. Make it one of the KPI's that you measure your employees on.
• Have the employees answer annual mandatory security oriented questionnaires.

Example questions for interviews, employee talks and questionnaires (for increased awareness answer the questions instantly instead of just giving them a final score) :

• Which of these is considered a strong password
• Which of these sites would you NOT log into
• How can you identify if you are communicating using a secure channel on the site your are using?
• What does the following message mean?
• What would you do, in order to do a best possible job, if someone calls you in an emergency to get a hold of documents on the intranet storage server?
• Why should you boot your machine when the computer prompts you for it?
• Which of these threats does locking your PC thwart?
• What is considered a safe way of disposing your mobile phone or PC?
• Which of these wireless networks would most likely be considered safe to connect too?
• Which email address would you use to register to your daughters football team's site with?

Update: SANS tweeted today that they have released new resources for measuring human risk and behavior.

Metrics give you the ability to track and measure the impact of your security awareness program. This can be used to improve your training, demonstrate return on investment, or compare your human risk to other organizations in your industry.

There is a couple of different resources available:

• Metrics Matrix.

  This spreadsheet identifies and documents different options for measuring your security awareness program

• Measuring Human Risk - Survey

  This twenty-five question survey will help you determine the human risk in your organization. Each question and its respective answers have different levels of risk associated with them. Depending on how your employees respond, you can add up the answers and determine a quantitative value of your human risk.

• Phishing Assessments Planning Package

  Phishing assessments are not only a simple and effective way to measure the impact of your awareness program, but a very powerful way to reinforce key training concepts. This package helps you step by step plan, build and implement a successful phishing assessment program, including several templates.

Answer 5

IMO, we only need to reach the users to the level of which we need to protect the company. This means that security training should not be some bundled slides playing to a monotone voice asking some simple multiple choice questions at the end. Instead (and I'm not naive to the point that budget must play a role here) user security training should be customized to the specific roles of the company. If Joe User gets social engineered and owned, your defense strategy should be much different than if it were Joe CEO. If the defense strategy is different for these users because the stakes are different, then why would user training be the same?

In regards to social interaction as "basement-dwelling rejects", I think you make an apt point. We need to work on clear communication that is appropriate for the level of the role we are dealing with. In addition, security (at least in my experience) tends to not be the favorite department of a company, so having that good PR in building working relationships could hopefully help in shifting that stereotype. I am not sure how much of that would transfer to better security.