5

In the UX field, personas are used to help designers think like the future end-users.

Is this technique also used in the field of information security, i.e. to think like a hacker in order to prioritize tests?

I'm very new in information security.

1
  • I suggest a better form for the question is "Should this technique be used in information security..." Mar 2, 2017 at 21:07

3 Answers 3

5

Yes, in a way.

When one designs a Threat Model, one thinks about the current system, the potential goals of a "Threat Actor" (attacker or a careless user), and the currently available tools, techniques, and procedures to exploit vulnerabilities.

For instance, I work with one client that outlines all this in detailed documents and sets priorities in relation to the risk priorities of the system and business. The focus is on threats not the attackers themselves, though.

That said, there is a huge benefit to using the UX style of personas in a more traditional way to deal with the "careless user" problem. In many cases, better UX would prevent many of the user-generated security problems we face daily.

0

I guess there is also a base-level, persona-like thinking in categorising attackers from skiddy to state actors. Or, if you follow Micken's nomenclature, you have the Mossad/not-Mossad duality.

RBAC may also be an area where persona-like thinking can be useful.

Whether or not personas are useful to you will sort of depend on what you are doing - and in your case, what tests we are talking about.

In general, one issue with trying to think 'like a hacker' (or ascribing personas to attackers) is that it is a lot like rolling your own encryption: you might start feeling you are safe, and worse, might start believing you are.

-1

There are many advocates for the use of personas, it rarely pays back the effort involved, even when a pre-created set of attacker personas are available. It is hard to predict what an attacker will do, but more importantly, there are better techniques available, such as the use of STRIDE, attack trees or CAPEC.

I also argue against the use of "think like an attacker" http://emergentchaos.com/archives/2016/04/think-like-an-attacker-is-an-opt-in-mistake.html

4
  • 1
    This kinda amounts to an answer of "don't do it - to find out more, read my book" (your blog article does not explain much). Making this sort of a link-only answer (without a link). Can you expand at all?
    – schroeder
    Mar 1, 2017 at 16:19
  • I tried to avoid the 'read my book' approach in the first paragraph. What would you say other than "it doesn't pay off?" Mar 1, 2017 at 16:52
  • The question is: do people use personas? and the answer is "yes". Your perspective on the use of personas has merit, but you need to include the relevant details in the answer. I don't mind you referencing your book or your blog, but an excerpt would be useful.
    – schroeder
    Mar 1, 2017 at 17:52
  • In that case I'm going to suggest edits to the question; the question that somene new to a field should ask is not 'does anyone do X?" but 'should I do X?" Mar 2, 2017 at 21:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .