In the UX field, personas are used to help designers think like the future end-users.
Is this technique also used in the field of information security, i.e. to think like a hacker in order to prioritize tests?
I'm very new in information security.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Yes, in a way.
When one designs a Threat Model, one thinks about the current system, the potential goals of a "Threat Actor" (attacker or a careless user), and the currently available tools, techniques, and procedures to exploit vulnerabilities.
For instance, I work with one client that outlines all this in detailed documents and sets priorities in relation to the risk priorities of the system and business. The focus is on threats not the attackers themselves, though.
That said, there is a huge benefit to using the UX style of personas in a more traditional way to deal with the "careless user" problem. In many cases, better UX would prevent many of the user-generated security problems we face daily.
I guess there is also a base-level, persona-like thinking in categorising attackers from skiddy to state actors. Or, if you follow Micken's nomenclature, you have the Mossad/not-Mossad duality.
RBAC may also be an area where persona-like thinking can be useful.
Whether or not personas are useful to you will sort of depend on what you are doing - and in your case, what tests we are talking about.
In general, one issue with trying to think 'like a hacker' (or ascribing personas to attackers) is that it is a lot like rolling your own encryption: you might start feeling you are safe, and worse, might start believing you are.
There are many advocates for the use of personas, it rarely pays back the effort involved, even when a pre-created set of attacker personas are available. It is hard to predict what an attacker will do, but more importantly, there are better techniques available, such as the use of STRIDE, attack trees or CAPEC.
I also argue against the use of "think like an attacker" http://emergentchaos.com/archives/2016/04/think-like-an-attacker-is-an-opt-in-mistake.html