In the UX field, personas are used to help designers think like the future end-users.

Is this technique also used in the field of information security, i.e. to think like a hacker in order to prioritize tests?

I'm very new in information security.

| improve this question | | | | |
  • I suggest a better form for the question is "Should this technique be used in information security..." – Adam Shostack Mar 2 '17 at 21:07

Yes, in a way.

When one designs a Threat Model, one thinks about the current system, the potential goals of a "Threat Actor" (attacker or a careless user), and the currently available tools, techniques, and procedures to exploit vulnerabilities.

For instance, I work with one client that outlines all this in detailed documents and sets priorities in relation to the risk priorities of the system and business. The focus is on threats not the attackers themselves, though.

That said, there is a huge benefit to using the UX style of personas in a more traditional way to deal with the "careless user" problem. In many cases, better UX would prevent many of the user-generated security problems we face daily.

| improve this answer | | | | |

I guess there is also a base-level, persona-like thinking in categorising attackers from skiddy to state actors. Or, if you follow Micken's nomenclature, you have the Mossad/not-Mossad duality.

RBAC may also be an area where persona-like thinking can be useful.

Whether or not personas are useful to you will sort of depend on what you are doing - and in your case, what tests we are talking about.

In general, one issue with trying to think 'like a hacker' (or ascribing personas to attackers) is that it is a lot like rolling your own encryption: you might start feeling you are safe, and worse, might start believing you are.

| improve this answer | | | | |

There are many advocates for the use of personas, it rarely pays back the effort involved, even when a pre-created set of attacker personas are available. It is hard to predict what an attacker will do, but more importantly, there are better techniques available, such as the use of STRIDE, attack trees or CAPEC.

I also argue against the use of "think like an attacker" http://emergentchaos.com/archives/2016/04/think-like-an-attacker-is-an-opt-in-mistake.html

| improve this answer | | | | |
  • 1
    This kinda amounts to an answer of "don't do it - to find out more, read my book" (your blog article does not explain much). Making this sort of a link-only answer (without a link). Can you expand at all? – schroeder Mar 1 '17 at 16:19
  • I tried to avoid the 'read my book' approach in the first paragraph. What would you say other than "it doesn't pay off?" – Adam Shostack Mar 1 '17 at 16:52
  • The question is: do people use personas? and the answer is "yes". Your perspective on the use of personas has merit, but you need to include the relevant details in the answer. I don't mind you referencing your book or your blog, but an excerpt would be useful. – schroeder Mar 1 '17 at 17:52
  • In that case I'm going to suggest edits to the question; the question that somene new to a field should ask is not 'does anyone do X?" but 'should I do X?" – Adam Shostack Mar 2 '17 at 21:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.