How to prevent small mistakes that have massive impact?

Question

I frequently have very personal files temporarily on my virtual desktop.

I sometimes download a new program, which is going into a VM. Before sending it in there, I tend to VirusTotal scan it.

I load my VirusTotal bookmark in my browser (Pale Moon) click the "upload file" button, it defaults to the "desktop" view of files, and I select the correct file to upload.

Then it instantly uploads to VirusTotal, owned by Google.

It has not happened yet, but what if, one day, I make a slight mistake when clicking the program installer file, and instead select my latest ZIP archive of my internal system, full of highly private and personal data? It will be instantly uploaded to Google, forever out of my control.

Whether Google will ever use this against me in practice is beside the point: I hate the idea of this being so easily possible just from one small mistake like that.

The same could also happen if I have the browser windowed with VirusTotal open, and accidentally drag-and-drop the wrong file into it. Instant upload. Or I keep it windowed while I'm supposed to drag-and-drop my private ZIP archive, but there's a muscle twitch in my hand, or a mechanical glitch with my mouse, so the file ends up dropping into the browser window instead of going to the File Explorer location which I intended.

A lot of people are much less secure than I, and even keep a "remote cloud drive" around at all times in their File Explorer which they could accidentally drop files into at any time. Things like that make me lose sleep, just thinking about others' data flying around with no control, especially if I'm included in their data somehow.

I can think of numerous things like that. And it really stresses me out. I can't be the only one.

Other than constantly being on "full guard", are there any "tricks" to make sure this kind of thing never happens?

Answer 1

There is a whole field of study around this called "Human Factors". It comes into play when the system is secure but a mistake or an action by a person creates a hazard or a breach.

There are quite a number of things that one can do to help prevent mistakes in a system. They generally fall into broad categories of layered factors:

• errors in the moment
• situational conditions
• control environment
• culture/values/resources

You obviously have a strong desire and a value to not make this particular mistake. And looking at just the "errors in the moment" isn't very effective.

What you can do is to look at the conditions and context around that thing that you do not want to do by mistake and see if there are things to prevent mistakes. For instance, you say that a mis-click will instantly send any file. What can you do to put in some kind of gate? A way to double-check?

Given what you've described, it sounds like there are a few defaults that you could change. For instance, default to a folder called "To Scan" and put any file you want to check there. Move it out of that folder once it's scanned. Yes, it makes it a few extra steps, but you are unlikely to mistakenly move the wrong file there, then select it with your browser. It gives you time to see what the file is and gives your brain a second to double-check.

This type of thing is what Human Factors experts do: they look for the weakness in the human context and processes and look for ways to give the person what they need to act in the way they want to act.

Disclosure: I am the co-author of HFACS-Cyber, which is the only Human Factors model for IT selected by the International Maritime Organisation to boost IT security globally.