Cybersecurity 4 security is sociotechnical issue

Security is a socio-technical issue

Cybersecurity: Security is a socio-technical issue

Slide 1

Improved security technology
• Computer security and security
engineering focuses on the technical
aspects of the cybersecurity problem


Slide 2

• By reducing vulnerabilities in code and
by adding more checks to code, many
security vulnerabilities can be avoided
and the number of incidents reduced
• However, this can significantly increase
costs and time required for development
and so delay delivery of the software

Slide 3

© John Wiley and Sons 2004


Slide 4

• “If you think technology can solve your
security problems, then you don't
understand the problems and you don't
understand the technology.”


Slide 5

© John Wiley and Sons 2004

• "Security is a
chain; it's only
as secure as
the weakest
link."

Slide 6

• Technology is necessary but cannot, on
its own, guarantee that systems will be
secure
• Cybersecurity is a socio-technical rather
than a technical problem

Slide 7

Why technology is not enough
• Technology reliability cannot be
guaranteed
• Insider attacks
• Technical security compromises made
for usability reasons

Slide 8

• Failure of organisational procedures or
poorly designed procedures
• Human carelessness
• Social engineering


Slide 9

Unreliable technology
• In the same way that it is practically
impossible to guarantee that a complex
system is free from bugs, it is also
impossible to guarantee that a system is
free from security vulnerabilities

Slide 10

• Even if a system A is „secure‟, it may
rely on other systems that are
potentially insecure. If these are owned
by different people, „system wide‟
security validation is impossible


Slide 11

Insider attacks
• Insiders have legitimate credentials that
allows them access to the system
– Therefore, strong access control
technology is not a barrier


Slide 12

• Insiders in an organisation are aware of the
technical safeguards built into the system and
may know how to circumvent these –
especially if they have privileged system
access
• Insiders have local knowledge that may be
used for social engineering and so may be
able to discover privileged information.

Slide 13

Maroochy water breach

Image credit: www.discoverqueensland.com.au


Slide 14

Usability vs security
• There is always a trade-off to be made
between usability and security
• Security procedures slow down system
operation and may alienate users


Slide 15

Companies may make a deliberate
decision to use weaker security procedures
so that users don‟t decide to go elsewhere
Login/password
authentication instead of
biometrics

© http://www.activistpost.com/ 2012

Unencrypted information
as encryption slows
down the system
Slide 16

Procedural failures
• Procedures that are intended to
maintain security may be badly
designed or implemented
• This may introduce vulnerabilities into
the system or may mean that users
have to circumvent procedures

Slide 17

Poor procedures
• Companies request strong passwords but do
not provide any help to users how to construct
strong easy to remember passwords such as
“My_hamster.spot
• Requirements for regular password change.
Thought to improve security but actually means
that users can‟t remember passwords so they
write them down

Slide 18

Human carelessness
• People will inevitably be
careless

© www.labnol.org 2009


– Leave systems
unattended whilst they
are logged on
– Use authentication in
public places where
they can be observed

Slide 19

Some technical controls
against carelessness
but impossible to
completely control this
vulnerability without
incurring very high costs

Slide 20

Social engineering

© thehackernews.com 2011


• Many examples
that show users
are willing to
provide
confidential
information to a
plausible
Slide 21

•

Attacker Alex calls system admin Bob pretending to
be the manager of a company and asks for his
password to be reset.

•

He asks Bob to tell him the new password

•

Bob wants to please his boss so does as he is asked
.

•

Alex then can gain access to the system (and lock
out the legitimate manager)


Slide 22

Multiple points of failure
• These „social‟ vulnerabilities may be
exploited in connection with each other
or with technical vulnerabilities to gain
access to system


Slide 23

• For example, a successful password
attack may require social engineering to
convince system administators to reset
a user‟s password


Slide 24

• A poor password change
procedure, which does not include a
check to ensure that the requestor is
legitimate
– Require text confirmation of password change
request or text password change details to users
mobile
– Requests made by phone should require callback25
Slide


Summary
• Cybersecurity is a socio-technical
problem
• Technology reliability cannot be
guaranteed
• Insider attacks
• Technical security compromises made
for usability reasons


Slide 26

• Failure of organisational procedures or
poorly designed procedures
• Human carelessness
• Social engineering


Slide 27

Cybersecurity 4 security is sociotechnical issue

Recommended

Recommended

More Related Content

What's hot

What's hot (19)

Viewers also liked

Viewers also liked (20)

Similar to Cybersecurity 4 security is sociotechnical issue

Similar to Cybersecurity 4 security is sociotechnical issue (20)

More from sommerville-videos

More from sommerville-videos (16)

Recently uploaded

Recently uploaded (20)

Cybersecurity 4 security is sociotechnical issue