"The Unintended Consequences of Beating Users with Carrot Sticks: Radical Thoughts on Security Reform" Presentation by Benjamin Tomhave at OWASP 2010 AppSec DC Cofnerence. Uploading here for non-mac users. (http://www.owasp.org/index.php/The_Unintended_Consequences_of_Beating_Users_with_Carrot_Sticks:_Radical_Thoughts_on_Security_Reform)

1. The Unintended
Consequences of
Beating Users
with Carrot Sticks
Radical
Thoughts on
Security Reform
Benjamin Tomhave, MS, CISSP
11/11/10 - AppSecDC 2010

3. The Falcon’s View
http://www.secureconsulting.net/
@falconsview

4. Quick Definitions &
Background

5. • Positive
• Encouraging
• Motivating

6. • Indemnification
• Reduced premiums
• Praise / Celebration
• Bribe vs Reward

7. • Negative
• Punishing
• (de?)Motivating

8. • Regulations
• HIPAA and PKI
• PKI in general
• Some security programs

9. Consequences
(Intended / Unintended)

10. Impact
• Positive
• Negative
• Neutral

11. Story: Airline Seatbelts
• Seatbelts on taxi...
• Seatbelts in the air...
• Consequences?

12. Uncertainty
• Not talking Heisenberg...
• In infosec... measured much lately?
• How well do we know ourselves?

13. Peltzman Effect

14. !
Decision

15. Uncertainty Applies! :(
?
! Action :|
Decision !
:)
Consequence
Impact

16. Unintended
Consequences
• Fines vs Safe Harbor
• Mindlessly strict policies
• Ubiquitous encryption
• Humiliation vs Enablement

17. Sidebar: Education,
NCLB, & Enablement
• Enablement culture
• Training vs Education
• How do you measure
teacher performance?

18. "Careful. We don't want
to learn from this."
-Bill Watterson

19. Psychology & The
Human Paradox Gap

20. What’s the Problem?
• Does society as a
whole "get it"?
• How about your
entire
organization?
• How about
everyone in this
room?

21. Sidebar: FishNet Report
• Decision-makers say top spend
priorities are firewalls, AV, authN, and
anti-malware.
• Same people say top threats are mobile
computing, social networks, and cloud.
h/t: http://1raindrop.typepad.com/1_raindrop/2010/10/reconcile-this.html

22. Sidebar: FishNet Report
• Decision-makers say top spend
priorities are firewalls, AV, authN, and
anti-malware.
WTF?!?!?
• Same people say top threats are mobile
computing, social networks, and cloud.
h/t: http://1raindrop.typepad.com/1_raindrop/2010/10/reconcile-this.html

23. On... BIAS

24. On... BIAS
"If a man is offered a fact which goes against his
instincts, he will scrutinize it closely, and unless the
evidence is overwhelming, he will refuse to believe it.
If, on the other hand, he is offered something which
affords a reason for acting in accordance to his
instincts, he will accept it even on the slightest
evidence. The origin of myths is explained in this
way.” --Bertrand Russell

25. On... BIAS
"Facts are meaningless. You
could use facts to prove
anything that's even remotely
true!" --Homer Simpson

26. *The Human Paradox Gap
Image Source: http://www.theninjacamp.com/lifestyle/lifestyle.html
*HPG: Credited to Michael Santarcangelo
www.securitycatalyst.com/learn

27. Uncertainty Applies! :(
?
! Action :|
Decision !
:)
Consequence
HPG: Distance Impact
between Action &
Impact.

28. More on HPG...
• Tew: “The key to success
is massive failure.”
• In engineering, failure
teaches lessons!
• If there’s no connection
between action and
impact, then what’s the
motivation for change?

29. Recent Research

30. From IEEE Computer...
• Social pressure
is useful
• Intent to
comply is vital
• Sanctions
better than
rewards
By Mikko Siponen , Seppo Pahnila , M. Adam Mahmood
Issue Date: February 2010, pp. 64-71

31. Additional Thoughts...
• Ultimately about
narrowing HPG
• Visibility, ease of
compliance key
• Rewards overused,
depreciated?

32. From Click-It or Ticket...
• Seat belt use
increased over time
• Increased perception
of enforcement
• Favorable attitudes
Source: Lance Spitzner, http://www.securingthehuman.org/blog/ticket-or-click-it/

33. Some Thoughts...
• HPG was narrowed
• Correlated vs Causal
• What about generational
changes?
• What about other
programs?

34. On... STATISTICS

35. On... STATISTICS
"Do not put your faith in what statistics
say until you have carefully considered
what they do not say." --William W. Watt

36. On... STATISTICS
"There are three kinds of
lies: lies, damned lies and
statistics." --Leonard H.
Courtney (misattributed by
Samuel Clemens to
Disraeli)

37. On... FRAMING

38. On... FRAMING
"The greatest challenge to any
thinker is stating the problem in
a way that will allow a solution."
--Bertrand Russell

39. On... FRAMING
"Living in a vacuum sucks."
--Adrienne E. Gusoff

40. Key Topics

41. Policies
• Not all policies are
equal!
• “Best” practices?
• What about process?
• What’s the objective?

42. Awareness Training
• “Best” practices?
• Closing the HPG?
• Just annually?
• Measuring success?

43. Survivability &
Sustainability
• Engineer for • Optimize for
resilience growth!
• Expect failures • Green -> Blue

44. Sidebar: Survivability
• Hoff’s 3 Rs:
• Resistance
• Recognition
• Recovery
• Defensibility &
Recoverability
• Civilization: West vs. East

45. Integrated Security
Practices
• Build security in...
• Add to job descriptions...
• Part of performance...
• Do you really need a
dedicated security team?

46. Risk Management +
Threat Modeling
• Evidence-based & quantitative risk
• Threat modeling w/ scenarios
• Business processes!

47. On... APPROACHES

48. On... APPROACHES
"Tradition is what
you resort to when
you don't have the
time or the money to
do it right." --Kurt
Herbert Alder

49. R Y
M A
Success Strategies
U M
S

50. 1. Narrow the HPG

51. 2. Model Success

52. 3. Culture Change

53. 4. Sensible & Automatic

54. 5. More Carrots

55. 6. Build Security In

56. 7. Go Blue: Sustainability

57. END.
Ben Tomhave
@falconsview
btomhave@geminisecurity.com
http://www.secureconsulting.net/