Talk by Dr Ciarán Mc Mahon at Facebook Dublin, as part of Cyber Security Month, October 2016. Information security consciousness: What you need to know about the psychology of online defence The aim of this talk is to deepdive the psychology of cybersecurity, in order to give attendees a more profound insight into their everday security routines. If you’d like to know how to re-wire your brain to make your cybersecurity habits more efficient and more enlightend, then this is the talk for you.

1. INFORMATIONSECURITY CONSCIOUSNESS
What you need to know about the
psychology of online defence

2. Today’s talk
• Introduction
• About me
• Elements of cybersecurity practice
• The psychology of everyday strife
• Moving slowly with unstable infrastructure
• Information security consciousness

3. Today’s Talk
• The aim of this talk is to deepdive the
psychology of cybersecurity, in order to
give attendees a more profound insight
into their everyday security routines. If
you’d like to know how to re-wire your
mind to make cybersecurity more efficient
and easier to achieve, this is the talk
for you.

4. Today’s Talk
• The aim of this talk is to deepdive the
psychology of cybersecurity, in order to
give attendees a more profound insight
into their everyday security routines. If
you’d like to know how to re-wire your
mind to make cybersecurity more efficient
and easier to achieve, this is the talk
for you.

5. Today’s Talk
• The aim of this talk is to deepdive the
psychology of cybersecurity, in order to
give attendees a more profound insight
into their everyday security routines. If
you’d like to know how to re-wire your
mind to make cybersecurity more efficient
and easier to achieve, this is the talk
for you.

6. Today’s Talk
• The aim of this talk is to deepdive the
psychology of cybersecurity, in order to
give attendees a more profound insight
into their everyday security routines. If
you’d like to know how to re-wire your
mind to make cybersecurity more efficient
and easier to achieve, this is the talk
for you.

7. About me
Dr Ciarán Mc Mahon is a director of the
Institute of Cyber Security and an award-
winning academic psychologist from Ireland. A
former Government of Ireland Scholar, he has
published research on the history of
psychological language, the psychology of
social media, digital wellness and the social
impact of cybercrime. Ciarán has worked at a
number of third level institutions, most
recently at the CyberPsychology Research
Centre at the Royal College of Surgeons in
Ireland. Ciarán also has extensive media
experience and regularly contributes on topics
relating to the human aspects of information
technology to national and international
outlets including Sky News, BBC Radio London,
USA Today, Fortune Magazine, and The
Guardian.

8. ELEMENTS OF CYBER
SECURITY

9. General advice
1. Use strong and unique passwords.
2. Think before you click. Don't fall for scams!
3. Don't plug in unknown USB keys.
4. Use only trusted and secure connections, devices,
sites and services.
5. Don’t let anyone look over your shoulder when
online, and log out once finished.
6. Report suspicious activities/cybercrimes to the
authorities
7. Always run the latest version of your OS and
software. Run your anti-virus regularly and keep
it updated too.

10. General advice
1. Use strong and unique passwords.
2. Think before you click. Don't fall for scams!
3. Don't plug in unknown USB keys.
4. Use only trusted and secure connections, devices,
sites and services.
5. Don’t let anyone look over your shoulder when
online, and log out once finished.
6. Report suspicious activities/cybercrimes to the
authorities
7. Always run the latest version of your OS and
software. Run your anti-virus regularly and keep
it updated too.

11. WHY DO WE FIND CYBER
SECURITY HARD?and how can we make it easier? and more efficient?

12. Passwords (Whitty, Doodson, Creese, & Hodges,
2015)
o Most likely to share
passwords:
o Younger people
o Low perseverance
o High self-monitoring
o Knowledge about
cybersecurity did not
distinguish between those
who did and did not share
passwords

13. Passwords (Pilar, Jaeger, Gomes, & Stein, 2012)
o Older adults no more memory
difficulties than younger
o Number of password uses was the
most influential factor on
memory performance
o limit for most people seems to
be 5 passwords
o recommend mnemonics and re-
using passwords by category of
use

15. Passwords (Das, Hong, & Schechter, 2016)
o Microsoft research
o Participants assigned six
random words
o (∼56 bits of entropy)
o The trained to form into
a story
o Less training, better
recall, than rote
learning

16. Phishing (Parsons et al., 2013)
o Participants who knew they
were in a phishing study
performed significantly
better
o Participants who had formal
training in information
systems performed more
poorly overall.
o 42% of all emails were
incorrectly classified

17. Phishing (Vishwanath, Herath, Chen, Wang, & Rao, 2011)
o Most phishing emails are
peripherally processed and
individuals make decisions
based on simple cues embedded
in the email (e.g. Urgent!!)
o People far more likely to
respond to phishing emails
when they have large email
loads...

18. Phishing research
• Must recognise that the signal/noise ratio
is prohibitive here
• Strategies
– if you come across a phishing email, share
screenshots with colleagues
– if targeted/spearphishing, inform your security
team asap

19. USB keys (Tischer et al., 2016)
o 16% scanned drive with anti-
virus software; 8% believed
their OS would protect them
o Majority connected a drive in
order to locate its owner (68%)
o Study authors believe altruism
comes first, then curiosity
o “I was wondering why a jpeg
picture had an html address”

20. USB keys (Hornstein, Fisch, & Holmes, 1968)
o Famous social psychology study
o People more likely to return
lost wallet when primed to feel
good about it
o but 12% of people primed to
feel bad about returning the
wallet still did so
o what’s the moral of the story?

21. Anti-virus & updating
• Lurking (Nonnecke, East,
& Preece, 2001)
• Pareto principle
– 90/9/1 rule
– 90 people watch
– 9 people talk
– 1 person creates
• Ergo, few expect to have
to do maintenance

22. Anti-virus & updating
• Telepresence (Lombard,
Ditton, & Media, 1997)
– IT is designed to be a
seamless interactive,
unobtrusive experience
– no awareness of actual
engineering
• Ergo, surprise when
required

23. ‘Everything is broken’
• Quinn Norton
‘It’s hard to explain to
regular people how much
technology barely works, how
much the infrastructure of
our lives is held together
by the IT equivalent of
baling wire.
Computers, and computing,
are broken.’

24. ‘Another flaw in the human character is
that everybody wants to build and nobody
wants to do maintenance’(Vonnegut)

26. What is the mind?
SHEN HSIU
The body is the Bodhi tree
The mind a bright mirror stand
Cleanse it with daily diligence
See to it that no dust adheres
HUI-NENG.
There is no Boddhi-tree,
Nor stand of a mirror bright.
Since all is void,
Where can the dust alight?

27. What is the mind?
SHEN HSIU
The body is the Bodhi tree
The mind a bright mirror stand
Cleanse it with daily diligence
See to it that no dust adheres
HUI-NENG.
There is no Boddhi-tree,
Nor stand of a mirror bright.
Since all is void,
Where can the dust alight?

28. What is the mind?
SHEN HSIU
The body is the Bodhi tree
The mind a bright mirror stand
Cleanse it with daily diligence
See to it that no dust adheres
HUI-NENG.
There is no Boddhi-tree,
Nor stand of a mirror bright.
Since all is void,
Where can the dust alight?

29. ‘Mind as machine’
memory cache
hard-wired
processing power
bootstrap

31. ‘Security as
warfare’
attack/defence
firewall
weapons
threat model

32. ‘Security as
hygiene’
virus
infection
quarantine
code injection

33. ‘hyper cyber securitizatio

34. ‘hyper cyber securitization
because it’s essentially invisible,
like the mind, security is often
overhyped

35. we need to transcend these
metaphors if we are to truly
incorporate cyber security into
our daily practices.
It has to be more meaningful

36. What is information security
consciousness?

37. information security consciousness
1. A refusal to sow fear and a pledge to
conserve attention
2. An awareness of human limits, and a
readiness to transcend them
3. An acknowledgement that ‘everything is
broken’ and a willingness to fix it

38. But above all

39. practice loyalty

40. practice loyalty
thank you