Heuristic and Biases

This week, we are going to look at how individual human beings make decisions in general, and how we make decisions in cybersecurity situations specifically.

We are going to look more generally at how human beings make decisions, and why they don’t always make the most “rational” decisions. We are going to start by reading an article or two that I wrote about how people make cybersecurity decisions. Start by reading this article in IEEE Security and Privacy magazine about about Folk Security. That article summarizes some research I did about how people make security decisions in general. I also recommend you read, or at least skim, the original research paper that describes these eight mental models of security.

Bruce Schneier is another author who has written multiple books on cybersecurity and the psychology of cybersecurity. He summarizes some of the key background about how people think and its relationship to cybersecurity in a short series of two blog posts. Please read both blog posts this week:  Post 1  and  Post 2.

These two essays describe a large number of “heuristics and biases” in the way we (human beings) think about security and risk. Some of these have names, such as the “availability heuristic” or the “control bias”. Others don’t have clear names but are still important, like the idea that we are especially attuned to risks involving people. As people make security decisions, all of these heuristics and biases come into play and complicate the way we make security decisions.

Finally, there is a more academic writeup of heuristics and biases in cybersecurity by L. Jean Camp and Viabhav Garg that is worth reading. It has some nice examples that include both ways these affect fraud, and how these can be used in design. Pay particular attention to the sections at the end about Design and about Limitations.

For this week’s summary, I want you to think both about heuristics and biases can be exploited by attackers, and how they can be utilized by designers for protection against attacks. Choose at least one heuristic and/or bias and explain how you would use it as an attacker to take advantage of a victim’s by exploiting the heuristic and/or bias in their decision making. Also, choose a second heuristic and/or bias and explain how you might use it to help people protect themselves – for example, by designing a technology interface to rely on that heuristic and/or bias, or by setting some rules, law, or policy.

(Optional) If you want to read more about how heuristics and biases can be used to design security and privacy systems, a good place to start is the literature on “Nudges”. A good survey article to start with is here.

(Optional) Also, here is a great research paper that discusses the wide range of cybersecurity advice that we ask end users to follow, and how even experts can’t agree on what is most important.