Psychology-Aware Security Design

While many people are aware that psychology figures into cybersecurity, the full scope and depth of psychology’s impact is still little understood. At Crimson Vista, we are often exploring how psychology impacts security, how the bad guys use it against us, and how security professionals need to better adopt it in their practice. One area of cybersecurity in particular that we analyze is cybersecurity product, system, and operations design. Our analysis shows that cybersecurity vendors need to better build systems based on human psychology. Today’s example is “affordances.”

The term “affordances” is a psychological phenomenon that you are familiar with even if you don’t know the term. An affordance simply refers to how your environment funnels you towards a certain decision or outcome. A product design cannot rely entirely on a block of text to instruct a user. The designer must use affordances to subtly direct the user to the proper actions. In a security breach, when a great deal is at stake and emotions are heightened, having proper affordances leads potentially highly stressed people in the right direction while improper affordances can result in catastrophe.

Take video game design, for example. If the video game involves firing a gun, 9 times out of 10, that input will be mapped to the trigger on the controller. This is an example of good affordances. In fact, all the controller mappings are designed to indicate or parody what it is the player is doing in the game. As an experiment, buy a new game and remap all the controls at random. Even though it is a new game with all-new controls, you will find a much steeper learning curve for yourself. Good game designers understand (and continue to research and study!) the affordances.

Affordances, however, are not just a single mechanism or feature in isolation. To the contrary, they very much depend on context and the user’s mindset! To continue with gaming examples, you may or may not be familiar with the “Tetris effect.” Essentially, after several hours of focused (usually repetitive) gaming, a gamer’s mindset is locked into those patterns. He or she may even attempt to perform the actions of the game in real life. For a person in the middle of the “Tetris effect” and a mindset locked into a game, the affordances of the physical world may stop being effective. In other words, because the person is in the wrong state of mind, the affordances that normally work fine cease to suggest the correct function. For example, suppose a man was playing Minecraft for some time, and then left to make toast. Upon finding that his toaster doesn’t work, his first thought is not to plug it in, but rather to find some coal with which to refuel the toaster.

This example is humorous, but there are plenty of serious comparisons in the world where mindset influences affordance effectiveness. Sticking with the toaster example, they generally have very good affordances overall both for use and safety. The size and shape of the bread slots are designed to be difficult for fingers to fit into on purposes, directing the user away from the heating elements. This is far more effective than a red label that says “careful when hot”. The use of a lever that mimics the insertion of the bread into the toaster is also a very good affordance. But the mindset does matter. How many times have you put toast in the toaster and forgotten to push the lever down? This is not just “brain fog” or forgetfulness. How many things in your kitchen “work” by just putting other things in them? Refrigerators? Cabinets? Drawers? Even the dishwasher if you’re not ready to start it. If your mindset is in the middle of these operations, even the toaster lever, generally a reasonable affordance, may not be intuitive.

Bad guys, sadly, are really good at using psychology against us. They create affordances in their attacks, such as phishing attacks. Beyond emotional evocation, phishing messages are designed to funnel the victim into one outcome. They do this via decorations, graphic design, and language. It’s worth noting that some phishing emails claim to be from your organization’s own security team or vendors. If the correct and legitimate security design is poorly made with poor affordances, the well-designed, intuitive fraudulent message and process can even seem more legitimate for no other reason than it is easier. Seriously. Humans are designed to use Occam’s Razor problem-solving rule when they don’t have enough information or training to operate otherwise.

All security is an arms race. The good guys need to be as good as the bad guys at the psychological principles. If a cyberattack successfully penetrates the user, no amount of technological security can protect them. If security procedure is obtuse and unintuitive, the amount of time it takes to catch a security breach will increase. The longer a security breach goes on, the more expensive it is. It goes without saying that the answer is not more training. Two hours of Powerpoint will not make a poorly designed security response more viable than a well-designed false security response as common in phishing scams. A masterful manipulator can drive a panicked user away from their own security by providing an intuitive alternative that is easier to follow.

Affordances are an important part of security design and they need to be carefully designed and deployed by security practitioners. The use of human psychology in funneling the user into the proper functions and decisions should factor into design, evaluation, and maintenance of systems and operations. Unfortunately, the bad guys are often ahead of us in this area and we need to make concerted efforts to catch up.

If you’re seeking to incorporate the correct technology into your cyber security design or to secure your infrastructure against AI, we have several services to help you. Don’t hesitate to contact us. www.crimsonvista.com