Humans Not Evolved for IT Security

Stony Stevenson writes to tell us that at the recent RSA Conference security expert Bruce Schneier told delegates that human beings are not evolved for security in the modern world, especially when it comes to IT. "He told delegates at the 2007 RSA Conference that there is a gap between the reality of security and the emotional feel of security due to the way our brains have evolved. This leads to people making bad choices. 'As a species we got really good at estimating risk in an East African village 100,000 years ago. But in 2007 London? Modern times are harder.'"

really

[snarkh (118018)]

As a species we got really good at estimating risk in an East African village 100,000 years ago.

I wonder how many days would that guy last in an East African village 100,000 years ago.

Re:

[Gabest (852807)]

depends... raw, smoked or cooked?

Re:really

[mstahl (701501)]

Come on. Bruce Schneier is like the Chuck Norris of the IT industry. He'd outlast us all!

Remember. There are no prime numbers, only numbers that Bruce Schneier doesn't want you to factor [geekz.co.uk]!

Re:

[Agripa (139780)]

I wonder how many days would that guy last in an East African village 100,000 years ago.

If he had grown up in that environment I would guess he would do fine. None of his ancestors died without having successful children.

Probably

[sharp-bang (311928)]

There were in South Africa [about.com] anyway.

Re:really

[apparently (756613)]

Last time I walked through Harlem, the hoodz said I had to fucking PROVE my wealth and whitenses before they would even consider robbing me. I showed them paystubs, my Discover card, even an ATM receipt, and still they doubted how rich I was! And don't get me started on the "white" thing, apparently they don't go by complexion any more, you gotta keep a DNA sample on you with a notarized letter from a scientist stating that he confirms your race.

Us white, rich folk never had it so tough.

Also, you really ought to be awarded with some sort of "waste of a condom" trophy.

do you want to check my shoes?

[User 956 (568564)]

He told delegates at the 2007 RSA Conference that there is a gap between the reality of security and the emotional feel of security due to the way our brains have evolved.

Which is why, a lot of times, you end up with security theatre [elliott.org], instead of real security.

Re:do you want to check my shoes?

[Kjella (173770)]

And don't forget CYA security - security rules that aren't being followed and aren't being enforced either - but that exist solely so that when shit hits the fan, the bosses can say it was against policy. These are usually extremely draconian, impossible to implement or practicly impossible to follow while getting work done. But hey, it looks good on paper...

Re:

[rtb61 (674572)]

So one crazy shoe bomber and a few hundred million shoes latter, how many exploding shoes have they found. So why aren't they strip searching everybody, if it is real, think of bombs in bras and cavity insertions, or at an absolute minimum completely dismantling every electronic component that goes onto a plane, every camera, phone, laptop, pda and media player. Better yet if you can afford to fly you can afford to buy all new stuff at your destination, great for corporate profits and besides, what is wrong

Ms Abacha?

[Mr_Icon (124425)]

Looking at the number of people falling for Nigerian scammers, I'd say that our ability to "estimate risk in an East African village" is not so hot either. :)

Re:Ms Abacha?

[nelsonal (549144)]

But that's a west African villiage, totally different risk profile. Well played.

Re:

[SterlingSylver (1122973)]

As a celebration for his victory, we are established for your beneficiary a large bank account in a small East African village. Effect payment of charge processing to the bank account to be listed later in order to receive your monies.

Humans Not Evolved for IT Security

[Daimanta (1140543)]

Thank God I was intelligently designed for this kind of thing ;)

Re:Humans Not Evolved for IT Security

[gammygator (820041)]

That's because in Soviet Kansas, nothing evolves...

Bad Analogies Abound

[eldavojohn (898314)]

"The brain is still in beta mode, it's got all sorts of patches and workarounds. It's not perfectly created, it's clearly evolved up."

Wow, just ... wow. I'm not even a biologist but I know that's a terrible analogy. You can't compare the brain to software. We can control software and decide when it 'goes live,' there are no prototypes in nature or evolution. Every attempt is an iteration of the process and the process is never ending. Furthermore, the existence of an absolute of 'perfectly created' is debatable on any level in regards to any process or system.

Exaggerate uncommon risks -- for example, air travel is safer than cars but because car accidents are common they are seen as less risky

Maybe because everyone involved in an air plane crash usually dies. Automobile deaths are much less. There's this idea of risk = probability * impact. In the case of automobiles, probability is high but the impact is low. It's the other way around in aircraft failures.

Personified risk -- Osama Bin Laden is scarier than a faceless threat

How in the hell does this relate to IT security? I think IT administrators are more afraid of the people they don't know hacking their systems then the people they actually employ doing the same. In the end, I'm sure more attacks come internally or from an ex-worker than someone unknown. Maybe the face you know should be more scary than the face you don't at the office?

Risks that could be controlled -- The DC sniper caused a few deaths but the response was way out of proportion.

Please elaborate, I know of the John Lee Malvo incident but I have no idea how this relates to IT security. Are you telling me that shutting down a system to protect a database from a possible threat or virus is overkill? I would respond with that varying on a case by case basis but at my job, offline databases are worth maintaining the integrity of the data inside them.

I know I'm really coming off as a jerk when I say this but I don't think this article helped me in anyway. All I saw was someone over simplifying a complex problem--thereby making them seem smarter to the people they were explaining it to.

Don't read this article, it has nothing to offer you. If you don't know this subject, I believe this article will only add to your confusion and lack of understanding.

Re:Bad Analogies Abound

[SatanicPuppy (611928)]

This is actually a hot psychological topic right now; humanities tendency to poorly conceptualize risk. We're far more worried about diseases we're unlikely to catch, than ones we are. Plane crashes are scary because planes aren't familiar to most people; poor understanding of the risks magnifies fear. People always worry about the stereotypical malicious strangers, when most assaults come from people you already know.

I think mostly he's just pointing all this out as background to the tendency to poorly appreciate risk. He's basically saying, "People apply more worry to splashy things that aren't likely to happen, and therefore we have these huge data breaches because who cares about SSNs when the terrorists could be blowing up a nuke plant?"

The only place where I think he's totally off base is calling the brain "a patchwork". It's not, in fact. It's extremely finely tuned to do what we need it to do...It makes us ferociously competitive animals, and that is proven rather than disproven, by all the security problems that we've been having. If we weren't competitive, we wouldn't have problems. The fact that not everyone works at the same level is irrelevant.

Re:Bad Analogies Abound

[Lurker2288 (995635)]

In the sense that brains in general started off in a much simpler state with no need to handle many of the things it's currently capable of (binocular vision, manual dexterity, doing calculus) and it got to where it is one incremental improvement at a time, then yes, it most certainly is a patchwork. You can see it in the gross structure: you've got the reptilian hindbrain that keeps your body functioning in a narrow homeostatic envelope all the way at the bottom, atop which sits a cerebellum that allows for things like emotion (great for pair bonding and knowing to run away from big things with pointy teeth), and atop all of that you've got the cerebrum that enables most of your higher intellectual activity.

The fact that this magnificent hodgepodge seems to be so perfectly attuned to our needs is almost definitional, as well as being a kind of survivor bias. That is, our brains are great at what we need them to do precisely because they evolved to do those things; brains that were evolved to do other things, or that did the same things, but not as well as ours, died off. Schneier's point is that the modern world has changed a lot faster than our brains are able to, and as a result, we're maladapted for some of the tasks facing us today, like assessing remote risks.

Re:

[Vellmont (569020)]

The evolution argument is disproven by Schneier himself; how could he be thinking about it if we hadn't already evolved to make it possible?

Schneiere isn't humanity, he's just Schniere. One guy can have the skills and ability to do something, while the vast majority of others do not. Anyway, I think he's really trying to say that risk assessment of the modern world doesn't come naturally to people, like it did to risk assessment of being eaten by a tiger 100,000 years ago.

I don't know if the evolutionary

Re:

[Sax Maniac (88550)]

It's pretty obvious that people estimate risk badly, and I agree with you.

But don't try and actually tell anyone this. You will be labeled a bad parent (because you don't worry about stranger kidnappings as much as car accidents), un-American (because you don't worry about turr'ism as much as dying from heart disease), or a host of other things. Do not try to explain to anyone why. People tell gravely tell you "I don't need proof, know in my heart that the world is a more dangerous place today" despite

Don't poke the bear

[Scrameustache (459504)]

Plane crashes are scary because planes aren't familiar to most people;

Actually, plane crashes are scary because once you're on the plane, there is nothing you can do about them.
Car crashes are less scary because of familiarity, has you said, but also because you can grab the wheel, yell "look out!", or otherwise act upon your own destiny. And because of vertigo phobia. In a car, you're already on the ground: you aren't going to accelerate towards it inexorably, as planes will if they stall/run out of gas/break/hit another plane/etc.

Familiarity and statistics are just part of it.

Re:Bad Analogies Abound

[SatanicPuppy (611928)]

That's part of it, but you're still more likely to die in a bus or taxi accident, and they're not viewed with the same unreasoning fear though they also lack control.

We are all soothed by familiar routine. This is the purpose of disaster drills, so if your building does catch fire, your mind will move into that pre-built track, and move effectively, without being paralyzed by the need to act conflicting with the fact that you have no idea of what to do. Planes are not only outside our control, they're outside most people's experience, so an event which is no more significant than a bus running through a pothole, elicits a greater level of fear due to it being an unknown, rather than a familiar, occurrence.

It's the money

[ZonkerWilliam (953437)]

As a INFOSEC person, I see this kind of mentality on a daily bases. Still, there is a realization of the costs of outages due to attacks and that I see. Slowly but surely it's changing. Compared to evolutionary changes tho, it's a blink of an eye.

Stupid.

[SatanicPuppy (611928)]

We're not evolved for space flight either. You can't apply "evolution" as a blanket to tool use at the level we've taken it; we have evolved a capacity for abstract thought which allows us to create highly complex tools...Saying that we're not evolved to assess risk on a level as abstract as this is disingenous...When was the last time a virus jumped out of your computer and ate you? There is no evolutionary pressure involved with such intellectual pursuits.

It's perhaps more accurate to say that only a few people are capable of truly understanding this stuff at all, and for the rest it's just black magic. Of course they don't appreciate the risk. I guess B.S was trying to find a rational reason why people just categorically don't understand security when applied to technology, but I think it's more just that they're doing well to be able to use the tech at all. We're going to have to have a lot higher skill level among users before we can expect them to truly appreciate security.

Re:

[timeOday (582209)]

When was the last time a virus jumped out of your computer and ate you? There is no evolutionary pressure involved with such intellectual pursuits.

Wow, it sounds like you're in violent agreement with Schneier; he said evolution didn't prepare us for computer security, you agree, then you call him stupid for saying it.

Anyways, these days mortal combat is now primarily an intellectual pursuit, because technology dominates. Usually nowadays we wage war by economic sanctions, which can kill just as many pe [thenation.com]

east african village

[arbitraryaardvark (845916)]

I once heard Neal Stevenson give a similar talk. http://db.tidbits.com/article/05951 [tidbits.com]
He drew pie charts labled "threat model" where 99% of the chart was "hyenas."
Today, our threat models are a bit more complex.
http://www.anu.edu.au/people/Roger.Clarke/DV/NotesCFP2K.html#Steph [anu.edu.au]

junpei wikipedia [wikipedia.org]

so what?

[AxemRed (755470)]

We aren't specifically evolved do algebra either, and we (well, many of us) do a decent job at that. Humans are evolved to learn and adapt.

Re:so what?

[kebes (861706)]

We aren't specifically evolved do algebra either, and we (well, many of us) do a decent job at that. Humans are evolved to learn and adapt.

Absolutely. But Schneier's point is not that it is impossible for humans to think rationally about IT security, but that it does not 'come naturally' to the average person. The same is true of algebra and other branches of mathematics: humans in general have very advanced knowledge in these areas, but it is still quite easy to construct a mathematical problem that will trip up a layperson, because most people are not formally trained in mathematics, and will incorrectly invoke "common sense" when solving a problem.

The fact is that humans have an in-built "threat and probability analysis" system that was optimized to deal with "real world" situations like searching for food, avoiding predators, finding mates, etc. It is for this reason that gambling "works." People are easily tricked into believing that they can "beat the system" or "find a pattern." They believe that having rolled many sixes recently, they are "due for a 1 or a 2" even though the probability of rolling a particular number on a die is independent of previous rolls. This is because most of our in-built probability estimators assume chains of events are causally linked (which is a reasonable assumption in the "real world"--i.e. if it's been a long time since it has rained, it is indeed "due to rain soon").

In the realm of security, Schneier identifies certain assumptions that our minds make, which are actually fallacies when it comes to modern security (e.g. that a commonly occurring risk is less important than a rare risk).

We are not "built" to deal with modern security. As with advanced math, rather than rely on common sense (and its associated useless rhetoric) to set security policy, we need to have detailed arguments citing well-documented studies. We can indeed rise above our "programming," but far too many people don't bother trying--and continue to rely on common sense even when it is a demonstrably poor predictor.

Re:

[Chris Burke (6130)]

They believe that having rolled many sixes recently, they are "due for a 1 or a 2" even though the probability of rolling a particular number on a die is independent of previous rolls.

My goodness, this is simply untruth! While it may be so in the white halls of academia, where such things as "fair dice" and "independent events" are bandied about as though they actually exist in their perfect mathematical forms, it isn't so in the harsh reality of the craps table! Allow me to explain. You see, when you ro

Re:

[apparently (756613)]

Go down you local street corner and see how many people can solve the simplest of equations

Well, for any equations where the solution is "go fuck yourself!", "I got somethin' you can solve, sugah!", or "no seriously, go fuck yourself" the subjects in my test study pass with flying colors.

Smith

[pete-classic (75983)]

"Only human."
--Agent Smith on IT security

Phhhh ...

[foobsr (693224)]

... if it really must be Schneier, read: "Why the Human Brain Is a Poor Judge of Risk" ( Wired [wired.com] ), but better immediately turn to Kahneman .

CC.

because people want the easy way

[hobo sapiens (893427)]

People want the easy way. Security and "the easy way" are often at odds.

Case in point...I was in a hospital ER the other day, waiting in the room (for a very long time), and I looked at the computer in the room. I noticed that someone affixed a sticker to the keyboard tray with (presumably) the windows domain login info. Had I wanted to, I could have logged in and probably gotten to all kinds of medical records. Someone from the hospital's CIS department would probably poop a brick if he saw that.

People are lazy, and security folks constantly have to toe the line between making things hard enough to be secure but not so hard that it's just easier to find the loopholes.

Re:

[blhack (921171)]

And that is why it SUCKS to be the person in charge of security for a domain. Make the security too harsh and the users complain (with good reason) that they can't get anything done. Make things too lax, and you turn into an alcoholic schitzophrenic who does nothing but sit at home in the dark murmering about exploits and unencrypted telnet sessions that your entire company runs on, and how even the software providers out in north carolina won't implement SSL into their software because all of their progr

No, we are simply taught the reverse.

[Zombie Ryushu (803103)]

I don't think thats the case. I think its just that culturally we fear what we don't understand and are being taught to be stupid and proud of it. Biology and evolution have nothing to do with it. We can learn these concepts we just willingly refuse to for religious and ideological reasons.

Just an excuse

[Kohath (38547)]

Security solutions have to be designed around usability. If usability isn't the #1 or #2 consideration, it will increase the failure rate of the humans involved and you'll end up with an insecure system in practice regardless of the technical merits of the security methods.

Or in short...

[pb (1020)]

"IT Security Not Evolved for Humans".

What a pile of carp

[Roadkills-R-Us (122219)]

The real problems are, in no particular order:

1) A lot of people are either stupid or uneducated.
2) A lot of people don't bother to think.
3) A Lot of people are sheep and believe what they're told by marketing.
4) A lot of people are lazy.

I guarantee you this covers the vast majority of the problems with IT security. It's not biological evolution, though you could make a good argument for societal devolution being the problem.

Re:What a pile of carp

[Frozen Void (831218)]

You forgot :
5.Building an insecure system from the ground up and expecting the users to fix it.

Re:

[turing_m (1030530)]

It also stems from upper management either not being smart enough or not dedicating enough time to do a bit of basic research on security, so then they either ignore security issues entirely, or want security but completely underestimate the intelligence required to do a good job at it.

I'm reminded of reading "Surely You're Joking, Mr Feynman!", where Feynman routinely bypassed the cargo cultish efforts at security by his ostensible military overseers. It's the same pattern - primitive people attempting to

Is there anything...?

[Otter (3800)]

Is there anything on which Bruce Schneier is not an expert? Now he's an expert on evolution? I'm not sure why he thinks his knowledge of cryptography qualifies him to hold forth on every freaking subject on the planet.

Re:Thanks Bruce, but call us when you're qualified

[NeutronCowboy (896098)]

So, sorry Bruce, but you're not qualified to make that statement with any authority

You're making the mistake of judging the validity of a claim based on the person's authority. Even Wikipedia, your favorite source, has info on that. Just make sure to read the article in its entirety. Your comment would in fact be far more helpful if it would actually dissect his theory. Because, quite frankly, if we're going by authority is the prime criterion for when anyone should say anything, you'd only be allowed to talk about the lint in your navel.

Re:No I'm not

[NeutronCowboy (896098)]

Wow. You truly are entertaining. Here, have some more rope. I'm sure you can find an entertaining way of hanging yourself again.

Re:Thanks Bruce, but call us when you're qualified

[ifoxtrot (529292)]

I don't usually respond to negative posts, but this is something I feel quite strongly about:

1. You don't have to have a qualification in something to know enough to make an enlightened statement about a particular subject. If we were to restrict talking about the weather only to meteorologists, small talk would vanish overnight. In a more serious vein, interdisciplinary research would be even more difficult than it is now. Imagine having to have a qualification in both psychology and security to be able to publish research into this?

2. A qualification is simply a piece of paper that has been accredited by some educational body, presumably recognising a standard of education in a particular field. Just because you don't have the piece of paper doesn't mean you don't have the knowledge. How do you know that Bruce Schneier doesn't, in fact, know as much (or possibly more) about evolutionary biology or behavioural psychology than yourself? Does the fact that I haven't studied engineering preclude me from having insightful discussions with an engineer? Do my opinions matter less because I don't have the degree? Does the fact that I have a PhD in computer security (and you presumably don't) mean that any opinion I state on the subject is somehow more valid because I hold the qualification and you don't?

3. Bruce Schneier is eminently qualified to make statements about security (which is afterall a central aspect of his thesis). He has been conducting extensive research into psychological aspects of IT security (you can see a draft essay on the topic at http://www.schneier.com/essay-155.pdf [schneier.com]). This research has included long discussions with psychologists and serious reviews of the literature. I would content that there are very few people on this planet that are truly as knowledgeable in both security and the psychology of security as Bruce Schneier is now. I would be equally interested in the views of a psychologist who undertook research into security -- I know only of a handful that have done so, and none have the particular angle that Schneier has adopted.

4. That is not to say that everything the Schneier is saying on the topic is faultless, or that I agree with everything he says, but I'll debate the ideas, not the man. I personally find it objectionable to anthropomorphise an evolutionary process, or talk about the intent of evolution. But what do I know, I don't have a degree in evolutionary biology...

Re:

[Opportunist (166417)]

So that's why my common sense tells me I don't need to hide under my bed from the bad, bad terrorists, it's just that I can't see them anywhere and not that it's overblown hype.

I'm kinda scared now.

Re:

[CompMD (522020)]

> You are alone in a dark room and cannot see. You are likely to be eaten by a grue.

Actually, sounds like what you can't see WILL in fact eat you.

Re:Lets think about this.

[joto (134244)]

but in an era where there is (comparatively) little immediate threat to life, we are not overly prepared to deal with subtle threats to information or technology

If somebody breaks into my computer, will I die? No. Will I become sick of temporarily disabled? No. Will I lose money? Possible, but unlikely, and in any case the insurance company will get them back for me. Should I therefore hire a security consultant? NO!

I believe most people get this analysis right.

We are prepared to react to predators that want to eat us and starvation, but ill prepared to deal with people that want to defraud us and steal possessions that may not be immediately with us.

More importantly, we are unable to plan for long-term security. If the planets ecosystem is under attack from global warming, creating and/or spreading lots of new diseases (harming us, our food, or in some other indirect way), do we stop emitting pollutants contributing to global warming? No. Do we invest money into biological research and education so we can handle the new diseases? No. Do we invest significantly in technological countermeasures, such as painting Sahara white, building dams against floods or the rising ocean, or even storing CO2? No. Do we do anything at all? Not really, unless you count selling quotas to each other.

Re:Stupid Crap

[Quiet_Desperation (858215)]

which makes it difficult to use, then say that people are just too dumb to use it.

That always amazes me to this day.

IT GUY: Your PC is insecure.
AVERAGE JOE: I don't really know how to properly secure it.
IT GUY: Dumbfuck.

Yeah, great approach. Gosh, why don't we teach kids that way?

TEACHER: What's 147 divided by 7?
FIRST GRADER: You haven't taught us division yet.
TEACHER: Dumbfuck.

Re:Stupid Crap

[Sax Maniac (88550)]

What I usually see is this:

IT GUY: Your PC is insecure.
CEO: It's your job to secure it, dumbfuck. Give me a secure computer.
IT GUY: Yes sir.

Re:

[Jasin Natael (14968)]

There is no possible way to "evolve" computer security.

Then, it sounds like we need a lethal, compulsory video game with a computer security theme.

Open letter to God

[EmbeddedJanitor (597831)]

Better luck with Humans V2.0.

Anyway you should only trust Humans V1.0 after SP1 has been released.