People do not generally like Cybersecurity. Although they do believe it is somewhat good to have, they often cannot be bothered to go through security defences such as registrations, strong passwords' choices, PINs' long waits through the post and all the like. I do believe they are essentially right, especially if modern services are to be enjoyed on the move, while the user is hopping on the tube, or pervasively, while the user is also watching television. Sometimes users have to be bothered to go through such defences otherwise they will not get the service they wanted. They may then be nastily rewarded with senses of disappointment and frustration both if they opted to go on and if their pride or boredom prevented them to. A layman at a cafe was arguing that he found Cybersecurity especially hideous when he was in a rush to get some service. Almost every researcher who looks at Cybersecurity from the socio-technical angle will agree with that layman as much as I do. This position paper outlines my view of the sole way forward for Cybersecurity: a fork in the road that takes either to Beautiful City or to Invisible City. One may of course refuse the fork and go back on the same road to Old City, where Cybersecurity often failed for a variety of reasons, including purely technical bugs and human-centred mistakes. I will postulate how I envisage Beautiful City and Invisible City to be. And do not worry you formal methodists: your help will be most appreciated also in the new cities.
A modern understanding of Cybersecurity situates it in a real use scenario that sees human users approach a technology that is meant to be secure, and experience it or, more simply, just use it. This is certainly a fuller and yet more insightful understanding than the traditional one, at least because it is clear that no technology will be secure if its users keep the login passwords on sticky notes. Copyright c by the paper’s authors. Copying permitted for private and academic purposes.
Here comes a new breed of views of Cybersecurity that are pivoted on the users, featuring the social, economic and legal views. These bear a huge potential to unveil niceties that could not be spot before, such as how easy it is for the layman to learn and comply with Cybersecurity, the coexistence with a deployedthough-flawed system version, and the assistance of the law to users who are victims of real-world breaches.
These new views entail what the Technocrats may perceive as a revolution: it will not suffice to look at the technical system in all sorts of ways to make it secure as they were used to do; by contrast, Scientists will have to look at the technical system holistically with its human users, and make that larger “system” secure. Arguably, Scientists will have to collaborate with colleagues from the Humanities to account for the human element. They will still only pass a technical system on to Engineers to build, but the resulting technology will be secure and privacy-preserving when practically used.
The new views of Cybersecurity in fact attract a worldwide, interdisciplinary
task force of researchers at present. These are not just Computer Scientists but
also Sociologists, Psychologists, Economists and Lawyers, confirming once and
for all to everyone that the topic is not a purely technical one, as someone might
have believed. A number of research events have appeared to publish the new
research output, notably the Workshop on Socio-Technical Aspects in Security
and Trust (STAST) [
Humans are difficult to fully account for, let alone formalise in the way dear to
Formal Methodists. In particular, the human users of a technology are far from
being automata executing the perfect program that the Technocrats behind that
technology had in mind:
Users may be deceived It is consolidated at least since Mitnick published
his famous book on deception that humans are rather easy to be duped
into making insecure actions, such as choosing poor passwords or annotating
secrets in insecure places [
Users may make errors There exists vast work from the Humanities studying
how and why humans make errors. Norman catalogued errors either as a
failure to do what the user intends (mistakes) or a momentary lapse when
the user takes an unintended action (slips) [
curity as a burden more than as a benefit, they may deliberately ignore or
oppose it. For example, some companies require card-and-PIN authentication
to enter their premises or record work times, but Amazon suggests that cards
can be left in a public card rack near the PIN pad [
I have done some research on the social view of Cybersecurity (not yet on the others), and this position paper gives me the opportunity to summarise and review some of my findings. At the moment, I see Cybersecurity as a planet with just three cities: Old City, Beautiful City and Invisible City. There exists a road that departs from Old, then forks and takes either to Beautiful or to Invisible. I am afraid that I have not explored anything else of that planet yet. It would seem that we researchers have been given the power to put the human users of the technology that we want to be secure in any of the three cities. I speculate that we used to choose Old but we had better take the users to either Beautiful or Invisible if we really care that technology to be secure. 3.1
This is the oldest city on the Cybersecurity planet, hence technology users have lived it for a long time. Here, Cybersecurity can be particularly hard to understand, interpret and use, and it can be realised empirically that it is often vulnerable. Vulnerabilities exist despite the Technocrats’ best efforts at preventing them, hence all sorts of security incidents have happened over time.
Vulnerabilities are not only purely technical as with the SSL Heartbleed and
Shellshock bugs. IBM reported that “over 95 percent of all incidents investigated
recognize ‘human error’ as a contributing factor ” in the 2014 Cyber Security
Intelligence report [
In this city, Cybersecurity is beautiful [
The first one is not innovative by itself as it appeals to the security-bydesign principle that the system should be designed with security in mind since the beginning; this normally enhances the ease of use and at the same time the effectiveness of the security defences. For example, security experts should contribute to the design of at least security-sensitive services since the inception.
The second requirement insists on what even security-by-design fails to prescribe clearly, that the secure access to a service be exclusive, namely the only possible one. For example, let us think of a web site secured via HTTPS yet allowing access also via HTTP for whatever legacy or performance reason. Also, when a user connects to a remote host via SSH for the first time, the user will have to accept the host’s public key on trust rather than on a viable certification system.
The third requirement is perhaps the most abstract one. I would like
Cybersecurity to be nice, desirable, rewarding and, generally speaking, a somewhat
positive thing to have. One way to meet this requirement could be to aim at a
Cybersecurity perceived as an engaging and fun game. An episode of the Peppa
Pig cartoon portrays a group of kids wanting to be part of a “secret club” as soon
as they come to know of its existence [
The gist of the beautiful security principle is that all three requirements be met at the same time. It would seem that the use of the web interface of WhatsApp conforms to this principle. The web client prompts the server, who then issues a passcode for the former, stores it and sends it back; the web client displays it as a QR code, which the phone client (the app) scans and sends to the server along with the chat log stored on the phone. Only if the received version matches the stored version, will the server output the chat log to the web client.
Notably, it all takes place over HTTPS except for the step whereby the passcode reaches the phone, which involves a human pointing the phone to the computer screen to scan the QR code. This is a crucial design choice: the passcode is 128 characters long, hence it would have been super tedious for the user to have to read it from the computer screen and tap it in the phone. Here, QR-code scanning conjugates usability, simplicity, security and also some beauty. I gather from random discussions that QR-code scanning normally thrills people. 3.3
In Invisible City, Cybersecurity is not perceived by the technology users although
it is still there. The idea is that if we cannot conjugate users and security by
means of beauty, then the only option left seems to make security invisible, that is
to literally make it invisible to the users’ perceptions. I provided various examples
on how this could be achieved in practice by integrating the security defences
with system functions or with other defences that the users would accept as
routine [
My favourite example is the Iphone 5S’s integration of the screen activation button with the fingerprint sensor. This idea stemmed from the observation that people were used to a stand-by display being off to preserve battery, hence to the need of pressing some button to activate it when needed. This integration combined a routine action with an important security defence, user authentication to the phone, which otherwise required a separate ceremony to insert a PIN or password.
I argue that another security ceremony that could live well in this city would
be a modification of the ceremony whereby passengers currently board flights
(at the gates of Old City airport). Each passenger gives the gate attendant three
pieces of information: the passenger’s face, his ID and his boarding pass. The
attendant matches face to ID, checks the ID validity, matches the ID to the
boarding pass, scans the pass in the airport system and checks that the outcome
confirms the identity that is allowed on the flight currently boarding. Only if all
checks succeed will the passenger be allowed to go through, otherwise he will
be stopped for further scrutiny. These are a number of checks for the attendant
to carry out on each passenger in a long queue, hence not surprisingly some
passengers complained to have reached the wrong destination [
With airport security being so sensitive at present, this scenario could be easily turned into various types of threats if the passenger attempted it deliberately and without reporting it. Therefore, I suggest to completely dispose with the boarding pass. This would leave only the initial authentication checks and the final authorisation one performed on the ID, which should be an electronic one, rather than on the pass. The match between the details of the ID with those of the boarding pass would be eliminated, reducing the risk of mismatching an authenticated identity to an identity that is authorised to board the flight. 4
I am a formal methodist down to the bone, so it is no surprise if I believe that
formal methods can help a great lot to assess Cybersecurity from the
sociotechnical angle, hence to build both Beautiful City and Invisible City. I have
published a few contributions to this debate [
The value of this recommendation does not expire; it could be generalised to every service recording users’ sensitive information. 5
This position paper demonstrates my view of Cybersecurity as a socio-technical problem, namely one that pertains to both the technology and to how users receive and avail themselves of it. Cybersecurity is a planet featuring Old City, one in which vulnerabilities and their exploitations are also due to an insufficient account on how humans use technology. I envisaged a road departing from Old City taking to either Beautiful City or to Invisible City, where I argued that Cybersecurity is more mindful of the human element. I also described some recent example uses of formal methods to help consolidate and expand the two new cities. Those are the places where I conclude that we researchers in Cybersecurity had better “move” the technology users from Old City.