NUDGE AND SLUDGE: DRIVING SECURITY WITH DESIGN // J. WOLFGANG GOERLICH, Duo Security by Cisco
•Transferir como PPTX, PDF•
0 gostou•87 visualizações
Security people say users are the weakest link. But are they? When complying with security becomes too burdensome, users take shortcuts, find workarounds, and end up jeopardizing security. Blaming users is lazy and easy. Making security usable is time consuming and challenging. How does design research help us understand our customers? What patterns and principles drive secure behavior? How can we build empathy with customers and make the right thing to do the easiest thing to do? This session explores these questions, and provides examples of how design thinking and research can help us be more secure. We will walk through our creation of core user personas, design principles, and how these inform and direct our design choices and intent. Don’t blame your users anymore. Come learn how to be part of a future where usability leads security.
Recomendados
Recomendados
Mais conteúdo relacionado
Semelhante a NUDGE AND SLUDGE: DRIVING SECURITY WITH DESIGN // J. WOLFGANG GOERLICH, Duo Security by Cisco
Semelhante a NUDGE AND SLUDGE: DRIVING SECURITY WITH DESIGN // J. WOLFGANG GOERLICH, Duo Security by Cisco (20)
Mais de DevOpsDays Tel Aviv
Mais de DevOpsDays Tel Aviv (20)
Último
Último (20)
NUDGE AND SLUDGE: DRIVING SECURITY WITH DESIGN // J. WOLFGANG GOERLICH, Duo Security by Cisco
- 2. @jwgoerlich J Wolfgang Goerlich Advisory CISO @ Cisco Secure WGoerlic@Cisco.com https://jwgoerlich.com Twitter: @jwgoerlich Wolf@JWGoerlich.com Hi. I’m Wolf.
- 3. @jwgoerlich Intentionally or accidentally, we create experiences. How can we design a better experience?
- 4. @jwgoerlich @jwgoerlich Predictability of each choice Number of steps Number of choices Familiarity of each step Friction at each step Cognitive load at each choice Paths They Take Choices They Make
- 6. “ @jwgoerlich Affordance is what the environment offers the individual. – James J. Gibson
- 7. “ @jwgoerlich Nudge was written as an alternative to rules and mandates. – Richard Thaler
- 8. @jwgoerlich Sludge: when people face high levels of friction obstructing their efforts to get work done
- 9. “ @jwgoerlich Friction and bad intentions. – Richard Thaler
- 10. @jwgoerlich Process analysis Journey mapping Behavior mapping Wayfinding Look at the paths they take
- 11. @jwgoerlich what we build Nudge and Sludge
- 13. @jwgoerlich
- 14. @jwgoerlich Epic Games unlocks the Boogie Down emote for turning on 2FA.
- 15. @jwgoerlich Content Warning: Many of my examples will be authentication and authorization. Please expand these concepts to your area of security.
- 16. @jwgoerlich Cognitive, physical, sensory, and functional affordances in interaction design. BIT 22(5) (pp.315-338)
- 17. @jwgoerlich 😕 🙁 ☹️ Emotional Affordances
- 18. @jwgoerlich X ✓ X ✓ Physical Affordance Cognitive Affordance
- 20. @jwgoerlich https://thegeekpage.com/chrome-sync-is-paused/ Indicating something is amiss without interrupting user tasks.
- 21. @jwgoerlich Nudge Towards More Security Bank of America, November 2021
- 23. @jwgoerlich Multi-Factor Authentication (MFA) Single Sign-On (SSO) Security & Privacy Settings *everywhere*
- 25. @jwgoerlich The features we give our users are the exploits we give our attackers.
- 26. @jwgoerlich
- 27. @jwgoerlich What path are the criminals taking? What are the steps along that path? What choices are they making? What choices are they NOT making? Starting Questions
- 28. @jwgoerlich
- 29. @jwgoerlich Investigate and manually block suspicious accounts Enhance the credit card approval logic Block certain telephone numbers Add controls to the signup to limit mass signups Not on the Users’ Path
- 30. @jwgoerlich Limit the number of calls for trial accounts Geo-fencing to block countries Credit card statement validation On the Users’ Path
- 31. @jwgoerlich Good security is applied along the paths and choices users and adversaries make.
- 32. @jwgoerlich how we build Nudge and Sludge
- 33. @jwgoerlich Apply UX to securing DevOps.
- 34. @jwgoerlich Let’s look at the paths they take.
- 36. @jwgoerlich
- 37. @jwgoerlich Adversary Path Deliver Exploit Control Execute Maintain Command & Control Exfiltration Discovery Lateral Movement Collection Privileged Escalation Defense Evasion Credential Access Initial Access Execution Persistence Lockheed Martin Cyber Kill Chain Mitre Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK)
- 38. @jwgoerlich
- 39. @jwgoerlich Good security gets out of the way of developers and gets in the way of adversaries.
- 41. @jwgoerlich People writing down passwords is a creative cognitive affordance.
- 42. @jwgoerlich Role-Based Access Control (RBAC) Just In Time Access (JIT) Updated images and packages
- 44. @jwgoerlich Constrained users are creative, and creative users are dangerous.
- 46. @jwgoerlich DevOps but Securely Design Review Code Review Code Inventory Asset Inventory DAST IAST SCA Change Monitoring FIM Vulnerability Management RASP WAF Container Monitoring Cloud Monitoring SAST
- 48. @jwgoerlich Security: SCAN ALL THE THINGS. Developers…
- 49. @jwgoerlich
- 50. “ @jwgoerlich Friction and bad intentions. – Richard Thaler
- 51. @jwgoerlich
- 52. @jwgoerlich
- 53. @jwgoerlich Good friction is the natural consequence of poor security behaviors.
- 54. @jwgoerlich Reducing sludge doesn’t always mean reducing steps.
- 55. @jwgoerlich Bad friction is determined by perceived friction, not just actual friction.
- 56. @jwgoerlich Measure compliance rates, BUT ALSO Measure process and communication sludge Trudging Through Sludge Source: Seeing Sludge:Towards a Dashboard to Help Organizations Recognize Impedance to End-User Decisions and Action
- 57. @jwgoerlich Good security is as little security as possible.
- 59. @jwgoerlich @jwgoerlich Predictability of each choice Number of steps Number of choices Familiarity of each step Friction at each step Cognitive load at each choice Paths They Take Choices They Make
- 60. @jwgoerlich
- 61. @jwgoerlich Users and Developers Behavior or journey maps BSIMM Reduce steps Reduce choices Simplify Clarify Criminals Threat model or attack path Mitre ATT&CK Increase steps Increase choices Complicate Confound How to Apply this Model?
- 63. @jwgoerlich Zero Trust for the Workforce (Data Plane) Policy Administration Policy Engine Trust Inference
- 64. @jwgoerlich To enter Israel, I need a negative Covid Test … which means I need my PCR test results ... which means I need my password manager ... which sees I’m traveling … and therefore prompts to login … which requires MFA … which in turn sees my MacBook needs an update … which begins downloading over a hotel Wi-Fi
- 65. @jwgoerlich
- 66. @jwgoerlich Good security is a design problem. And like any design problem, it will take many iterations to get right.
- 67. @jwgoerlich Thank You! J Wolfgang Goerlich Advisory CISO @ Cisco Secure WGoerlic@Cisco.com https://jwgoerlich.com Twitter: @jwgoerlich Wolf@JWGoerlich.com
Notas do Editor
- Nudge and Sludge: Driving Security with Design DevOpsDays Tel Aviv with Cloud Native & OSS Day & StatsCraft
- Royalty-free stock photo ID: 458236126 Garden Brick Pathway Paving by Professional Paver Worker. By welcomia https://www.shutterstock.com/image-photo/garden-brick-pathway-paving-by-professional-458236126
- https://www.youtube.com/watch?v=KYuaKMrquYQ&ab_channel=TheUniversityofChicagoBoothSchoolofBusiness
- Duo story about where people begin on the app restore process.
- Nudge and Sludge: Driving Security with Design DevOpsDays Tel Aviv with Cloud Native & OSS Day & StatsCraft
- Stockholm, Sweden. “The interactive staircase persuaded 66% more people than normal chose to use the staircase instead of the escalator.” https://sites.psu.edu/siowfa15/2015/09/16/the-fun-theory/
- https://www.epicgames.com/help/en-US/epic-accounts-c74/account-security-c112/what-rewards-do-i-get-for-enabling-twofactor-authentication-2fa-on-my-epic-games-account-a4443
- Hartson’s taxonomy of affordances https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.499.252&rep=rep1&type=pdf
- Duo story about different frowning faces leading to different responses in unpatched software.
- Physical affordances – I know where the buttons are and I’ve built muscle memory. Power users. Cognitive affordances – The buttons are where I’d expect based on other apps. New users.
- Mention doing an analysis of e-commerce MFA and finding almost no support for anything other than SMS. Mention http://sso.tax/ or the SSO wall of shame.
- https://www.pexels.com/photo/antique-communication-phone-museum-35886/ Long distance calls are expensive. Shady Telco’s asked: What if we could have people generate long distance calls to increase revenue? Scammers asked: What if I could generate long distance calls and get a kickback from the telco’s? Shady Telco’s stand up premium numbers that scammers direct traffic to for a kickback.
- Wayfinding: What path are the criminals taking? Wayfinding – cognitive load: What are the steps along that path? Choice architecture – choice cost: What choices are they making? Choice architecture – defaults: What choices are they NOT making? Path: Scammer establishes trial account with stolen credit card. Scammer registers the shady telco’s premium number as second factor. Scammer performs authentication to place the phone call. Shady telco charges for the call, provides kick-back to scammer. PROFIT!!! Choices: API or headless browser Specific IP addresses - country of origin Specific telephone numbers
- Image by Janine Bolon from Pixabay Balance usability with defensibility using design.
- Nudge and Sludge: Driving Security with Design DevOpsDays Tel Aviv with Cloud Native & OSS Day & StatsCraft
- Initial Access Execution Persistence
- Seek out user-driven cognitive affordances. This is people’s way of trying to fix an underlying design issue. Here, it’s the lack of password manager or password vault.
- Tell the story about trying to update production APX when you were at Munder Capital. Give the example of Merrill’s on-call people having prod access only when on-call.
- Security depends upon how well the needs of the developer are met by the affordances of the security controls. If they don’t meet, developers will creatively satisfy their own needs with their own affordances. From: Affordances as an alliance to design https://www.udemy.com/course/affordances/learn/lecture/637602#overview
- Excessive error messages and reports and tickets, what Richard Thaler calls “useless clutter” sludge. Can Stock Photo, Wolf’s license Order 6379855
- “Think Better” with Richard Thaler https://youtu.be/KYuaKMrquYQ?t=1006
- https://en.wikipedia.org/wiki/Rumble_strip#/media/File:North_Luzon_Expressway_Rumble_Strips.jpg
- Friction is the metaphor of rumble strips on highways. Completely out of the way for most of the time. Only kick in when drivers go off track, hopefully to prevent car crashes. Highway https://www.flickr.com/photos/kenlund/14467590123 Rumble Strip http://asphaltmagazine.com/rumble-strips-keep-drivers-on-the-road/ Car crash https://commons.wikimedia.org/wiki/File:Car_crash_1.jpg
- Master Class added steps to the sign-up process. This should have resulted in more sludge. “What Master Class found, however, was a substantial increase in subscriptions, which is potentially attributable to the idea that even though the number of steps increased, the perceived level of “ask” on each step was reduced.”
- Soman, Dilip and Cowen, Daniel and Kannan, Niketana and Feng, Bing, Seeing Sludge: Towards a Dashboard to Help Organizations Recognize Impedance to End-User Decisions and Action (September 27, 2019). Research Report Series Behaviourally Informed Organizations Partnership; Behavioural Economics in Action at Rotman, September 2019
- Image by Daniel Nebreda from Pixabay
- Nudge and Sludge: Driving Security with Design DevOpsDays Tel Aviv with Cloud Native & OSS Day & StatsCraft
- Royalty-free stock photo ID: 458236126 Garden Brick Pathway Paving by Professional Paver Worker. By welcomia https://www.shutterstock.com/image-photo/garden-brick-pathway-paving-by-professional-458236126
- Building Security In Maturity Model (BSIMM) is a study of current software security initiatives or programs.
- Live the story you want to tell, even if it’s a cautionary tale.