Crash Test Cybersecurity

Human behavior is a huge part of cybersecurity, say I and everyone in the room nods sagely. But like Lake Woebegone, where all the children are above average, in Cybersecurity Culture we all seem to be immune to the foibles of the human psyche. What does that mean? An example will help.

One of my buddies in college, JG, was an applied math major with a penchant for mechanical engineering courses. At a deep level these two fields are closely related. But they are not the same, especially with respect to the personality traits of the practitioners.

This fact first came to my attention when JG joined other of my friends in taking a course entitled "Design Optimization and Failure." JG loved this course. He loved using Finite Element Analysis to figure out which part in a complex system would fail first, which set the standard that all the other parts would be held to. He loved the head-spinning math required to constantly re-assess as they tried to make a complex system a bit stronger or faster or better with a minimum amount of improvement. He found the idea of breaking complex systems to be very interesting, intellectually. He felt nothing emotionally.

The actual mechanical engineers, on the other hand, found the idea of breaking complex systems on purpose rather disturbing. The idea of celebrating the weakest link in the chain was hard for them to stomach. Their instinct was to start a never-ending improvement spree, which is part of what the course was intended to teach them: real life doesn't work that way. Increasing the strength of one part often puts greater strain on another part. The failures then cascade as you strengthen another part which causes some other part to fail. The inverse, having deliberately weak parts which are sacrificial on purpose, is often the better option. (This sacrificial strategy is useful in cybersecurity: we refer to deliberately easy to attack but sequestered systems as "honey pots.")

During all this I was smugly on the sidelines: in software, building and destroying virtual things this is par for course. Iterative improvement sprees can lead to bloated code, but also can lead to a superior product. Finding a weak spot and NOT patching it was like having an itch you cannot scratch. In software, FEA is not such a big deal. We have endless test suites and finding and fixing bugs is not a very emotionally-charged process.

I was able to feel superior to those mechanical engineers until a hardware project for which I did the software. Suddenly physical form factors mattered. And when the time came for drop testing, the process of dropping our beautiful devices from ever-greater heights to determine whether or not we had a product and not a prototype, I could not bear to watch. I let other people do it and I tried not to think about it. There are even firms which specialize in this kind of testing, so that people like me can ship them our precious darlings and not have to think about what terrible things are being done to them.

I was not safe from this limitation in cybersecurity either. Every Cybersecurity Program (CSP) I have ever encountered exhibits this same phenomenon, this tendency toward avoiding actually breaking things. In theory, most CSPs should have someone go offsite and download some security cracking tools and have at your networks and your other digital assets. How do you know how strong a window is? You break several. How do you know how good your network security is? Well, you make some assumptions and then monitor activity based on those assumptions and call it a day. This nonchalance would never fly in other branches of engineering: why do we allow it in cybersecurity?

Even having a small group within your group is not ideal. For best results, the people doing the testing are different people than the people who do the securing. When I secure a system, I protect it against all issues I can imagine. I am not so good at protecting it from issues I can't even imagine. I also don't keep up with cracking tools because the entire topic is distasteful to me. To do that job right, I would need some very trusted outside agency, often called "white hat hackers," to give a go and then report the results to me.

Despite the tragic impulses so well portrayed in the film"A Beautiful Mind," no one is smart enough to figure out what they don't think about about. I had a comic demonstration of my own limitations many years ago when I had housemates. There were three of us: two above-average sized guys and a small woman. After a couple of initial incidents during which the men discovered that the woman felt that leaving cake or brownies lying around did NOT constitute abandonment, all such incidents ceased. I thought no more about it. Upon breaking up our household, years later, I discovered that the woman had taken to storing treasured food in the bottom kitchen cabinets. While theoretically something I saw every day, I hate getting down low and had literally ceased to be aware of the cabinets. For years delectable comestibles had been hidden there, within easy reach but in utter safety. Blind spots are real and they don't just affect one's ability to find snacks or desserts.

A stereotypical cybersecurity engineer's reluctance to engage in the activity they exist to prevent is also real. Getting people to do things that they don't even want to think about is hard. Accomplishing this in cybersecurity is as important as it is difficult. We can help. Ask us how.