Simulating Perceptions of Security

Paul Wernick; Bruce Christianson; William Spring

doi:10.1007/978-3-319-71075-4_7

Simulating Perceptions of Security

Paul Wernick, Bruce Christianson, William Spring

Centre for Computer Science and Informatics Research

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

86 Downloads (Pure)

Abstract

Systems complicated enough to have ongoing security issues are difficult to understand, and hard to model. The models are hard to understand, even when they are right (another reason they are usually wrong), and too complicated to use to make decisions.

Instead attackers, developers, and users make security decisions based on their
{\em perceptions} of the system, and not on properties that the system actually has. These perceptions differ between communities, causing decisions made by
one community to appear irrational to another.

Attempting to predict such irrational behaviour by basing a model of perception on a model of the system is even more complicated than the original modelling problem we can't solve. Ockham's razor says to model the perceptions directly, since these will be simpler than the system itself.

Original language	English
Title of host publication	Security Protocols XXV
Subtitle of host publication	25th International Workshop, Cambridge, UK, March 20–22, 2017, Revised Selected Papers
Editors	F. Stajano, J. Anderson, B. Christianson, V. Matyáš
Publisher	Springer Nature
Chapter	7
Pages	60-68
Number of pages	9
Volume	10476 LNCS
Edition	1
ISBN (Electronic)	978-3-319-71075-4
ISBN (Print)	978-3-319-71074-7
DOIs	https://doi.org/10.1007/978-3-319-71075-4_7
Publication status	Published - 29 Nov 2017
Event	Security Protocols 25th International Workshop - Cambridge, United Kingdom Duration: 20 Mar 2017 → 22 Mar 2017

Publication series

Name	Lecture Notes in Computer Science

Conference

Conference	Security Protocols 25th International Workshop
Country/Territory	United Kingdom
City	Cambridge
Period	20/03/17 → 22/03/17

Access to Document

10.1007/978-3-319-71075-4_7

Wernick et al Accepted ManuscriptAccepted author manuscript, 688 KB

Cite this

Wernick, P., Christianson, B., & Spring, W. (2017). Simulating Perceptions of Security. In F. Stajano, J. Anderson, B. Christianson, & V. Matyáš (Eds.), Security Protocols XXV: 25th International Workshop, Cambridge, UK, March 20–22, 2017, Revised Selected Papers (1 ed., Vol. 10476 LNCS, pp. 60-68). (Lecture Notes in Computer Science). Springer Nature. https://doi.org/10.1007/978-3-319-71075-4_7

@inproceedings{9cfb0ebefda64850ac7210ca419a18d9,

title = "Simulating Perceptions of Security",

abstract = "Systems complicated enough to have ongoing security issues are difficult to understand, and hard to model. The models are hard to understand, even when they are right (another reason they are usually wrong), and too complicated to use to make decisions. Instead attackers, developers, and users make security decisions based on their{\em perceptions} of the system, and not on properties that the system actually has. These perceptions differ between communities, causing decisions made by one community to appear irrational to another. Attempting to predict such irrational behaviour by basing a model of perception on a model of the system is even more complicated than the original modelling problem we can't solve. Ockham's razor says to model the perceptions directly, since these will be simpler than the system itself. ",

author = "Paul Wernick and Bruce Christianson and William Spring",

note = "This document is the Accepted Manuscript of a conference paper published in Proceedings of the Cambridge International Workshop on Security Protocols 2017. Under embargo until 29 November 2018. The final publication is available at Springer via: https://doi.org/10.1007/978-3-319-71075-4_7; Security Protocols 25th International Workshop ; Conference date: 20-03-2017 Through 22-03-2017",

year = "2017",

month = nov,

day = "29",

doi = "10.1007/978-3-319-71075-4_7",

language = "English",

isbn = "978-3-319-71074-7",

volume = "10476 LNCS",

series = "Lecture Notes in Computer Science",

publisher = "Springer Nature",

pages = "60--68",

editor = "F. Stajano and J. Anderson and B. Christianson and V. Maty{\'a}{\v s}",

booktitle = "Security Protocols XXV",

address = "Netherlands",

edition = "1",

}

Wernick, P, Christianson, B & Spring, W 2017, Simulating Perceptions of Security. in F Stajano, J Anderson, B Christianson & V Matyáš (eds), Security Protocols XXV: 25th International Workshop, Cambridge, UK, March 20–22, 2017, Revised Selected Papers. 1 edn, vol. 10476 LNCS, Lecture Notes in Computer Science, Springer Nature, pp. 60-68, Security Protocols 25th International Workshop, Cambridge, United Kingdom, 20/03/17. https://doi.org/10.1007/978-3-319-71075-4_7

Simulating Perceptions of Security. / Wernick, Paul; Christianson, Bruce ; Spring, William.
Security Protocols XXV: 25th International Workshop, Cambridge, UK, March 20–22, 2017, Revised Selected Papers. ed. / F. Stajano; J. Anderson; B. Christianson; V. Matyáš. Vol. 10476 LNCS 1. ed. Springer Nature, 2017. p. 60-68 (Lecture Notes in Computer Science).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Simulating Perceptions of Security

AU - Wernick, Paul

AU - Christianson, Bruce

AU - Spring, William

N1 - This document is the Accepted Manuscript of a conference paper published in Proceedings of the Cambridge International Workshop on Security Protocols 2017. Under embargo until 29 November 2018. The final publication is available at Springer via: https://doi.org/10.1007/978-3-319-71075-4_7

PY - 2017/11/29

Y1 - 2017/11/29

N2 - Systems complicated enough to have ongoing security issues are difficult to understand, and hard to model. The models are hard to understand, even when they are right (another reason they are usually wrong), and too complicated to use to make decisions. Instead attackers, developers, and users make security decisions based on their{\em perceptions} of the system, and not on properties that the system actually has. These perceptions differ between communities, causing decisions made by one community to appear irrational to another. Attempting to predict such irrational behaviour by basing a model of perception on a model of the system is even more complicated than the original modelling problem we can't solve. Ockham's razor says to model the perceptions directly, since these will be simpler than the system itself.

AB - Systems complicated enough to have ongoing security issues are difficult to understand, and hard to model. The models are hard to understand, even when they are right (another reason they are usually wrong), and too complicated to use to make decisions. Instead attackers, developers, and users make security decisions based on their{\em perceptions} of the system, and not on properties that the system actually has. These perceptions differ between communities, causing decisions made by one community to appear irrational to another. Attempting to predict such irrational behaviour by basing a model of perception on a model of the system is even more complicated than the original modelling problem we can't solve. Ockham's razor says to model the perceptions directly, since these will be simpler than the system itself.

U2 - 10.1007/978-3-319-71075-4_7

DO - 10.1007/978-3-319-71075-4_7

M3 - Conference contribution

SN - 978-3-319-71074-7

VL - 10476 LNCS

T3 - Lecture Notes in Computer Science

SP - 60

EP - 68

BT - Security Protocols XXV

A2 - Stajano, F.

A2 - Anderson, J.

A2 - Christianson, B.

A2 - Matyáš, V.

PB - Springer Nature

T2 - Security Protocols 25th International Workshop

Y2 - 20 March 2017 through 22 March 2017

ER -

Wernick P, Christianson B , Spring W. Simulating Perceptions of Security. In Stajano F, Anderson J, Christianson B, Matyáš V, editors, Security Protocols XXV: 25th International Workshop, Cambridge, UK, March 20–22, 2017, Revised Selected Papers. 1 ed. Vol. 10476 LNCS. Springer Nature. 2017. p. 60-68. (Lecture Notes in Computer Science). doi: 10.1007/978-3-319-71075-4_7