[PROJECT SEGMENT #1]: How Psychology is Related to the Human Aspect of Security
When it comes to InfoSec, the main objectives of this field are to identify important assets that needs protecting (such as sensitive information), recognizing potential problems, then adopting necessary solutions to prevent and to protect those assets from threats. We all know about the C-I-A triad, this serves to accomplish the needs of InfoSec’s purpose. However, in the broader scope of security, this fails to address and encompasses other pitfalls of concerns. This is due to the fact that the properties of C-I-A only ensures that the communications you exchange and assets you wish to protect, is accessible by for those that are authorized or who are considered “trustworthy”.
Here is what it DOES try to achieve:
· Authentication allows for the verification of someone’s identity, so you know you are communicating with who you think want to exchange information with (applies to user-to-machine interactions as well)
· Confidentiality allows for the exchange of information/data to be protected from unauthorized agents intercepting the message during the process of transmission, as well as after
· Integrity allows for the assurance that the information exchanged has not been tampered and modified in any way, where the received output should be exactly 100% the same as the input
With that being said, now it’s time to contrast this with what it DOESN’T necessarily achieve:
Authentication isn’t perfect (especially by humans), as it is hard to discern who exactly is different from whom. Aside from the obvious cases of identity theft, in which criminals can easily impersonate as you using your personally identifiable information (PII), there are other overlooked implications associated with authentication problems. One way of identifying people to determine if they are “allowed” to enter a premise or perform certain actions, etc, is by checking their faces with a “reliable” source. Depending on whether they are “judged” to match the face on their source, they would either be granted or denied entry. As this process involves making judgements about faces and appearances, there is an abundant and vast area of psychological research that are of relevant interest. Let’s take a look at these, before linking it back to security.
One interesting research area from developmental psychology is ‘perceptual narrowing’ and this revolves around the findings that early childhood experiences can be extremely important in shaping our perceptual abilities as an adult. There are different aspects of perceptual narrowing, but the one we are going to focus on, is related to faces. During the early stages of our developmental process, there exists what are known as ‘critical periods,’ which is the time period where certain environmental exposures are necessary in order for us to benefit from it later on in life. Here is an example. If a child is living in a multicultural country that has people from a diverse range of ethnicities and he/she is exposed to many faces from different races during the critical period, then this child would be able to develop the ability to distinguish between their faces. They would be able to tell if an Asian face specifically belongs to someone who’s Korean, Chinese or Japanese, etc. The same is true not just for human faces, but with monkey faces. Suppose during the critical period, a child has been exposed to many faces of monkeys, they would be able to tell which species the monkey is from. This perceptual ability that allows for discernment would be impossible or very difficult, if the exposure occurs after the critical period has ended. Of course, this is also the explanation as to why some people are able to tell what someone’s racial background is, while others have the perception that for example, “all Asians look the same” or “all white people look the same”. The same is true for our perception that “all monkeys look the same”. Those that grew up with limited exposure to a wide variety of facial profiles, would have a declined ability to infer similarities from differences.
Another interesting research area stemming from forensic psychology is the fallibility of memory. This is strongly related to the reliability of eyewitness testimony as forensic and legal evidence. Important implications can be drawn by briefly examining how these influences one another. Once upon a time, eyewitness testimony was considered to be a valid and highly reliable form of evidence used to identify perpetrators, especially when there are many witnesses that point to the same person. However, time and time again, with historical similarities between many cases of wrongful convictions and exonerations, the important lesson to be learnt is that eyewitness testimony can be flawed. This conclusion is based on statistics alone, but there is experimental evidence from psychology research to confirm this. Countless experiments on human memory have demonstrated the fallible nature of this cognitive ability. For one thing, it is found that every time we remember something, this retrieval of memories is not the same as playing back a recorded video from a camera. Rather, it involves recalling the last time we remembered the information associated with the memory. This is undesirable, as it easily leads to inaccurate recall. Studies in laboratory setting, have demonstrated that participants have a high failure rates in correctly remembering and identifying the correct suspect (someone acting out a scenario as a criminal in a video). These misidentification outcomes found in real-world cases are easily replicable under experimental conditions. Another finding is that it is also not that hard to create false memories (multi-personality disorders are caused by false memories from diagnosis by the clinician), which is based on activating related schemas in a semantic network in our memory that brings related details to mind (also one of the theories behind déjà vu). I have personally participated in some of these experiments, and the results are always surprising. One of these I’ve done involved remembering many words related to the topic of “sleep”, such as “bed”, “dream” and “pillow”, etc. When all participants had to recall these words, the majority of them reported the word “sleep”, even though this word never been presented. The last finding to know is that memories can be altered with expectations, beliefs and contamination. Contamination refers to how an individual’s memory of an event can be changed immediately afterwards when communicating with others who have experienced the same event. If the conversation contains conflicting recall information, the inaccurate details from one person could overwrite the certainty that someone has on their own recall accuracy. So, considering that memories are very unreliable even when it is retrieved shortly after time of exposure to the information, one can imagine how it could degrade over the course of extended durations. These are the reasons as to why memory problems could lead to outcomes such as, but not limited to, false positives of innocent people being imprisoned, some cases of false confessions (suspects claiming they have committed the crime when they haven’t, due to bad interrogation techniques), as well as personality disorders. Notice how eyewitness testimony and the fallibility of memory is connected to facial recognition and appearances, which goes back to identification.
The final interesting research area comes from social psychology, and it is the phenomenon of ‘change blindness’. This occurs when a there is a change in the visual stimulus without the observer noticing, even when it is big change. Studies done on this revealed that even when someone is interacting with a specific individual, and they switch with another different-looking individual, this change would not be noticed. For example, say cashier is serving you, and if you crouched under the table and switch with someone else who was already crouching (without being seen), the cashier would think that the switched person is the same person as you. This finding has been replicated across different scenarios and its effectiveness is alarming. It is similar to the effects of selective attention, where while the observer is focusing on certain information, other irrelevant information is filtered out or not consciously processed. These 2 play a major role in why magic tricks work.
Tying these topics together, this combined knowledge shows some of the potential problems with the process of identification verification. Before a decision can be made to grant or deny permission/access, confirmation of their identity needs to be established, which is crucial to authorization and authentication. However, this is based on a conditional probability, since decision relies on the judgement of ensuring that the individual is who they claim they are, and this relies on their interpretation of the source (e.g. ID card) used to make the comparison. Interpretation comes from perception and as outlined by the research I presented on perceptual narrowing, fallibility of memory and change blindness, perception both influences and is influenced by other cognitive processes involved in decision-making and judgements. These are the fundamental factors that act as the foundation for the process of authentication. Therefore, if these components could be affected, then subsequently, their judgement abilities can be impacted to an attacker’s favour. Though, even without deliberate manipulation, it is reasonable to assume that type I and type II errors would inevitably occur due to human error (this will be further explained later), because humans aren’t necessarily so great at remembering information in accurate detail, like faces, nor distinguishing who is different to who. But it is also important to point out that these recognition problems are weaker for familiar faces or those we know well, as opposed to unfamiliar (effect is not as significant).
In scientific research and statistical analysis, one measure that determines how consistent the results are, for applied practices among those giving judgements is known as “inter-rater reliability”. It is essentially a score of the extent of agreement (agreeability) between multiple raters for a measurement, judgement or rating. In the context of authentication, inter-rater reliability can be poor for some people, depending on individual differences (for reasons explained by the mentioned research), as well as for another reason that will be explained. Taking this into consideration, with enough skill, evading detection from those familiar of the attacker, while also impersonating a target in face-to-face situations is still possible. This is achieved through the means of disguising. The historical significance of disguising dates back to spies adopting another appearance that differs from their own, to switch identities when required. Purposes for this includes, stealth infiltration of enemy’s territories, intel gathering, assassination, stealing items of interest and carrying out a secret operations by gaining trust. Thus, the relationship between espionage and disguising with cybersecurity, has to do with trust, insider threats and advanced persistent threats (APTs).
Now, when it comes to methods of disguising, there can be different approaches. Concealment by hiding facial features such as using sunglasses, face mask and hat, etc, can ironically, attract more attention than intended. This is analogous to the streisand effect, in that the attempt to hide information leads to the consequence of it becoming more salient. Even more so when the context does not align with the appropriateness of the agent’s behaviour (like being fully-clothed on a very hot day). Another similar approach would be using face masks. However, in the modern age, it is extremely difficult to reproduce a mask that’s realistic to the properties of the human face, such as skin tone, texture and how light reflects on the surface. Even the CIA, has had difficulty in doing this with highly advanced technology. These 2 approaches rely heavily on security through obscurity, while also drawing unnecessary attention and suspicion, rendering it relatively useless. On the other hand, a more flexible and effective way to change appearances is through the use of make-up. When I say ‘make-up’, this term is generalized in a broader sense, referring to any materials used to modify the look and feel of one’s appearance, including typical cosmetics products, body paint, false lashes, double eyelid glue, face tape, wax, contact lenses, fake teeth, wigs and prosthetics/implants. If the agent is skilled enough, this allows for superior flexibility, as they could use it to transform themselves (for face) to look like anyone. There are in fact, make-up artists and cosplayers that are unbelievably capable of successfully achieving this. This means that they could impersonate other individuals and break authentication, either short-term (for bypassing facial-recognition technology as a biometric measure) or long-term (adopting fake identities while undercover). How practical this is realistically, depends on the skill of the agent, their facial features/structure and sex. Females have an advantage over males, since it is more “natural” for them to be wearing makeup, in this case, heavy usage to alter appearance, without raising suspicion. While males would stand out and attract undesirable attention. It is also noteworthy to remind that, in fewer cases, disguising can involve changing genders. A notable historical figure who was famous for this was Chevalier D'eon, who could pull this off the transformation from male-to-female flawlessly. He was a spy whose true gender remained a mystery. If you add voice acting to this, changing both voice and appearance is most ideal.
Bringing back all the topics into the relevance of some of the ways on how psychology is important to security, it could be summed up as follows. When it comes to unfamiliar faces, humans are bad at distinguishing and remembering who is similar and different to who, given that they have limited exposure to those faces. This ability to discern is even worse if the individual making these judgements have a declined identification ability from minimal exposure faces during the critical periods of early childhood (as a result of perceptual narrowing). People have memory problems and this worsened by change blindness and selective attention. Then the face-to-face in person authentication process via humans, can be bypassed through taking advantage of flaws associated with the identification verification being a conditional probability which relied on the interpretation of comparison between the individual’s face and their identifier source. Those flaws comes from weaknesses in perception and cognition that can be exploited through facial impersonation. This is then related to the power of make-up as a means for disguising, which addresses the problem (from the threat actor’s point of view) of being recognized by those familiar/close to him/her. The skill to disguise and goes undercover, can be utilized by insider threats, APTs, foreign spies and law enforcement. Concerns about being detected and exposed is reduced since humans would not necessarily notice changes, along with confirmation bias. Ultimately, this all plays into an unanticipated aspect of social engineering and human hacking (intel gathering, deception, exploitation and manipulation), compared with stereotypical methods.
Thus far, everything has been framed from an attacker’s perspective outside of a professional, ethical context. But, the application of my arguments could potentially be implemented into red teaming and penetration testing. There is much more that could be explained better and expanded upon (such as using example scenarios), but for readability’s sake, I will leave it up to the reader’s imagination on further possibilities and draw their own conclusions, with what I have given so far. This essay is concerned with just one way in which psychology is relevant to security, there are many other ways of how these 2 fields are interconnected, some of which will be explored later in my project.
In this segment, I have talked about how insider threats is linked to the limitations of the C-I-A triad and how psychology ties in, but there is more to this connection to be explored in follow-up segments, where I provide an answer to address this issue.
