Friday, 25 September 2009

Human Factors in Information Security - Errors & Violations

Human failures are often described as Slips, Lapses, Mistakes and Violations. These are grouped into two categories: Errors and Violations. The difference here is the intent - violations result from conscious decisions to disregard policies and procedures, whereas errors have no malicious intent. Also, violations often involve more than one form of misconduct, whereas errors are often isolated.

Don Turnblade has stated that in his experience "well trained staff had a 3.75% unintentional non-compliance rate; they did not realize that installed software compromised data security. About 0.4% of end users were intentionally non-compliant, generally willful persons with strong technical skill or organizational authority who were unaccustomed to complying with computing restrictions."

So what are the different types of error? Dealing with each in turn, we have Slips, Lapses and Mistakes.
  • Slips - actions not carried out as intended, e.g. pressing the wrong key by accident. Slips usually occur at the task execution stage.
  • Lapses - missed actions or omissions, e.g. forgetting to log out, or a step in a configuration process.
  • Mistakes - occur due to an incorrect intention, whilst believing it to be correct, i.e. they are deliberate actions with no malicious intent, e.g. misconfiguration of a firewall. Mistakes usually occur at the planning stage.

So who causes the error or violation and how do we combat them? Slips and Lapses are usually the fault of the user, but can be mitigated by making it more difficult for the user to make the error, e.g. by having confirmation dialogs for slips and better training for lapses. Mistakes tend to be the fault of designers and are slightly more difficult to combat as designer education is required or outside technical expertise needs to be brought in. However, this doesn't always solve the problem if they don't have the skills and knowledge required. Finally, violations can often be laid at the door of the managers. It is often the case that a culture of violations is accepted by senior management, who fail to impose proper sanctions or take the threat seriously.

All of these have to be dealt with to have a secure system and most of it boils down to having proper user education and training in place.


Andrew Lenaghan said...

Its interesting you frame the discussion in Human Factors terms. A big issue in designing interactive systems is the 'mental model' that uses have. That is the internal representation a user has of a system. Mental models give some depth to a users understanding of how the different parts of a system interrelate and consequently how it will behave given novel inputs or conditions.
Mental Models can be difficult things to establish in a domain as intangible / complex as software but without them peoples understanding (or their ability to predict outcomes) is very brittle - a system appears to either do what its always done or is inexplicable different.
I think the consequence of lacking good mental models in security is that people are unable to make judgments about the risks associated with their actions. Judgments get very binary with risks being either under or over estimated, neither of which are helpful.
The response of the security functionality in systems often compounds this difficulty turning decisions into ok / cancel types of choices with little effort to inform the user of the potential consequences.
I think if there was one goal for helping manage 'lapses' & 'violations' it should be to help users make informed decisions (informed in the sense of an awareness of the risks) rather than a paradigm based on just controlling and simplifying. Neither dumbing things down or automating too much in the background to second guess a user intent appear to be sustainable strategies. If anything they just make the impact of users less predictable.

Post a Comment

Welcome to the RLR UK Blog

This blog is about network and information security issues primarily, but it does stray into other IT related fields, such as web development and anything else that we find interesting.

Tag Cloud

Twitter Updates

    follow me on Twitter

    Purewire Trust