module u1: human capability and ia azene zenebe, ph.d., and lola staples, m.sc. management of...
TRANSCRIPT
Module U1:Human Capability and IA
Azene Zenebe, Ph.D., and
Lola Staples, M.Sc.Management of Information Systems Department
Center for Business and Graduate Studies, Room 3330
14000 Jericho Park Road, Bowie, MD 20715
1
Presentation Outline
Overview Introduction Human Capability and Security Factors for Human Capability Models in Human Computer Interaction (HCI) Importance to Usability of Security Systems Human Behavior and Security Summary Discussion Questions
2
Overview Users are not always capable of performing the
right decisions regarding security.
If users have to invest too much mental effort in working out how to operate security systems, they will be less efficient and make more errors.
Human – security system interaction is a cognitive activity.
3
ObjectivesWhen you complete this module, you will be
able to: Describe human capability Discuss factors that determine human capability Describe the relationship between usability of security
systems and human capability Discuss human behavior in security systems Determine factors affecting human behaviors in
security systems Conduct a study of user behaviors in a security
system 4
Introduction
Users interact with computer and information security systems differently and have different behavior.
The purpose of this module is to provide definitions, background and theoretical framework for human capability and behavior in relationship to the usability of computer and information security systems.
5
Human Capability and Security
Humans carry out tasks in which information is created, accessed and/or manipulated.
The more complicated the interaction with the computer systems the more frustrated users become and the more distracted they are from their real tasks.
Users are not always capable of performing the right decisions regarding security.
6
Human Capability and Security Several studies indicated that:
ˉ The mechanism for encryption, authorization or authentication can be difficult for people to understand or use.
ˉ People often fail to recognize security risks or the information provided to alert them.
Computer interaction is a cognitive activity that involves processing of information in the mind
7
Human Capability and Security - What is Cognition?
What is cognition?
According to the Encyclopædia Britannica’s definition, cognition includes “all processes of consciousness by which knowledge is accumulated, such as perceiving, recognizing, conceiving, and reasoning.”
8
Factors for Human Capacity Key factors that affect the way users
interact with computer systems are (Benyon, 1993):ˉ our sensorsˉ attention ˉ memory
ˉ sensory, ˉ short term or working and ˉ long term
ˉ learning andˉ mental models
9
Factors - Sensors Perception – The process of seeing an active
process: ˉ mainly visual environmental informationˉ can be previously stored knowledge ˉ provides a more constant view of the world ˉ highly related to user interface with security
systems should be legible distinguishable comprehensible uncluttered and meaningfully structured
10
Factors – Attention
Attention - Our capability to attend to amass of information at one time
ˉ We can see, hear, and smell at one time.
ˉ We are multi-tasking
ˉ Hence few tasks or decisions receive our full attention at any given time
11
Factors - Memory
Memory - Our ability to store and remember.
There are three main types of meory:ˉ sensory memory (SM)ˉ short term or working memory (STM) ˉ long-term memory (LTM)
12
Factors - Sensory-Memory (SM)
SM retains an exact copy of what is seen, heard or touchedˉ mainly visual and auditory
SM lasts only a few seconds and has unlimited capacity
13
Factors-Short Term Memory(STM)
STM works like RAM memory STM provides a working space and is
vulnerable to interruption or interference STM has the ability to retain a limited
capacity of up to 7 pieces of independent information with a single aspect, i.e., actually, 7 +/- 2 “chunks.”7 is called the Millers Magic Number.
Items in STM last from 3 to 20 seconds
14
Factors - STM: “Chunking” “Chunking” allows the brain to
automatically group certain items together, e.g., a telephone number.
We remember phone numbers by their aspects of 2 or more groupings.
We don't really remember "seven" numbers
15
Factors - Long Term Memory (LTM)
LTM defined as relatively permanent storage…ˉ information is stored by meaning and
importance. ˉ Information can be stored for extended
periods of time ˉ capacity limits are unknown
Information moves from STM to LTM
16
Factors - Long Term Memory Information moves from STM to LTM
by ˉ rehearsal ˉ practice …and ˉ use in context.
“LTM stores interrelated networks of mental models of the world that form intricate knowledge structures.”
17
Factors - Long Term Memory (Con’t)
According to Clark (2004):ˉ LTM has a strong influence on perception
through top-down processing…
ˉ Our prior knowledge affects how we perceive sensory information…
ˉ Our expectations regarding a particular sensory experience influence how we interpret it….this is how we develop bias.
18
Factors - Learning According to the Merriam-Webster Online
Dictionary, learning is defined as “ … 2 : knowledge or skill acquired by instruction or study. 3 : modification of a behavioral tendency by experience (as exposure to conditioning) “
The ability to learn is possessed by humans, animals and some machines
19
Factors - Mental Model (MM) (Norman, 1988).
MM is a set of beliefs about how a system works.
Users interact with systems based on their MM. Some properties of MM:
ˉ Enable users to understand the working of a security system.
ˉ Can be built-on-the-fly from knowledge of prior system experience, training, and interaction
ˉ Is unstable and subject to changeˉ Contains minimal information
20
Factors -Human Processors (HP)
Information processing in HP involves (Card, Moran & Newell,1983):ˉ Encoding the information into some form of
internal representationˉ This is related to perception
ˉ Comparing this representation with previously stored representations in the brain
ˉ this is related to attention and memory
ˉ Deciding on appropriate responses; andˉ Organizing a response and necessary action
21
The Information Processing Model
22
Figure 1. The Information Processing Model (Clark, 2004; used with permission). http://www.nwlink.com/~donclark/hrd/learning/memory.html
Models of Human Performance
Models of Human Performance A simple model of human cognition is
empirically developed by Card, Moran, Newell in 1983.
The components are Senses, Sensory store, Short-term memory, Long-term memory, and processors.ˉ Processors cycle time of 50-200msˉ Memories have type, capacity and decay time ˉ See Figure for the Model Summary
23
Human Performance – Summary of empirical study by Card, Moran, Newell in 1983.
Components Function Decay Time CapacitySenses processor- Perceptual
Continuously capture data
Decay: 100ms [50 – 200] ms
unlimited
Senses processor - - Motor
Continuously capture data
Decay: 70ms [30 – 100] ms
unlimited
Senses processor - - Cognitive
Continuously capture data
Decay: 70ms [25– 170] ms
unlimited
Sensor store – Visual Stores most recent input unrecognized
Decay: 200ms [70 - 1000]ms
17 letters of text [7 - 17] letters
Sensor store- AudioStores most recent input unrecognized
Decay: 1500ms [900 - 3500]ms
5 letters of text [4.4-6.6] letters
STM Gets basic recognition from Sensory Store
Decay: 7 seconds [5 - 226] seconds
7 chunks [5 - 9] chunks
LTM Store Episodic & Semantic information
Not estimated Unlimited
24
Importance to Usability of Security Systems
Knowledge of human capability helps:ˉ Predict what users will remember, retain,
understand and use.ˉ Plan on how to make new security related
knowledge and information retained in user’s Long Term Memory during training.
ˉ Use chunking in presentation of security information and codes such as passwords, access codes, etc. to users.
25
Amount of Human Effort Required – Examples PKI
Things PKI end-users have to learn(Sasse & Flechais, 2006):ˉ How to create keysˉ How to import a trust anchorˉ How to import a certificateˉ How to protect private keysˉ How to apply for a certificate
26
Amount of Human Effort and Security – Examples PKI (Con't)
Things PKI end-users have to learn(Sasse & Flechais, 2006):ˉ How to turn on digital signingˉ How to get and import someone’s public keyˉ How to export a certificate
27
Models in Human Computer Interaction (Norman (1988), Cooper (1995) & IBM (1992) )
Designer’s Model: The way the designer represents the application.
Programmer’s Model: The actual way that a system works from a programmer’s perspective.
User’s Mental Modelˉ The way that the user perceives how the
systems works. User model: incorporates the cognitive and
performance characteristics of a user.28
Interaction-Design Model
29
Designer’s Model, User’s Mental Model and System images
Source: http://www.interaction-design.org/encyclopedia/mental_models_glossary.html)
Importance of Mental Models to Usability
For Learning & retaining systems’ operationsˉ Correct mental models => more usable =>
users are effective, efficient, and satisfied
An inaccurate mental model of what is happening in a system leads to errors.
Ideally, interface and system shall be consistent with our mental models about computers, environment and everyday objects.
30
Quick Quiz Why do we have difficulty in remembering some of our
passwords? Where do humans store passwords and how do we
recall them? Explain the role of STM, LTM, and Chunking while using
simple and complex passwords. What are the different tasks to be completed to use a
firewall a) by end-user, b) by system administrator? Compare and contrast user model, mental model,
designer’s model and programmer model. What is the mental model of a user about a firewall?
31
Human Behavior and Security –Risks
People exaggerate risks that are (Schneier, 2007 ) :ˉ Rareˉ Personifiedˉ Beyond their controlˉ Intentional or man-madeˉ Immediateˉ Rapidly occurring
32
Human Behavior and Security – Risks (Con’t)
Users minimize their risk and tend to (West, 2008):ˉ Not think they are at risk ˉ Not give security their full attentionˉ Focus on their goals, such as completing a
task….e.g., completing their on-line paymentˉ Think of security and safety as abstract
concepts resulting in quick decisions without considering all the risks, consequences and options
33
Human Behavior and Security – Risks (Con’t)
Examples of risky behavior: ˉ Opening a file with attachments from
unknown sources where a user does have a great interest in the content of the file from its subject heading
ˉ Download and installation of an ActiveX control from an unknown source in order to view the Web page content
34
Human Behavior and Security - Risks (Con’t)
To improve security behavior, designers and developers of security systems can (West, 2008):ˉ Include a means to reward pro-security behavior,
i.e., notify them of unauthorized attempts to access files
ˉ Improve risk awareness using message alerts and sounds.
ˉ Catch security policy violators using auditing and monitoring techniques
ˉ Reduce the cost by making security systems easy to install, configure and use.
35
Quiz
What are the common attitudes of users with regard to risks associated with computer?
Discuss how users make decisions when they face security challenges.
36
Framework for Studying User Behavior in Security
The Social-cognitive Theory (Bandura, 1986) can be used as a theoretical framework forˉ studying experiences related to security
behavior and ˉ identifying factors that influence user’s
behavior It is based on a reciprocal relationship
between: behavior, cognition and environmental factors
37
Social–Cognitive Theory
38
Figure: Social Cognitive Theory (Bandura, 1986) (Source: http://www.des.emory.edu/mfp/eff.html)
Framework for Studying User Behavior (con’t)
Applying the Theory:ˉ The behavior of users of security systems
depends on the individual’s cognitions and emotions by observing and exploiting the environment (e.g. other co-workers’ behavior).
ˉ It is expected that self-efficacy (belief to execute behavior to achieve an outcome) has strong influence with use of security systems
39
Framework for Studying User Behavior – Social-cognitive Theory
The Social-cognitive Theory also presents:ˉ The possibility of learning from experienceˉ And learning from the behavior of respected
individuals like colleagues and leaders.ˉ Finally, knowledge or information about
security risks is expected to have impact on security related behavior of users.
40
Framework for Studying User Behavior – Social-cognitive Theory
Therefore, to study experience and factors influencing user behavior, a model should consider: ˉ the personal characters of users including:
ˉ cognitive capacity; ˉ socio-demographic factors, ˉ attitudes, beliefs, values, experience, education
and knowledge;
ˉ the environmental factors of users
41
Quiz
What SCT? How can SCT be used in studying the
behavior of Security systems?
42
Takeaway Slides - Summary
Analysts, designers, programmers and system administrators of information security systems need to consider facts about ˉ human capability and ˉ human behavior during their activities.
Security threats can arise from human errors and cognitive limitations during the installation, configuration, use and maintenance of these computer and information security systems
43
Summary - Human Capabilities Demanding too much mental effort by users
in operating the computer equates to less efficiency and more errors.
People often fail to recognize security risks or the information provided to them.
Users are not always capable of performing the right decisions regarding security
ˉ Security mechanisms such as encryption and authorization can be difficult for people to understand or use.
44
Summary -Human Capabilities Factors Key factors are: sensors, attention,
processor/information processing, memory, learning and mental models of users
Humans are multitasking, therefore, few tasks or decisions receive full attention at a given time.
45
Summary Human Capacity - Cognition Model
Human Cognition Model comprised of:ˉ Senses, sensory store, short term
memory, long-term memory and ˉ processors.
Humans have limited capacity for information processing
Empirical model developed by Card, Moran and Newell in 1983 estimated various capabilities, decay times, etc.
46
Summary -Human Capabilities
Security threats can arise from human errors and cognitive limitations during the:ˉ installationˉ configurationˉ use and maintenance of computers and
information security systems.
47
Summary – Chunking Chunking allows the brain to automatically
group certain items together. Human beings have a limited capacity of
remembering up to seven pieces of independent information
ˉ These seven pieces of information are remembered with a single aspect and one exposure. Actually represents 7+/-2 “chunks,” or (7 plus or minus two pieces of information, or between 5 and 9 items)
48
Summary -Human Capability Knowledge
Knowledge of human capability helps:ˉ predict what users will remember, retain,
understand and use.ˉ in understanding how to retain new
security related knowledge and information in user’s Long Term Memory.
ˉ In using “chunking” when presenting security information and codes such as passwords and access codes.
49
Summary - Models
Designer and user mental models of security systems should match
Burden should be on the system designers to build user expectations into the system.
Accurate model lead to effective, efficient and satisfied customers….
Inaccurate models lead to errors.
50
Summary -Human Behavior and Security
Users (West, 2008)ˉ Are not good decision makersˉ Tend to take risksˉ Do not give full attention to security risksˉ Think security and safety are abstract
conceptsˉ Make quick decisions without considering
all of the risks, consequences and options.
51
Summary -Human Behavior and Security
To Improve user security behavior, designers of security systems (West, 2008):ˉ Should create a mechanism to reward pro-
security behavior of users.
ˉ Improve the awareness of risk through
training about risks, using message alerts and sounds with security systems that capture the attention of users.
52
Summary -Human Behavior and Security
To Improve user security behavior, personnel in security systems can (West, 2008):ˉ Catch corporate security policy violators using
auditing and monitoring capabilities of security system and automatic notification of violators using via e-mail.
ˉ Reduce the cost of implementing security by making security systems easy to install, configure and use and/or by employing good secure default settings.
53
Summary -Human Behavior and Security
Applying the Social-cognitive theory (Bandura, 1986), to study the experiences and factors influencing users’ behavior on the use of security systems, a model should consider: ˉ the personal characters of users including
cognitive capacity; socio-demographic factors, attitudes, beliefs, values, experience, education and knowledge; and the environmental factors of users.
54
Discussion Topics Discuss the magic 7 number in the context of
computer and information security. Compare and contrast mental model, design
model and system model. Discuss why mental model is important to
security systems. Determine what Firewall Users Have to Learn
55
References1. Encyclopædia Britannica.2009. Cognition. Accessed on June 26th,2009,
accessed from http://www.britannica.com/EBchecked/topic/124474/cognition
2. Merriam-Webster Online Dictionary.2009. Learning. Accessed on June 26th,2009, accessed from http://www.merriam-webster.com/dictionary/learning
3. Bahn, D. Social Learning Theory: its application in the context of nurse education. Nurse Education Today, 21 (2). 110-117.
4. Bandura, A. Self-efficacy. in Ramachaudran, V.S. ed. Encyclopedia of human behavior, Academic Press, New York, 1994, 71-81.
5. Bandura, A. Social foundations of thought and action: A scoial cognitive theory. Prentice-Hall , Inc., New Jersey, 1986.
6. Benyon, D., Davies, G., Keller, L., Preece, J. and Rogers, Y. A Guide to Usability: Human Factors in Computing. Addison Wesley Publishing Company, Workingham, England, 1993.
56
References7. Card, S.K., Moran, T.P. and Newell, A. The psychology of human-
computer interaction. Lawrence Erlbaum Associates, Inc., Hillsdale, New Jersey, 1983.
8. 2004. Instructional System Design Concept Map. Accessed on January 13,2009, accessed from http://nwlink.com/~donclark/hrd/ahold/isd.html
9. Cooper, A. About Face - The Essentials of User Interface Design. IDG Books Worldwide, Foster City, CA, 1995.
10.Norman, D.A. The psychology of everyday things. Basic Books, New York, 1988.
11. Sasse, A. and Flechais, I. Usable Security. in Cranor, L.F. and Garfinkel, S. eds. Security and Usability: Designing Secure Systems That People Can, O'Reilly Media, California, 2005.
12.Schneier, B. The psychology of security. Commun. ACM 50 (5 ), 128
13.Tversky, A. and Kahneman, D. Rational Choice and the Framing of Decisions. The Journal of Business, 59 (s4). S251.
14.West, R. The psychology of security. Commun. ACM 51 (4 ), 34-4057