Bridging the Gap in Computer Security Warnings

Flashcards covering the methodology, frameworks, and key findings of the 2010 CMU study on computer security warnings and the differences between novice and expert mental models.

Bridging the gap in computer security warnings

The title of a 2010 research paper from Carnegie Mellon University (CMU) that examines why users treat security alerts as background noise and seeks to improve warnings via mental models.

First line of defense (Safety Engineering)

The practice of designing out the hazard entirely, such as repairing a broken sidewalk so a sign is no longer needed.

Second line of defense (Safety Engineering)

Guarding against a risk when it cannot be designed out, such as putting a barricade around a hole or using software to automatically remove phishing links.

Third line of defense (Safety Engineering)

Providing a warning to users; this is treated as a last resort when a risk cannot be designed out or guarded against.

Human in the loop model

An engineering model used to analyze the communication process by treating the human as a system component to identify breaks in the chain, like attention or comprehension failures.

Communication human information processing model

A psychological framework describing a linear sequence of stages for warning effectiveness: attention, comprehension, and application.

Availability heuristic

A cognitive bias where novice users tend to relate almost every security warning they encounter to a virus.

Mental Path Stages

The multi-stage process mapped in the study: Observe (cues), Judge and Decide (diagnose the problem), Act (perform action), and Outcome (safe or unsafe results).

Information deletion or loss

One of four warning categories used in the study, typically represented by disk-based alerts.

Information disclosure

One of four warning categories used in the study, involving events like email encryption or address book access.

Execution of malicious code

One of four warning categories used in the study, involving events like opening email attachments.

Trust in third parties

One of four warning categories used in the study, involving security elements like SSL certificates.

Novice 'Open and Save' misconception

The belief held by some users that 'opening' a file is safer than 'saving' it because they perceive 'opening' as a non-executable preview.

Semi-structured interview

The methodology used in the study involving $30$ participants where four standard questions were asked, followed by open-ended follow-up based on observations.

SSL Certificate confusion

A finding where $16$ out of $20$ novices failed to understand SSL certificates, typically attributing the warnings to viruses instead.

Self-signed certificate

A certificate not trusted by the operating system that may indicate either a misconfiguration or an attacker intercepting a connection.

Bayesian's belief network

An approach suggested in the paper's conclusion to automatically estimate the probability of different possible security risks.

A priori simulation

The ability of advanced users to internally simulate the consequences of an action before performing it, unlike novices who often 'run and see what happens.'