Mental Models and Folk Models of Home Computer Security

Theoretical Origins and Definitions of Mental Models

• Mental models are a core industrial concept in Human-Computer Interaction (HCI), as well as psychology and usable security.

• Key researchers associated with the application of mental models in HCI include Don Norman, Rick Wash, and Gene Camp.

• A mental model is a personal, internal understanding of how the world or a specific system works. It is not an objective representation of the world, but a subjective one that individuals use to make decisions.

• Individuals utilize internal simulations of the world based on their mental models whenever they are thinking about an aspect of the physical or digital environment.

• Example: If asked what would happen if a tsunami hit Auckland, an individual runs their internal model of "big waves" against their model of "Auckland" to estimate the consequences.

• A "good" mental model is defined by its ability to support an individual's goals rather than its absolute scientific accuracy.

Depth of Models vs. Functional Utility

• The required sophistication of a mental model depends on the intended task:

  • For general use, such as operating a television, a simple mental model is sufficient.

  • For technical tasks, such as repairing a television, a deep and sophisticated model of the internal mechanics is required.

• A model is considered "bad" specifically when it leads to behavior that results in harm, such as poor security decisions based on inaccurate perceptions of risk.

• Technical expertise is not required for daily function, but when models lead to erroneous security behaviors, interventions are necessary.

The Concept of Folk Models

• Rick Wash defines folk models as informal explanations for how systems work.

• These models are not necessarily scientifically or technically correct, yet they guide everyday decisions and behavior.

• Folk models are shared among members of a culture and are learned through personal experience, observing others, hearing stories, receiving advice, or watching media such as movies and television.

• Security advice is often transmitted between people primarily through storytelling.

• Kempton’s 1986 study on household thermostats serves as a prime example of folk models. Homeowners held technically incorrect beliefs about how thermostats functioned, yet those beliefs consistently guided how they adjusted their home temperatures.

Research Methodology: Wash (2010)

• Rick Wash authored the influential 2010 paper titled "Folk Models of Home Computer Security."

• The research shifted the focus from whether users are "right or wrong" to understanding how they think about security in their own words.

• The study involved qualitative interviews with $33$ non-expert home computer users.

• The interviews were conducted in two rounds between the years $2007$ and $2008$.

• Participants ranged in age from $19$ to over $70$ years old.

• The sample was drawn from three Midwestern US cities.

• Security professionals were explicitly excluded from the study to focus on ordinary user perspectives.

• The goal was not to establish statistical percentages, but to identify in-depth patterns of thinking.

Folk Models of Viruses

• While users often use the term "virus" to describe all forms of malware, they apply four distinct mental models to explain them:

1. Bad Bugs: A simple model where viruses are viewed generically as "bad" without an understanding of their underlying mechanics.

2. Buggy Software: Software that infects a computer specifically when a user downloads or clicks on a suspicious or malicious file.

3. Visible Mischief: Malware characterized by obvious signs of infection, such as pop-up windows, crashing computers, or defaced interfaces.

4. Financial Crime/Theft: Malware that exists solely to steal personal information and facilitate financial crimes.

Folk Models of Hackers

• Wash identified four common ways users conceptualize hackers:

1. Digital Graffiti Artists: Individuals who break into systems for fun, ego, reputation, or the challenge. Users expect these attackers to cause visible damage or leave obvious signs of a breach.

2. Burglars: Individuals who target bank accounts, passwords, and credit card information for clear financial rewards. This is closely associated with identity theft.

3. Big Fish Hunters: Attackers who only target wealthy, powerful, or high-profile individuals. Users with this model believe they are at low risk because they are not "interesting" enough to be targeted.

4. Contractors: Highly skilled individuals working for organized criminal organizations or targeting large businesses. Hacking is viewed here as a professionalized criminal activity rather than a solo act.

The Botnet Problem and Model Failures

• Botnets represent a security threat that typically falls outside all common folk models.

• Folk models fail to account for botnets because they:

  • Often do not damage user files.

  • Remain hidden and invisible to the user.

  • Spread without the obvious user actions that participants expect.

  • Turn the victim's computer into a resource to attack others rather than stealing the victim's own data.

• The technical reality that any internet-connected computer is valuable, regardless of the owner's wealth or status, contradicts the "Big Fish Hunter" and "Burglary" models.

Design and Behavioral Implications

• Security behavior is a direct result of the user's mental model:

  • If a user believes malware steals data silently, they view antivirus software as essential.

  • If a user believes they are only at risk if they click on suspicious files, they may view antivirus as an unnecessary step.

  • If a user expects malware to destroy files, they prioritize backups over other defenses.

• Security education often fails because it tells people "what" to do without addressing the "why" that fits their internal model.

• Proposals for security design suggest that technology should be designed to work with existing folk models, or that systems should help users develop more accurate models.

• Security is frequently a "secondary task" for users. This means they have limited "attentional currency" to spend on learning complex security concepts.

Comparison: Digital vs. Physical Security Models

• There is a significant difference between mental models of digital security and those of physical tasks like driving a car or locking a home.

• Motor Vehicle Models:

  • Most users have a fairly accurate mapping of controls (steering wheel, pedals) to vehicle behavior.

  • Accidents are usually attributed to distractions or the unpredictability of others rather than a fundamental misunderstanding of the human-car interface.

• Physical Home Security:

  • Humans have a tangible, high-level understanding of physical cause-and-effect (e.g., locks and doors).

  • Individuals can easily put themselves in the shoes of an attacker because they understand physical constraints like the size of a window or the function of a key.

• Digital Security:

  • Digital processes are invisible to the average person.

  • There is no physical equivalent to "turning the key" that provides direct feedback.

  • The world of computer security is "alien" and has no immediate physical consequences, making it difficult to bridge the gap between action and effect.

Questions & Discussion

Group Brainstorming on Model Weaknesses and Solutions

• Question: What are the vulnerabilities of the "Generically Bad" virus model and how can it be improved?

• Response: Treating everything as just "bad" leads to unnecessary panic during minor warnings (e.g., a missing website certificate). Scammers can exploit this panic. A solution could be color-coding warnings ($yellow$, $orange$, $red$) based on severity to give users a sense of scale even if they do not understand the underlying technology.

• Question: What are the problems with the "Buggy Software" model?

• Response: Not all viruses are malicious software in the traditional sense. Many threat actors use "living off the land" binaries ($LOLbins$), using legitimate software like PowerShell to run malicious code. Users who only look for "bugs" or "malicious files" will be oblivious to these attacks.

• Question: What are the misconceptions in the "Burglary" or hacker models?

• Response: Users often perceive hacking as a dramatic television event where a person sits at a desk and targets a specific individual. This leads to the false belief that the attacker needs a "good reason" to invest time in a victim. In reality, an attacker can target $1,000,000$ people simultaneously. If an attacker can make $1$ dollar per person, they gain $1,000,000$ dollars with very little investment per individual victim. Explaining the automated, low-cost nature of modern attacks can correct the "I'm not important enough" misconception.

Discussion on Changing Models vs. Accepting Them

• There is a tension between not blaming users for inaccurate models and the necessity of correcting those models for safety.

• Participants generally agreed that we should strive for more accurate models where achievable because subtle differences in threats change how a user should deal with things on their computer.

• However, because there are so many varied mental models, it is difficult to design an interface that accounts for every version of a user's internal understanding.

• Some argue that as long as an analogy (the basis of most folk models) exists, there will be gaps. These gaps are opportunities for security failures. Therefore, models should be simple but accurate.