Flawed Mental Models Lead to Bad Cyber Security Decisions.pdf

POSTER: Flawed Mental Models Lead to Bad Cyber Security Decisions: Let's Do a Better Job!

PRESENTER: Sean Smith, Dartmouth College

ABSTRACT:
Many security problems arise from flawed mental models of general users and security folks or flawed representations in systems. This poster focuses on our recent work that utilizes semiotics to better understand and classify existing security problems. We contend that many security problems can be thought of as mismorphisms, mappings that fail to preserve structure. A semiotic model for mismorphisms is provided, classes of mismorphisms are discussed, and examples from these classes are provided. Future work aimed at using this model to deliver real-world security solutions is also discussed.

CO-PRESENTER(S):
Ross Koppel, Jim Blythe

KEYWORDS:
cybersecurity, models, cybersecurity models, semiotics, mismorphisms

PRESENTER BIO:
Professor Sean Smith has been working in information security---attacks and defenses, for industry and government---since before there was a Web. In graduate school, he worked with the US Postal Inspection Service on postal meter fraud; as a post-doc and staff member at Los Alamos National Laboratory, he performed security reviews, designs, analyses, and briefings for a wide variety of public-sector clients; at IBM T.J. Watson Research Center, he designed the security architecture for (and helped code and test) the IBM 4758 secure coprocessor, and then led the formal modeling and verification work that earned it the world's first FIPS 140-1 Level 4 security validation.
     In July 2000, Sean left IBM for Dartmouth, since he was convinced that the academic education and research environment is a better venue for changing the world. His current work, as PI of the Dartmouth Trust Lab and Director of Dartmouth's Institute for Security, Technology, and Society investigates how to build trustworthy systems in the real world.
     At Dartmouth, many of his courses have been named "favorite classes" by graduating seniors. His book Trusted Computing Platforms: Design and Applications (Springer, 2005) provides a deeper presentation of this research journey; his book The Craft of System Security (Addison-Wesley, 2007) resulted from the educational journey.
     Sean has published over one hundred refereed papers; been granted over a dozen patents; and advised over three dozen Ph.D., M.S., and senior honors theses. He and his students have won several "Best Paper" awards.