Human brains not wired for modern IT security

Powered by SC Magazine
 

The neocortex is 'still in beta', says security expert.

Security expert Bruce Schneier told delegates at the Black Hat USA 2009 conference that the human brain is not suited to IT security in the modern world.

Schneier said in his address that, in evolutionary terms, the human brain cannot deal with the complex threats that dog the modern environment, and that computer security is unlikely to be solved in our lifetime.

"We have Stone Age brains. We respond to stories not data," he said. "We are very good at living in small family groups in the East African highlands, but we do not have a lot of experience in the modern world."

Schneier suggested that this had a direct relevance to computer security in that humans tend to think along narrative rather than empirical lines. For example, having a firewall is perceived as a great protector of a computer, but in fact a poorly-configured firewall is worse than useless.

He also cited biometrics and airport security as cases in point, where seemingly good security measures are actually counter-productive.

There are two key parts of the brain that respond to stress. The amygdala, which is one of the oldest parts of the brain stem, deals with the 'fight or flight' reflex. This is present in ancestors as far back as fish.

But advanced mammals have the neocortex, which makes people think rationally about the potential risks. This is how humans mitigate risks and rewards.

"This only exists in mammals. It is the newest part of the brain, kind of still in beta testing," said Schneier, giving the example of someone getting a dressing down from their boss and not feeling inclined to stab the person or run away.

However, this logical reasoning comes with certain costs, and raises interesting questions from a security standpoint.

Humans are story-telling creatures, Schneier explained, and good stories capture our interest despite the fact that they may be factually harmful. This tendency in humans will make security a hard goal to reach.

Copyright ©v3.co.uk


Human brains not wired for modern IT security
 
 
 
Top Stories
Photos: iTnews Benchmark Awards countdown begins
Just a few days left until entries close for 2014.
 
Australian Govt to rethink cyber security strategy
Six-year old policy to be refreshed.
 
The failure of the antivirus industry
[Blog post] Insights from AVAR 2014.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  38%
 
Your insurance company
  3%
 
A technology company (Google, Facebook et al)
  8%
 
Your telco, ISP or utility
  7%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  20%
 
An Australian law enforcement agency (AFP, ASIO et al)
  15%
 
A State Government agency (Health dept, etc)
  5%
TOTAL VOTES: 1037

Vote