Maybe Users Aren't So Funny After All

Computerworld — I can't stop thinking about my experience last month when I had to reload Windows XP for a friend. It makes me think we need to reconsider how we in the security world have failed the consumer. Should it really be necessary for a consumer to be a security expert to safely use a computer?

That seems to be our message. "You should have known not to click that link," we say. "Why would you trust that that e-mail actually came from your mother?" We get disgusted that users keep falling for old tricks. But what are we doing to actually help these people?

We should start by better understanding the misconceptions about e-mail and Web site safety that pervade the user base. For example:

* If an e-mail looks authentic, it is safe. We seem to believe that every user should be as jaded as we are. After all, spam mail, phishing attacks and all the rest have been around for years, right? We techies aren't surprised when the attacks appear to be legitimate emails. Why do users not suspect everything the way we do? We expect deception in cyberspace to be as common as it is in nature. But we shouldn't forget that a suspicious nature, so beneficial in our profession, isn't necessarily helpful to the work our users do. Instead, we are surprised -- indeed, amused -- when our well-intended users respond to an attack. And yet, really, when one of my family members last week got caught up in the wave of fake Amazon cancellation notices, what did he do that was so wrong? He responded to a message that looked legit to him, especially since he had just placed an order with Amazon.

* This e-mail came from someone I know, so I know it's safe. Again, as security pros, we are aghast that anyone could not be aware that spammers and other e-mail attackers have for years been sending out their attacks with forged "From:" addresses. We understand the mechanisms that allow the bad guys to pose as our friends. And even my friends and family members who are not very computer savvy realize that I would not contact them trying to sell black-market Viagra. But sometimes the sender and the message converge, as they did for the family member who had just placed an order on Amazon, and so they respond. "How could that e-mail not be from Aunt Lucy?" they want to know. I always tell them that e-mail messages, like postal envelopes, can be trivially made to contain any "From:" address the sender chooses to use.

Continue Reading