HOWTO use con-games to improve information security

“Understanding scam victims: seven principles for systems security” by Cambridge University’s Frank Stajano and Paul Wilson is an excellent look at the principles involved in “short cons” (confidence games that only take a few minutes to “play”) and how they can be applied to information security. The authors examine the mechanics of scams demonstrated in the BBC show “The Real Hustle” and then extract the principles that drive them and show how they are also used in online ripoffs:

This illustrates something important. Many people feel that they are wise to certain scams or take
steps to protect their property; but, often, these steps don’t go far enough. A con artist can easily answer
people’s concerns or provide all sorts of proof to put minds at ease. In order to protect oneself, it’s
essential to remove all possibility of compromise. There’s no point parking your own car if you then
give the valet your keys. Despite this, the mark felt more secure when, in actual fact, he had made the
hustler’s job easier….

…Much of systems security boils down to “allowing certain principals to perform certain actions on
the system while disallowing anyone else from doing them”; as such, it relies implicitly on some form
of authentication–recognizing which principals should be authorized and which ones shouldn’t. The
lesson for the security engineer is that the security of the whole system often relies on the users also
performing some authentication, and that they may be deceived too, in ways that are qualitatively differ-
ent from those in which computer systems can be deceived. In online banking, for example, the role of
verifier is not just for the web site (which clearly must authenticate its customers): to some extent, the
customers themselves should also authenticate the web site before entering their credentials, otherwise
they might be phished. However it is not enough just to make it “technically possible”18 : it must also be
humanly doable by non-techies. How many banking customers check (or even understand the meaning
of) the https padlock?19

Understanding scam victims: seven principles for systems security

(via Schneier)