Arun Vishwanath, Ph.D., MBA
Associate Professor
http://arunvishwanath.us

I study how hackers, cyber terrorists,
hactivists enter networks…

I study…
I study how hackers, cyber terrorists, hactivists enterand compromise networks
The proverbial “people problem” of cyber security

Unintentional Insiders
Brute Force
Hacking

Spear phishing
HABITS

Organizational
Email Provider

COGN
IT
PROC IVEESSINGPERSONALITYEMPLOYEEDEFENDEDUNSECURED INTERACTION

External
Email Provider

VULNERABLE

Data breaches keep getting bigger…

Source: http://www.informationisbeautiful.net/
visualizations/worlds-biggest-data-breacheshacks/

Spear phishing is theattack vector ofchoiceImpacted every industry

Perpetrated by State and Nonstate Sponsors

YOU ARE THE
WEAKEST LINKIN CYBERSPACEApproaches to dealing withthe “people problem”
Firewalls, antivirus; Whitelisting approaches

EMET; Constrain access/admin privileges

How realistic is this…

Human factors approach: Cyber
security training
1.

“Phish” people simulations

2.

Show them why they fell
for it3.

Keep telling them to shapeup

4.

Admiral Mike Rogers: “Weshould court-martialthem!”The PEOPLE PROBLEM
The Problem is NOT the People

It is in our UNDERSTANDING of PEOPLE

We Have developed a human factors model that
explains how people think, act, behave online, andwhy.

Suspicion, Cognition, Automaticity Model(SCAM)(Vishwanath, Harrison, & Ng, 2016)

SCAM explains how users
think:

Scrooge: I
am a
cognitivemiser

I use cognitive
shortcuts a.k.a
Heuristics

Heuristics

SCAM explains what users
believe:

Cyber Risk Beliefs
WHAT IS SAFER:••••••

PDF vs. Word Document
OSX vs. Windows
iOS vs. AndroidChrome vs. Safari
Google Fiber vs. Free wi-ﬁ
Browser based email access vs.
using an email client

SCAM explains the role ofhabits and devices

Habits
Ritualistically checking
email
Texting while talking,walking, driving
Entering login, password,authentication credentials

Smartphones, smart watches…
not so smart people
Thanks Apple and Google!

Suspicion, Cognition, Automaticity Model (SCAM) (Vishwanath, Harrison, & Ng, 2014)

Heuristic
Processing
Suspicion

Cyber Risk
Beliefs

Victimization

Systematicprocessing

Personality,
Work Routines,
Patterns

Work/EmailHabits© Arun VishwanathLeveraging theunderstanding ofpeople

Develop a Cyber Risk
Index (CRI)
An empirical data driven approach

Uses a short, 40 question self-report survey

Can be done within existing “red-team” simulations

Like credit rating, it can we aggregated across division,organizations, sectors© Arun Vishwanath

Deciding who gets trained
and how:
faultyCyber risk
beliefs

Yes

BeliefChange

No
poor

Yes

Heuristics

Better
Heuristics

No

Systematic
processing

inadequate

Yes

EducationNo
badHabits

Yes
NoHabit
Change© Arun Vishwanath

Deciding who gets
access:Current system of providing access is based onorganizational role and status

Use CRI to identify individual risk levels and changes
in risk behavior overtime

This becomes a quantitative score of INDIVIDUALCYBER HYGIENE© Arun VishwanathReferences to publishedresearch and writings:
Selected Academic Research

Selected pieces in CNN

Vishwanath, A., Harrison, B., & Ng,Y.J. (2016). Suspicion, Cognition,
Automaticity Model (SCAM) ofPhishing Susceptibility.
Communication Research.

Why the cyberattacks keep
coming:http://www.cnn.com/2015/06/08/
opinions/vishwanath-stoppinghacking/Vishwanath, A. 2016). Mobile Device
Aﬀordance: Explicating How
Smartphones Inﬂuence The
Outcome Of Phishing Attacks.
Computers in Human Behavior.

Why we need a cyber wall:
http://www.cnn.com/2016/05/02/
opinions/build-cyber-wallvishwanath/index.html

Vishwanath, A. (2015). Habitual
Facebook Use and its Impact on
Getting Deceived on Social Media.
Journal of Computer-MediatedCommunication, 20(1), 83-98.

When hackers turn your lights oﬀ:
http://www.cnn.com/2016/02/11/
opinions/cyber-infrastructureattacks-vishwanath/Contact Information
Arun Vishwanath, Ph.D., MBA
Email: avishy001@gmail.com
Web: http://arunvishwanath.us
Mobile: 716.508.0192