SafeMind

A Framework for Evaluating and Patching
the Human Factor in Cybersecurity
Ron Bitton
Principal Research Manager
Cyber Security Research CentreBen Gurion University of the Negev

Phishing

1. Social engineering
attacks goes beyond
phishing
2. Social engineering
attacks are no longer
limited to PCs.

PortableMedia

Passwords
Cracking

Drive-bydownloadSocialEngineering

Client-side
Scripts

Permission
Abuse

TrojanApplications
Certificates
Abuse

Social engineering attacks have changed in recent years.

Smartphones

Social Networks

1. Social engineering
attacks goes beyond
phishing
2. Social engineering
attacks are no longerlimited to PCs.

Social engineering attacks have changed in recent years.

1. Social engineering
attacks goes beyond
phishing
2. Social engineering
attacks are no longer
limited to PCs.

The skills needed by a user tomitigate different types of attacks
are not the same.

Social engineering attacks have changed in recent years.

1. Social engineering
attacks goes beyond
phishing
2. Social engineering
attacks are no longer
limited to PCs.

Despite those changes, mostexisting solutions do not
distinguish between different typesof attacks and platforms.

Social engineering attacks have changed in recent years.

Evaluation

Mitigation

Self-Reported Measures

Attack Simulations

Training Workshops

Reducing attack surface

Interviews, surveys
and questionnaires

Simulated phishingattacks.

Security awarenesstraining workshops

Email protection,
System hardening,
Browser isolation

Existing solutions for evaluating and patching the humanfactor in cybersecurity

§ Based on self reported measures.

§ Require the subjects’ active involvement and collaboration.

Interviews, surveys and questionnaires§ Based on self reported measures.
Tend to be subjective and biased.
§ Require the subjects’ active involvement and collaboration.
Consuming significant human resources and therefore areless scalable and cannot be performed continuously.

Interviews, surveys and questionnaires

§ Measure the momentary behavior of subjects during specific event.

§ Limited to phishing.

Attack simulations

§ Measure the momentary behavior of subjects during specific event.
Sensitive to environmental and contextual factors andtherefore can be very biased.
Cannot be used to evaluate the ISA of users continuously.
§ Limited to phishing.
Cannot be used to evaluate the ISA of users to different
attack vector.

Attack simulations§ Usually performed using videos, games and posters in a controlled
training environment.

Security awareness training workshops

§ Usually performed using videos, games and posters in a controlled
training environment.
Does not necessary reflects the behavior of users intheir natural environment.
Low user engagement to the process of learning
People tend to learn the most from critiques on their own
behavior, rather than generic training programs.

Security awareness training workshops§ Prevents specific exploitation techniques but leaves the vulnerability
unpatched.

§ Mostly limited to specific environments (e.g., a user’s workingenvironment)

Email protection, System hardening and
Browser isolation§ Prevents specific exploitation techniques but leaves the vulnerability
unpatched.
The attacker can exploit the vulnerability using otherexploitation techniques, which are not covered by thecountermeasure.
§ Mostly limited to specific environments (e.g., a user’s workingenvironment)
Cannot be used to protect the user in other environments(e.g., when working from home).

Email protection, System hardening and
Browser isolation

An automated andframework forcontinuously andobjectively evaluating theresilience of users tospecific types of social
engineering attacks.

SafeMind

SafeMind

The critical success factors in the development of
SafeMind
1ANALYZE

What are the criteria for a security aware user?
What are the importance of different criteria in
mitigating different types of attacks?

2

MONITOR

Given a user, how we evaluate those criteria
continuously, and objectively?

3

TRAIN

Given a vulnerable user, how we make abehavioral change that will last long

010203

04

05

Exploring social
engineering attack
case studies

Identifying thetechnologies thatare compromisedby the attacker

Enumerating thecountermeasuresthat can be used
to protect thesetechnologies

Identifying thehuman factor
vulnerabilities thatare exploited by
the attacker

Formulating thecriteria required
from a user tomitigate theattack.

Defining the criteria for a security aware user

The criteria for a security aware user
Application

Browsingü Download apps
solely from trusted
sources.
ü Does not install appsthat require
dangerous
permissions.
ü Does not install apps
with a low rating.
ü Rarely installs appsthat require root
privileges.
ü Regularly updateapps.
ü Rarely clicks onadvertisements.
ü Properly manages
running/installedapps.
ü Does not install
unsingedapplications

ü Does not entermalicious domains
and operates inaccordance withsecurity alerts.
ü Prefer to use HTTPS
sites.
ü Prefers to download
files via HTTPS.
ü Does not send
sensitive
information viaHTTP.
ü Does not insert
private information
into popups oradvertisement cites.
ü Deletes unknowncertificates.
ü Does not use
untrustedcertificates.

VirtualCommunication
ü Does not openemails/messages
received fromunknown sendersü Does not open
emails classified asspam.
ü Does not executeattachments
received fromunknown senders.
ü Does not click on
URL’s received fromunknown senders.

Virtual Accounts

Safeguards

Physical Channels

ü Updates passwords
regularly.
ü Use unguessableand diverse
passwords.
ü Does not store
passwords unsafely.
ü Uses two-factor
authentication
mechanisms.
ü Uses password
management
services.

ü Uses embedded
security systems.
ü Uses antivirus
application.
ü Updates securitysystems.
ü Operates inaccordance withsecurity alerts (i.e.,does not ignore
security alerts).
ü Uses PINcode/pattern/fingerprint.

ü Does not connect tounencrypted Wi-Finetworks
ü Does not download
files on unencrypted
Wi-Fi networks.
ü Uses VPN services.
ü Does not transmit
private data via
unencryptedchannels.
ü Enables Bluetooth,Wi-Fi, NFC, and GPS
only while they arein use.
ü Connects trusted
Bluetooth and NFC
devices.
ü Does not connect
unknown media toyour device.

Deriving the importance of different criteria
in mitigating different types of attacksThe different awareness models
Application Installation
1
Phyisical Channels

Application Installation
1
Phyisical Channels
0.8
Network

Application Handling

0.8
Network

0.6

0.6Browser

Browser

0.4

0.4

0.2

0.2

00

Security Systems

Security Systems

Data Privacy
Operating System

Application Handling

Data Privacy
Account
Operating System

Account

Virtual Communication
Virtual Communication

Man-in-the-middle Attacks

Phishing Attacks

Application-based attack

Password-based attacks

B1
1

B11

Browser Technologies

0.6

B10

• B4 – Does not send sensitive info
via HTTP• B7 – Does not insert private info onunvalidated websites• B6 – Deletes unknown certificatesfrom the device• B8 – Does not approve unknowncertificates• B9 – Does not ignore security
alerts

B20.8

B30.4
0.20B9B4

B8B5
B7Man-in-the-middle Attacks

B6Phishing Attacks

The critical success factors in the development ofSafeMind
1ANALYZE

What are the criteria for a security aware user?
What are the importance of different criteria in
mitigating different types of attacks?

2MONITOR

Given a user, how we evaluate those criteria
continuously, and objectively?

3TRAIN

Given a vulnerable user, how we make abehavioral change that will last long

Given a user how
can we evaluate
those criteria?

EndpointSolutions

Network-based
Solution

AttackSimulations

Information extracted using the endpoint solution
Connectivity
Management
PhysicalChannels

Mail Activity

Certificate
Management
Installed
Applications

Password
Management

Security
Settings
SMS

SocialNetworkActivity

Information extracted using the network solution
Application Level Protocols

Deep Packet Inspection• Detecting OS update version• Certificate handling• Detecting personal informationtransmitted in plaintext• Detecting unencrypted file downloads

Domain Categorization• Detecting installed applications• Detecting malicious websites• Detecting pop-ups and ad clicks• Detecting uses of security countermeasures• Detecting downloads from untrusted stores

Attack simulations
Smartphones

PC

Social Networks

Short Demo – Application Phishing Simulation

Operator’s Dashboard

Emploee’s Smartphone§ A long-term experiment involving 162 subjects, for aduration of seven weeks.
§ During the experiment we:Ø Monitored the network traffic of the subjects.
Ø Measured their behavior while operating theirsmartphone and PC.
Ø Asked them to answer the security questionnaire.
Ø Exposed the subjects to four social engineering attacks.

Evaluation Method

Results§ The self-reported behavior of subjects might differ significantly fromtheir actual behavior.
§ Security awareness scores derived from data collected by endpoint
and network-based solutions are highly correlated with the users’
success in mitigating social engineering attacks.

Conclusions

Thank you!
Ron Bitton
Principal Research Manager
Cyber Security Research Centreat Ben Gurion University of theNegev

This talk was partially based on the following two academic papers:[1] Ron Bitton, Andrey Finkelshtein, Lior Sidi, Rami Puzis, Lior Rokach, Asaf Shabtai:
Taxonomy of mobile users' security awareness. Computers & Security 73: 266-293 (2018).
[2] Ron Bitton, Kobi Boymgold, Rami Puzis, Asaf Shabtai:
Evaluating the Information Security Awareness of Smartphone Users. 2020 CHI Conference on
Human Factors in Computing Systems.

Kobi Boymgold

Andrey Finkelsthein

Lior Sidi

Security Researcher
Cyber Security Research Centreat Ben Gurion University of theNegev

Data Scientist & Security
Researcher at IBM

Data Scientist & MachineLearning Entrepreneur
Cyber Security Research Centre
at Ben Gurion University of theNegev

Asaf Shabtai

Rami Puzis

Lior Rokach

Associate Professor
Cyber Security Research Centre
at Ben Gurion University of theNegev

Assistant Professor
Cyber Security Research Centre
at Ben Gurion University of theNegev

Full Professor
Cyber Security Research Centre
at Ben Gurion University of theNegev