Today there was a news piece about a social engineering scheme whereby a jewelry thief
pretended to be the security alarm company and got the victim to ignore the alarm. This particular instance cost the University of British Columbia some valuable gold pieces and gold artifacts.
While this is a slightly amusing story, it is also a sad commentary on the state of security theory. The point being that people often think of security as external object to that which it protects, an onerous obstacle that stops intruders and annoys legitimate personnel. The jewelry thief played on this way of thinking, as many car thieves do.
How many times, when a car alarm goes off, do you ever investigate to see if the car is being stolen or broken into? Is it ever more than a cursory glance out the window, to see who's overly sensitive alarm was set off by a gust of wind? Typically, the alarm registers as nothing more than a nuisance, and the only attention we pay is in wondering when the alarm will stop. After it stops, the whole issue evaporates from our perception. Problem solved, right?
This way of thinking is often ignored when designing security, and among those it is supposed to protect. The initial response is that we should only sound alarms when there is really and truly an alarming situation. However, game theory suggests that this won't be possible, because all things being equal, if alarms are silent in the future, you stand out by having a loud alarm, leading to the same situation.
In that case, we need to think about why we have the alarms, and who it is we are supposed to be alerting. In many cases, the alarm is to deter the thief. Unfortunately, this only deters unexperienced or unexpecting criminals, as experienced professional thieves will not only expect but ignore the alarm, knowing that those around him will ignore it too. What has happened here is that plural ignorance takes over as a coping mechanism. People assume that someone else will deal with the problem.
This type of group-think mentality results in paralysis while the crime happens right in front of their eyes. Plural ignorance claimed the life of
Kitty Genovese, a New Yorker, who was attacked and stabbed many times over a period of 30 minutes, in front of her neighbors. Nobody answered her pleas for help. When questioned about it, they all assumed that someone else surely would have called the police, but nobody did.
So the result is that the alarm isn't the problem, the people who are exposed to the alarm are. This means that the solution must be derived from behavioral psychology, because it is the behavior of the alarm observers that we want to influence. Behavioral psychology suggests that to break out of plural ignorance, you must single out an individual, and tell them specifically what to do. It would have saved Kitty Genovese's life, and it would have saved the university's artifacts.
The practical application would be an alarm that could sound different types of alarms, and to notify specific people. For example, if the alarm was able to communicate that first there were intruders, then there was a door broken, and then the artifacts were stolen, this would give very specific and contravening indications against the claims of the supposed alarm company.
Of course, the human factor is always fallible, and additional best practices should be applied. The on-site guards must be notified that the alarm is to be considered an autonomous authority, and to ignore the influence of others and independently check on the notices the alarm provides. They must also be trained to understand where authority issues from. If the alarm company has authority, then it must be verified that you are dealing with the authority if they are asking you to do something out of the ordinary. If a police officer asks to enter your home, you should ask to see a police officer's badge and then call the police to see if such an officer exists and that they are at your location. This would be the same as the alarm company having to verify itself to on-site security by producing a codeword for that day.
Such quick and simple checks to verify authenticity of authority are critical. My bank called me the other day and asked me to verify some information to facilitate a transaction. I told them that their actions were quite irregular, and that they would have to verify they indeed were the bank. The woman on the other end of the line was quite surprised, as nobody really ever questioned her about who she represented.
What does all this mean?
1. Alarms should be designed to have informative properties, not just alerting properties.
2. When someone appears to give a command of authority, make sure you can verify they are who they say they are. Those with genuine authority do not bluster at verification attempts.
Software Update: We're going to release a version 2.0.0.14b for users that are having the end loop problem. In a future version of the installer, you'll also be able to select to install xB Machine, and it will update xB VPN if you already have it installed
Posts
