Why do we Click?
I hope everyone had a great weekend and holiday for those in the U.S. We had a relatively queit weekend so I thought I would follow up with a question from SANSFire. It's a little less computer techie.
Introduction
SANSFIRE 2013 I did a talk about understanding online news and decided to follow up on a question. In this discussion there were many talking points but the question of “Why do we click” came up. There is no real complete “Technical” answer but I will cover some factors. First, it is pretty much well known and accepted that when you are tired you can make mistakes. There was a meta-analysis done studying self-control and they discuss other factors that might be contributors to "the click factor." Things like, diet, stress, and difficulty of current task could be contributors to reduced self-control (Hagger, Wood, Stiff, Chatzisarantis, 2010).
Details
What came out of this was a simple idea that might help. So simple we will likely ignore it :) There is usually not a good reason to check email at midnight, let alone 2AM [depending upon your sleep schedule of course].
To recap:
- When you are tired you might make mistakes.
- When you are stressed and tired you are even more likely to make mistakes.
- When you are stressed, hungry, and tired + + +
Personally, I consider all of our readers cynical by nature and somewhat suspicious, it's what we do right? What about your <Insert_non_techie_Here> person? In my experience Sales Account Managers are a great stereotype to pick on! I know one CIO that use the sales staff as mobile honeypots/malware collection points. That said, how many of us have seen a huge deluge of email from Account Rep A that was sent between Midnight and 1AM? Speculating on the scenario, perhaps hotel room, end of quarter, chasing the deal, etc… We can somewhat safely assume that individual is both tired and stressed. Another relatively safe component to the scenario is diet as the individual has probably been eating in hotels and restaurants for days. There is a limit to the amount of self-control a person has (Baumeister, Bratslavsky, Muraven, Tice, 1998).
All those people related issues can directly contribute to something we consider a security related problem. We often talk about, mostly in jest, OSI Layers 8+. Perhaps it is time to have some real discussions on things we as security operators can be aware of.
Conclusion
In closing, why do we just click on things? Not sure, but I know that it is a people issue and am starting to understand some factors. In our industry it's about mitigating risk factors.
It would probably never fly but idea? Based on time zone, suggest professionals minimize emails to N working hours? 6AM to 10PM maybe?
References
Baumeister, R. F., Bratslavsky, E., Muraven, M., & Tice, D. M. (1998). Ego depletion: Is the active self a limited resource? Journal of Personality and Social Psychology, 74(5), 1252-1265. doi:10.1037/0022-3514.74.5.1252
Hagger, M. S., Wood, C., Stiff, C., & Chatzisarantis, N. L. D. (2010). Ego depletion and the strength model of self-control: A meta-analysis. Psychological Bulletin, 136(4), 495 - 525. doi:10.1037/a0019486
Keywords: social engineering
14 comment(s)
×
Diary Archives
Comments
Jokes aside, I've always thought that MS Outlook should be renamed to: MS Lookout.
Jack
Jul 8th 2013
1 decade ago
Your statement, "I know one CIO that use the sales staff as mobile honeypots/malware collection points." just made it into my quote-of-the-moment file! ;-)
Moriah
Jul 8th 2013
1 decade ago
Those three point also apply if you are in the middle of an implementation or recovery project.
KBR
Jul 8th 2013
1 decade ago
Has anyone considered simply removing links from emails as a corporate policy, and more importantly, did it work?
The solution might be to only allow and use plain text (no hyperlinks) emails while still allowing attachments.
Jack
Jul 8th 2013
1 decade ago
Getting an email from 'Yulia' with a subject line, "I'm one in a million" means you don't need to be a rocket scientist to know to delete, but you never can tell!
As for our beloved Outlook users, WHY do they have to PREVIEW messages? You can train them not to, then they get lazy and open them anyway without much thought. You can suggest having 'text' only mail and then they complain they can't see all the images!
Perhaps tired admins need the help of the mining industries Fatigue Detection Technology, so as we doze off, emails are auto-displayed with header detail only in flashing colours and a loud robotic voice 'you've been p0wnd!'
No easy answers I guess, unless the detection tools become foolproof.
nic
Jul 8th 2013
1 decade ago
Just sayin'.
Jack
Jul 8th 2013
1 decade ago
For me, it is understand that people are likely not going to change. We can make them more aware but things will happen. Understanding why it happens is my first step in understanding if there is a solution and how.
~Richard
Richard
Jul 8th 2013
1 decade ago
On a slightly related subject, I've been tempted to schedule a re-scan or virus scan of mailboxes just before the start of the business day; you may be able to retroactively quarantine mails that were not known to blacklists or AV signatures at the time they were received, but maybe in time to stop people opening them. A batch job can also afford more extensive testing than would be viable for a real-time scanner during peak times.
Steven Chamberlain
Jul 9th 2013
1 decade ago
JRD
Jul 9th 2013
1 decade ago
The CDC.gov (U.S.) site is packed with good information. http://www.cdc.gov/nutrition/everyone/fruitsvegetables/. I don't think if you eat a salad you are going to turn into a genius, but I do think that more vegetables can contribute to better cognitive function and reduced stress.
It may seem odd that we are discussing diet as a security topic but I ask, is it so odd? The above diary was about a trend that i don't think will change.
@Steven Chamberlain, I like the idea of kicking of a pro-active mailbox scan just before working hours. I would say definitely prior to the start from a long weekend or holiday as well?
~Richard
== References ==
Ghalami, J., Zardooz, H., Rostamkhani, F., Farrokhi, B., & Hedayati, M. (2013). Glucose-stimulated insulin secretion: effects of high-fat diet and acute stress. Journal Of Endocrinological Investigation,
Shenoy, S., Kazaks, A., Holt, R., Chen, H., Winters, B., Khoo, C., & ... Keen, C. (2010). The use of a commercial vegetable juice as a practical means to increase vegetable intake: a randomized controlled trial. Nutrition Journal, 938. doi:10.1186/1475-2891-9-38
Richard
Jul 9th 2013
1 decade ago