Unleash the power of your HUMAN potential in the cyber war. Use cyber security tools and techniques that put the human first – not the data.
The power of computers is essential for cyber defense, but the human is often ignored. Should you continue to spend money and time investing in faster computers, better analytic tools, and fancy machine learning software? Perhaps, but you should also consider that the humans are the most important part of the system, and that they can contribute in unique ways.
The Human-Machine Interface or “User Experience”
Machines are built by humans. A computer is a machine. Computers are built to serve humans. Computers are cyber security tools. If this seems like an easy concept, it is. But this concept is sometimes forgotten, especially when humans spend an enormous amount of time and money making sure the computers are healthy. Does this seem backwards?
The concept of human-machine interface is an old one, but difficult to master. Nowadays, the term User Experience (or UX) or User Interface is all-the-rage. The concept is so popular and so important, you can even take a course on UX. The idea is that a computer or system should be built so that it provides a pleasant experience for the user.
For an example of UX, think of a baseball bat. The bat gets skinnier and has a cap at the bottom so it doesn’t slip out of your hand. And it is thicker where you want to hit the baseball. Have you ever played stick-ball, where instead of a bat you just use a stick? A baseball bat has a superior UX compared to a stick. A baseball bat is a baseball tool.
Today, UX is very important with mobile applications. How long does it take to load? Are the buttons easy to press with your thumb? Can you use the app without reading the instruction manual because it is intuitive? Apps live and die by UX. Why? Because the purpose of the App is to serve the human. If it isn’t doing something for the human, it gets deleted. Over the past 10 years, mobile apps have evolved to match the needs of the humans using them. Apps are tools.
Tools should enable the human to do something. So what tools are helping you with cyber security?
What Can Humans Do?
So what can humans do to contribute to cyber defense? This is the wrong (first) question! Remember, tools server humans, not the other way around. The first question is, “what can cyber security tools do to serve humans achieve cyber security?” This question will be addressed in the next section.
But let’s assume that you will, in fact, be using humans in your lineup of cyber defense tools. What can these humans do that machines and software cannot? Here are a few talents we bring to the fight:
Decision Making
First and foremost, humans are excellent decision makers. Humans make decisions nearly every minute of the day, integrating hundreds of data points and drawing upon decades of experience nearly instantaneously! Humans can calculate risks and potential payoffs extremely well.
Why are computers not adept at decision making? Even advanced artificial intelligence systems have trouble making decisions, and when they do it can leave humans puzzled as to why they chose the paths they did. Why? Because machines don’t have the same desired end states as humans. In other words, machines want different things than humans. We can try to teach computers how to consider what humans want, but there will never be a way to do this – especially with the breadth and variety of human desires.
Further reading at CyberDominance.com on
desired end states:
Pattern Recognition
Admittedly, computers can actually be quite adept at pattern recognition. The difference is that their recognition is related to data that can be perceived by computers (or information that can be reliably digitized). Computers are great at finding pictures of dogs in images, for example, but they may not be good at finding pictures that make a particular person angry, and certainly not in finding patterns that would indicate that one person loves or hates another.
I argue, therefore, that while computers can be good at recognizing patterns, humans are good at finding patterns, some of which computers cannot recognize. So humans should be used to recognize patterns.
Physical Interaction
Perhaps most obviously, unless a computer is given a body or a specialized mechanical limb (like in a car factory), it has very little ability to affect the physical world. Similar to the quality of pattern recognition, there are some things that computers with mechanical arms can do that no human can do. But on the whole, humans have an advantage with physical interaction.
Along with this, I believe, is the phenomenon of “muscle memory.” Presumably, a computer can do any action it is programmed to do just as well as any other interaction. Computers are incredibly capable generalists, or perhaps even at a specific action that they are physically built to perform, such as bolting a car door to a car frame. But humans have a link between the things they do repeatedly that are subconscious and natural – which can make us very efficient at tasks that we practice.
Creativity and Problem Solving
The variety of ways humans can be creative and solve problems – two concepts I consider to be identical – is astonishing. Yes, someone has programmed a computer to paint a picture, but really it is the human that imbued the computer with his own creativity and the means by which to implement it.
Humans love solving problems and love being creative. They can think “outside the box” and are truly unlimited in this regard. Computers, however are literally “inside the box” and must always conform the constraints they are given.
Cyber Security Tools of Today
Anti-Virus software
Almost as old at the first computer virus, anti-virus software like McAfee and Norton basically come standard with the purchase of a new computer. These tools have innovated some with regard to User Experience. The good ones will help you understand the most important data first.
Here is a good example of a UX that makes risk very clear to the user, and makes fixing problems easy to implement:
Raw data and technical results always put the human at a disadvantage. A good cyber security tool will avoid times where it has to show you raw data, like in the following image:
Intrusion Detection Systems
What about professional cyber security tools used by professionals that guard big companies and networks? Intrusion Detection Systems (IDS) are designed to alert professionals to cyber intrusions.
Consider two screenshots from an IDS from FireTower. Which would you rather use?
What’s the Problem Here?
If you look at every cyber attack in the past 5-7 years, it was rarely a problem with anti-virus software or Intrusion Detection Systems. They saw the data that passed through them. They saw the attacker. They may have even shown you that data. The problem is that the data wasn’t usable by the human in a way that prevented or mitigated damage from the attack.
Cyber Security Tools of Tomorrow
The concept of anti-virus software and Intrusion Detection systems won’t change; we will always need these cyber security tools. But with the enormous amounts of data passing through these tools and the complex way in which threats emerge, we must continue to invest in adaptations that allow the human to use the tool effectively.
So what will the future be for cyber security tools and techniques?
Blend Man and Machine
Simply put, cyber security tools of the future must harness the advantages of both man and machine, while mitigating their respective shortfalls. Harness Man’s decision making, pattern recognition, physicality, and creativity.
To harness these advantages, we must make great strides in the human-machine interface. What would such strides entail?
Jacob Foster Davis is the founder of CyberDominance.com. He is a systems integrator and jack-of-all-trades. He specializes in leading teams of rivals to solve “impossible” challenges. He’s a former Adjunct Professor of Cyber Security at the U.S. Naval Academy and has a background in complex adaptive systems, space operations, performance arts, military operations, and iOS development.
[…] Understand the information. Data is deceiving. Work to understand what it means. Employ tools to transform data into knowledge. […]