Modelling human threats in security ceremonies1

Abstract

Socio-Technical Systems (STSs) combine the operations of technical systems with the choices and intervention of humans, namely the users of the technical systems. Designing such systems is far from trivial due to the interaction of heterogeneous components, including hardware components and software applications, physical elements such as tickets, user interfaces, such as touchscreens and displays, and notably, humans. While the possible security issues about the technical components are well known yet continuously investigated, the focus of this article is on the various levels of threat that human actors may pose, namely, the focus is on security ceremonies. The approach is to formally model human threats systematically and to formally verify whether they can break the security properties of a few running examples: two currently deployed Deposit-Return Systems (DRSs) and a variant that we designed to strengthen them. The two real-world DRSs are found to support security properties differently, and some relevant properties fail, yet our variant is verified to meet all the properties. Our human threat model is distributed and interacting: it formalises all humans as potential threatening users because they can execute rules that encode specific threats in addition to being honest, that is, to follow the prescribed rules of interaction with the technical system; additionally, humans may exchange information or objects directly, hence practically favour each other although no specific form of collusion is prescribed. We start by introducing four different human threat models, and some security properties are found to succumb against the strongest model, the addition of the four. The question then arises on what meaningful combinations of the four would not break the properties. This leads to the definition of a lattice of human threat models and to a general methodology to traverse it by verifying each node against the properties. The methodology is executed on our running example for the sake of demonstration. Our approach thus is modular and extensible to include additional threats, potentially even borrowed from existing works, and, consequently, to the growth of the corresponding lattice. STSs can easily become very complex, hence we deem modularity and extensibility of the human threat model as key factors. The current computer-assisted tool support is put to test but proves to be sufficient.

Perceptions of Beauty in Security Ceremonies

“…In particular, when carrying out a (formal or even semi-formal) analysis of a security ceremony, one should consider also the mistakes that human users may make through their active participation, and that have the potential to lead to violations of the security properties that the ceremony was intended to guarantee. A number of approaches have been proposed to this end, e.g., discussing different threat models of security ceremonies (Sempreboni et al, 2019), providing frameworks for the analysis of security ceremonies (Bella et al, 2022;Carlos et al, 2012), or explicitly modelling and reasoning about human errors in security ceremonies (Basin et al, 2015;Basin et al, 2016;Sempreboni and Viganò, 2020).…”

“…It should be noted that, while formal analysis approaches and tools have advanced to the maturity that allows for the automated analysis of such complex security protocols as TLS 3.1(Blanchet, 2018) and 5G Authentication(Basin et al, 2018), as well as of security ceremonies such as those considered inBasin et al (2016),Bella et al (2022), andSempreboni and Viganò (2020), formal analysis of security protocols and ceremonies in the presence of an active attacker is an undecidable problem, so there is no guarantee that tools will terminate with a proof or a counterexample to the protocol's or ceremony's security. It is thus good practice to complement formal analysis with other approaches such as risk analysis or security assurance approaches (see, e.g., ENISA2022).…”

Six Characters in Search of a Security Problem: Pirandellian Masks for Security Ceremonies

“…Another relevant recent work is seen in [Bella et al 2022a], where the authors propose a formal modelling of human threats imposed on the ceremony using the Tamarin tool [tam 2022].…”

“…They state that the ceremony is directly affected by its users' behaviours, mentioning as an example of this that "a train ticketing system can become insecure if passengers are dishonest and controllers are lazy" [Bella et al 2022a]. More serious scenarios would involve the disclosure of information that was supposed to be kept private by the users of the ceremony, or even the forging of physical elements that aim to exploit the system.…”