Human Element of Cybersecurity - A Hard Case

By no means the articles in this site have tackled or discussed deeper or technical aspects of cybersecurity simply because it is not its primary purpose. As you can read in our side panel, our purpose and goal for this is:

Dedicated to providing Filipinos general information about online & offline security practices and how to better protect their data & privacy.

As you can clearly read, we simply aimed at providing general information to the public, specifically our fellow Filipinos. In short, our goal was to partly address the human element of cybersecurity or information security. We approached this by deliberately/consciously NOT using technical terms in our writing, avoiding lingo specific to a work culture, and keeping it generally understandable.

There's an old hyped web app in social media, Facebook in this instance, happening here in PH that once again gained attention among the general public. It's the type of web app that with a person's selfie/portrait and social media permission/access it claims:

• it can detect a person's age
• it can assess which actor a person looks like in certain nationality and morph the face to prove its merit
• it can assess which country a person is best suited to live in
• it can calculate if a person is pretty or not
• it can analyze who visited a person's social media profile the most
• it can provide a breakdown of a person's qualities by providing social media profile and data access

plus a lot more similar claim. Sadly, most readers simply shrug off its claim and say its for fun. And for those who know what they really are doing, it might be ok. One major problem is that it requires a good deal of data access permission on a person's social media account. To any security conscious person, that is a red flag. Additionally, most of us know only a few people really do try to utilize a social media's privacy to minimize any exposure of its data to the general public or third-party apps even if the information if provided by the social media itself or someone writes a how-to about it. Even so, we know its relatively easy to join or aggregate data from different sites to complete a profile of an individual.

This type of app has many layout, design, question, presentation, and website that integrates with Facebook. Identifying one of them is useless. We approached the issue by describing the problem with the data access permission it is asking and highlighting that dangers it poses when people have freely given the app (and the people behind the app) their photo or biometric data. We also included information that banks here in PH are already in the test phases of using mobile device based biometrics to unlock mobile app and grant the unlocked app permission to manage financial control on the account.

We know that people somehow also want to inform friends and families because our post was shared to a good amount of people. It's not hard to see that as of posting time since we only have less than 30 posts. It was easy to track to which article is getting shared often at this time through Blogger and Google's Analytics platform. It was getting between 40-80 hits per hour. With a bounce rate of 3% from the Social channel which constituted 92.4% of the source of readership having an average time of 45 seconds reading the article.

The readers despite reading the warning and being provided with a course of action, are not following through it. They spent a good minute of reading but completely disregard what to do given the situation they are in or how to prevent it in the future.

Screen Shot 2017-04-09 at 1.38.29 PM

The screenshot you see above is the analytics data on 2017-04-09 at 1.38.29 PM. The course of action articles in the post warning people about the data prefetching/profiling by third party are items 2 and 4. There is definitely a huge gap of reads or views for the suggested course of action.

We can say that addressing the Human Element of Cybersecurity is definitely a hard case. While this confirms that issue, we are taking it as challenge on how to write articles that would entice users to act on the suggested course of action. And if you have any ideas how else we can bridge this gap or address human elements to further improve cyber security, do send us a trackback, ping, email, or a comment. We'd love to hear from you.