Learning Log 4

They say that the human mind is the most complex computing device in the world (although that analogy is simply not true, since a brain isn’t really a computer as a certain article says that a brain does not process information as opposed to a computer). A three-gigahertz processor asks for directions on what to do three billion times per second, seems like a lot, then add the fact that a single computer nowadays require more than one of these processors. It almost seems insurmountable, until the brain comes in. The brain with its nuances, its folds, its ability to simply do the irrational, easily surmounting these processors. Were we to rank these processors (although the article attribute to above says that the brain does not process info), the brain would always come out on top.

Ironically enough, in a security infrastructure, the brain, and the human who owns it, is the system’s greatest vulnerability.

Unfortunately, the thing that makes us humans – irrationality, from which imagination stems – is the source of this weakness.

People have been exploiting this weakness from time immemorial (e.g. con men). In the case of security, these people are exploited, banking on a person’s emotions to overtake logical thought.

How is this done? People gather information about this person. In most cases, a significant degree of the person’s trust is gained through clever manipulation. Some people gather info through garbage data (dumpster diving), while a rather funny case where a person was given a cause for alarm caused her to simply give important credentials signifies that sometimes a simple injection of emotion can supersede rational thought.

This is social engineering, a method used by a lot of people as a means to various ends. It has been shown to be particularly costly.

It makes me rather paranoid though. What if someone gains implicit information by simply looking at my wittybuny.com and buzzfeed.com test results. I mean, in this test it said that if I were cheese, I’d be gorgonzola! Can social engineers get something useful out of that?