Ross Anderson and Frank Stajano, in a paper called “It’s the Anthropology Stupid!“, suggest that the study of human culture is necessary to understand insecure behavior and protect virtualization from risk.
And what about mistakes? They matter much more than targeted attacks. […] Mistakes are often caused by getting the context wrong, so if we’re going to make them less likely, our designs should be better at synchronising the user’s mental model better with that of the machine. […] …secure virtualisation isn’t just about ensuring that the right VM in the laptop talks to the right VM in the cloud. It’s about ensuring that the right VM in the laptop (or the cloud) talks to the right VM in the user’s brain. It’s not primarily about the outside attacker, but the insider: and the critical question is which insider.
The point they’re making is that each group and subgroup is defined by its controls. Have you ever shown up to a party wearing the wrong costume?
Something you have, something you know, or something you are will matter when assessing whether you are in the right place at the right time. A gap (mistakes) can easily form between the implementation of segmentation in virtualization technology and its translation to a view or knowledge of the segmentation by a user.
I get asked all the time now “can you give us a reference architecture for segmentation”? This is like asking an anthropologist for a guide to what costume you should wear to the party. Does the outside observer really get to set the insider behavior? Automation without accounting for variables in behavior may only push these gaps wider.
The line of reasoning in this paper reminds me of a movie released in 1968 by Stanley Kubrick as echoed in my 2011 BSidesLV Presentation: A Cloud Odyssey.
