Applying persuasion to information security

Social Psychology Professor Scott Plous mentioned a very enlightening almost 12-minute video on the "Science of Persuasion" by Robert Cialdini and Steve Martin.

Every security professional should be able to persuade their customers and users in an ethical and successful manner. I recommend to watch this video. For those who can't or who won't, here you are some learning points:

6 decision-making shortcuts or principles that govern human being's reactions and influence:

1. Reciprocity
In general, we feel obliged to answer back with kindness when we are the receivers of a nice act.

Cool tip from the video: If you describe your action while being kind, you are the first to give and it is personalised, then the reciprocal answer is even better. The statement "For you, nice people, here's an extra mint!" in the video corroborates.



2. Scarcity

Simply put, human beings like to have more from what becomes scarce. If it is not scarce, then we do not have such a big interest. So, if you would like to sell your security services, tell your customers about your unique value proposition! 



3. Authority
People follow the view of experts. Transposing the example showed in the video to the security world, if you display your security certifications, or even tell someone (even if they personally also benefit from it) to market your great professional value, your customers will follow your advice a little more seriously.

This principle has also a curious application: people get more persuaded by people wearing uniforms. Take this into account in your next social engineering engagement.


4. Consistency
People like to be consistent with previous decisions they took. This is the reason why some of the big requests are preceded in time by small enticing related requests that are far easier to be accepted.

Voluntary, active, public and, if possible, written commitments do wonders. I think this is really underused in our information security arena.



5. Liking
"Human beings prefer to say yes to those they like". Important point: Who do we like? According to Robert Cialdini and Steve Martin we like people who are:

- Similar to us.
- Complimenting us.
- Cooperating with us.

Simple but powerful facts. The most important tip then: If you are bound to negotiate security measures with a customer, talk to them first in an informal manner to identify similarities, to compliment them and to cooperate with them.


6. Consensus
In general, we do not like to be the exception. Mention what other similar customers are doing. A way to apply this to our field could be showing reputable statistics on the adoption of specific security measures.

Channelling attention to persuade ethically

Happy ethical (and costless?) persuasion!

Social engineering lecture by Kevin Hogan

The episode number 9 of the Social Engineer podcast features an interview with the author and body language expert Kevin Hogan. Among other books, he has written "the psychology of persuasion". This is a post with learning points extracted from his words on persuasion. Here you are (most of them are close to literal, or slightly summarised, statements from Mr. Hogan):

Minute 17: Let's try to use the right words. Emotions are attached to words. The listening of some words (e.g. terrorist, malware) triggers, unconsciously, the release of cortisol and adrenaline in our brains.

Minute 22: "When people smile too much ...[]... we put a question mark".

Minute 23: Keep yourself a handshake's distance away in face to face communications (for liking and acceptance). A smaller distance calls for a negative answer from our counterpart. People tend to have an affinity for mirroring (e.g. same first name, same voice, same clothes): "The reason why I know he is a genius is because he thinks like I do" (min 25).

Minute 24: "Women really pay attention to shoes ...[]... women are really discriminative about men in general".

Minute 25: Identifying badges. If you want to pass unnoticed, leave all necklaces and unique accessories at home. And the opposite, if you want to be remembered, show that unique tattoo you have.

... for right-handed people... (for lefties, the sides mentioned will be the opposite)

Minute 26: Right-hand handshakes. In general, when you look up to the right, the left brain hemisphere is more active. And this side is more logical and sequential.

Minute 27: The right part of our brain is mostly biographical (and unconscious), full of unpleasant memories. Not recommendable to be highly active when we first know someone.

Minute 29: If you want to cause a right impression, sit close to the tidiest side of the desktop, which, in right-handed people, is usually the right side. Avoid the chaotic side of the table.

Minute 33: Sit down at ease and look with your eyes to the right. No problem! Look now to your left. Do you feel like ending with that look? And do you notice fear, sadness, anger?

Minute 36: Left and right. Generic statement: If you put your earphone on your left ear, you will have a more emotional conversation than if you place it on your right ear.

Minute 39: Microexpressions. Do not force a smile, they will all discover it. A phony smile creates discomfort (min 42).

Minute 42: Human beings look for simetry. "Simetry is easy to fake... by keeping your lips slightly apart". Keep this posture in photographs.

Minute 46: A look of curiosity opens more doors that a smile.

Minute 50: "Men are territorial". If a man sits close to a woman for longer than 5 minutes, he becomes her protector.

Minute 55-57: Access any facility appearing that you belong to it. "When trying to enter any facility, a cleaning man with a mop and a bucket is never stopped ...[]... or carrying the internal magazine ...[]... or carrying a company box ...[]... or asking for John".

Minute 57: "If you look angry, nobody would stop you [at the entrance]".

Minute 60-61: "Most people are in auto-pilot within their role". Keep them in auto-pilot within their role and your social engineer compromise would work. Do not raise any flag.

Minute 64: Most of the people would like to keep on being comfortable in their roles.

Minute 65: Reading an email. 50% of the content of any email you send is already on the mind of the reader. Emoticons could create a nice initial context.

Minute 67: "People are terrible at understanding risks".

Minute 69: If you need to obtain information, better than asking how are you, ask what are you up to?

Minute 72: The more real something looks, the more tangible and credible something seems e.g. a testimonial with a real name says much more than an anonymous testimonial.

Thanks to Mr. Hogan and to the social-engineer.org crew again!