Security Engineering: Why Technology Is Powerless Without Understanding People

Information security is often perceived exclusively as a set of technical tools: encryption, firewalls, antivirus software, intrusion detection systems, and access control mechanisms. However, this perspective reflects only a small part of the real picture.

We will consider a much broader approach. It views security as a full-fledged engineering discipline that exists at the intersection of technology, economics, psychology, and organizational management. The central idea is that security cannot be reduced to individual tools or products. It is a comprehensive process of designing systems capable of withstanding both accidental failures and deliberate actions by adversaries.

What Is Security Engineering?

Security differs from ordinary system reliability in one important factor — the presence of an adversary.

When designing reliable systems, engineers account for random hardware failures, software bugs, and human errors. However, in the field of security, it is necessary to consider the existence of an attacker who actively seeks ways to compromise the system.

We can define security engineering as follows:

"Security engineering is about building systems that remain dependable in the face of malice, error, or mischance."

This idea is well illustrated by Bruce Schneier's metaphor. Ordinary programming is the art of making a computer perform assigned tasks. Reliable programming involves accounting for random errors arising from unforeseen circumstances. Schneier refers to this approach as designing for "Murphy's Computer."

Secure programming requires an entirely different mindset. Here, systems must be designed for a hypothetical "Satan's Computer" — an adversary who will deliberately seek out any vulnerabilities and exploit them at the most unfavorable moment.

Thus, security is not merely the absence of errors. It is the ability of a system to preserve its properties even under conditions of active opposition.

The Security Engineering Framework

One of the most important concepts is the model according to which security relies on four interconnected components. Weakening any one of them can jeopardize the entire system.

Security Policy

A policy defines security objectives and answers the question:

What exactly are we trying to achieve?

It formulates the rules that the system must enforce.

For example:

• only physicians have access to patients' medical records;
• an employee cannot independently approve their own financial transactions;
• access to classified information is granted only to individuals with the appropriate clearance level.

Without a clearly defined policy, it is impossible to determine what constitutes a security violation.

Security Mechanisms

Mechanisms are the tools used to implement the policy.

These include:

• cryptographic algorithms;
• access control systems;
• biometric authentication;
• hardware security mechanisms;
• physical locks;
• separation-of-duty procedures.

It is important to understand that mechanisms themselves do not constitute security. They merely enforce predefined rules.

Security Assurance

The existence of security mechanisms does not mean that they actually function as intended.

Assurance answers the question:

How confident are we that the mechanisms correctly enforce the security policy?

To gain this confidence, the following methods are used:

• testing;
• auditing;
• independent evaluation;
• formal verification;
• certification;
• architectural analysis.

Without assurance, security ceases to be an engineering discipline and becomes a matter of trust and assumptions.

Incentives of System Participants

Many security problems arise not from technical shortcomings.

Quite often, they result from poorly aligned incentives.

It is essential to understand why users, administrators, organizations, and attackers behave the way they do.

The key conclusion is the following:

Systems often fail not because cryptography is weak, but because the incentives of system participants conflict with security interests.

For example, if a bank shifts responsibility for fraudulent transactions onto the customer, it loses the economic incentive to invest in improving protective mechanisms. As a result, the overall level of security declines.

Why Incentives Matter

The topic of incentives becomes one of the central ideas in security.

The Principal-Agent Problem

One of the key economic problems arises when the decision-maker and the party bearing the consequences of those decisions are not the same.

If an organization does not suffer direct losses from inadequate security, it may lack motivation to improve its defenses.

ATMs provide a good example. If a bank shifts responsibility for fraudulent transactions onto the customer by claiming that they disclosed their PIN themselves, the incentive to invest in improving the security of the infrastructure becomes significantly weaker.

The customer bears the cost, not the organization.

The Lemons Market

Let us turn to the concept of the "lemons market."

The problem is that consumers are often unable to assess the security quality of a product before an incident occurs.

If buyers cannot distinguish genuinely secure solutions from insecure ones, they are unwilling to pay more for better protection.

This creates an incentive for manufacturers to cut corners on security by releasing inexpensive but vulnerable products. Over time, the market becomes saturated with such solutions.

Security as Risk Transfer

Sometimes security mechanisms are implemented not so much to eliminate threats as to redistribute legal liability among the participants in a process.

In such situations, security becomes a tool for managing risk and responsibility rather than exclusively a means of protection.

Trusted vs. Trustworthy: Why They Are Not the Same Thing

One of the most important concepts is understanding the distinction between trusted and trustworthy. Despite their apparent similarity, in security engineering they have fundamentally different meanings.

This distinction is often overlooked even by experienced professionals, leading to mistakes in the design of secure systems.

Trusted — A Trusted Component

A trusted component is one whose failure would result in a violation of the security policy.

In other words, the system is forced to trust it regardless of whether it deserves that trust.

For example, the operating system of a user's computer is a trusted component. If an attacker gains control over it, the security of all other mechanisms will be compromised.

It is important to understand that a trusted component is not necessarily trustworthy.

A striking example:

If an NSA employee sells keys to a Chinese diplomat, they remain trusted because the system was forced to trust them. However, they are clearly not trustworthy.

Trustworthy — A Component Worthy of Trust

Trustworthy refers to a component that genuinely possesses a high degree of reliability.

Such a component:

• has been thoroughly tested;
• has undergone independent evaluation;
• has been designed with threats in mind;
• demonstrates resilience against failures and compromise.

This is the state that security engineers should strive to achieve.

Trusted Computing Base (TCB)

The distinction between trusted and trustworthy leads to another fundamental concept — the Trusted Computing Base (TCB).

The TCB consists of all system components whose failure would result in a violation of the security policy.

The TCB may include:

• hardware;
• operating systems;
• critical software;
• administrators;
• management procedures;
• organizational personnel.

The key objective of a security engineer is the following:

Make the TCB as small as possible.

The fewer trusted components a system contains, the easier it becomes to:

• conduct audits;
• analyze threats;
• perform testing;
• ensure a high level of assurance.

The ideal goal is to minimize the number of trusted components and make them truly trustworthy.

Security Always Depends on Context

One of the central ideas of this article is the rejection of universal solutions.

Security is determined not by a set of technologies but by the context in which a system operates.

The same mechanisms may be effective in one domain and entirely unsuitable in another.

To illustrate this idea, let us consider four different examples.

Banking: When the Main Threat Comes from Within

Intuitively, it seems that banks should primarily defend themselves against external attackers. However, practice suggests otherwise.

The Main Threat

A significant portion of financial losses is associated with the actions of the organization's own employees.

Insiders possess:

• legitimate access to systems;
• an understanding of internal processes;
• knowledge of existing control mechanisms.

Therefore, insider threats become one of the primary risks.

Security Mechanisms

To counter such threats, banks rely not only on technical measures.

Organizational mechanisms play a key role:

• double-entry bookkeeping;
• Separation of Duties;
• auditing procedures;
• mutual oversight among employees.

Separation of duties implies that no single employee should be able to independently perform a critical operation from beginning to end.

The Main Lesson

In the banking sector, integrity often becomes the highest priority.

Money cannot be created out of nothing — it can only be transferred between accounts.

If the total value of debit transactions does not match the total value of credit transactions, the system should indicate that a problem exists.

This example demonstrates that, in some domains, integrity is significantly more important than confidentiality.

Military Base: Protecting Information at Any Cost

Military systems have a completely different threat profile.

The Main Threat

The primary dangers are:

• external adversaries;
• espionage;
• leaks of classified information.

The main objective is to prevent unauthorized disclosure of data.

Multilevel Security (MLS)

To address this challenge, Multilevel Security (MLS) models are used.

Information is classified into different security levels:

• Unclassified;
• Official Use Only;
• Secret;
• Top Secret.

The fundamental principle is that information should move only in permitted directions.

In simplified terms, this can be described as:

Information may flow upward through security classifications, but it must not leak downward.

Challenges of the Model

In practice, such systems encounter several difficulties.

For example:

• the complexity of managing information flows;
• errors in configuring access policies;
• the existence of covert channels for data transmission.

Malware capable of infiltrating highly protected environments and transferring information to less secure systems presents a particularly serious threat.

It is in this context that the Bell–LaPadula model emerges.

Healthcare: When Security Competes with Availability

Healthcare institutions face a fundamentally different challenge.

Here, security represents a constant search for compromise.

Conflict of Interests

It is necessary to simultaneously ensure:

• the confidentiality of patients' medical data;
• the availability of information necessary to provide timely medical care.

Excessively strict restrictions may pose a direct threat to a patient's life.

Characteristics of Healthcare Systems

Military systems operate according to the principle:

No clearance — no access.

However, such an approach is unacceptable in healthcare.

In emergency situations, physicians must be able to access necessary information even without standard authorization.

The Main Lesson

Rigid security models are not always suitable for the real world.

Many systems require:

• consideration of context;
• flexible decision-making;
• a balance between security and functionality;
• consideration of ethical factors.

This is why security models must be adapted to the characteristics of a specific domain.

Home: The Blurring Boundaries of Physical Security

The final example demonstrates how technological progress is changing the very understanding of security.

The Evolution of Threats

Traditionally, home security was based on physical mechanisms:

• door locks;
• alarm systems;
• video surveillance systems.

However, the emergence of Internet of Things devices has radically changed the situation.

A modern home may contain:

• smart locks;
• surveillance cameras;
• voice assistants;
• intelligent lighting systems;
• connected household devices.

New Risks

Previously, an attacker had to physically enter the premises.

Now, an attack can be carried out remotely.

For example, the compromise of a smart lock manufacturer's cloud service could potentially allow control over the device without any physical contact.

The Main Lesson

The boundaries of the traditional security perimeter are gradually disappearing.

Today, physical security directly depends on cybersecurity.

The compromise of digital components can lead to very real consequences in the physical world.

Key Takeaways

We have established the fundamental principles of security engineering.

Security Is a Process, Not a Product

It is impossible to simply purchase "security."

It is necessary to continuously:

• analyze threats;
• review policies;
• improve security mechanisms;
• verify their effectiveness;
• consider the changing incentives of system participants.

Humans Are Both the Weakest Link and Part of the Solution

Ignoring the human factor inevitably leads users to circumvent even the most sophisticated security mechanisms.

Psychology and ergonomics are just as important to security as cryptography or access control.

Context Determines Security Requirements

What works effectively in a bank may prove useless in a hospital.

What is appropriate for military systems may render civilian services unusable.

There are no universal solutions.

Any security system represents a set of trade-offs between competing requirements.

These conclusions prepare us for the next important topic: understanding human nature and its influence on the security of systems.

Usability and Psychology: Why People Become the Primary Target of Attacks

So far, we have examined and gained an understanding of what security engineering is and how secure systems are designed. Now, we shift our focus to people.

It is here that one of the most important ideas of modern information security emerges:

The weakest link in a system is often not technology, but people.

This idea is well reflected in a famous quote by Bruce Schneier:

"Amateurs attack machines; professionals attack people."

Modern security mechanisms are becoming increasingly sophisticated, cryptographic algorithms continue to improve, and computing power keeps growing. However, attackers are increasingly choosing to bypass technical barriers and target users directly.

To understand the reasons behind this phenomenon, we must turn to human psychology.

Why Humans Become the Weakest Link

Computers operate predictably and deterministically. Humans, on the other hand, act under the influence of emotions, cognitive limitations, social norms, and accumulated experience.

The main problem is that the human brain evolved for life in small social groups, not for interacting with complex digital systems.

Many security mechanisms require users to perform tasks for which they are simply poorly adapted:

• remembering dozens of complex passwords;
• assessing the authenticity of websites;
• recognizing social engineering attempts;
• making correct decisions under time pressure.

Ignoring these limitations makes even technically perfect systems vulnerable.

The Usability Asymmetry

It is important to note a significant difference between the physical and digital worlds.

In the physical world, many objects possess a natural asymmetry of use.

For example, a potato peeler is designed in such a way that peeling potatoes is significantly easier than harming another person.

In other words, correct use is easier than incorrect use.

In the digital world, the opposite is often true.

Clicking on a malicious link is significantly easier than verifying its authenticity.

Providing a password to a scammer may be easier than correctly assessing the level of risk.

As a result, modern interfaces often create environments in which unsafe actions are easier than secure ones.

Human Cognitive Limitations

The human brain has limited information-processing capabilities.

We struggle with tasks that require:

• remembering long random sequences of characters;
• assessing probabilities;
• maintaining constant attention;
• detecting subtle anomalies.

At the same time, humans excel at recognizing:

• faces;
• social cues;
• emotional responses;
• behavioral patterns.

Security systems that ignore these characteristics inevitably face user resistance and an increasing number of errors.

Social Engineering: Exploiting Human Nature

Social engineering involves exploiting human psychological characteristics to gain unauthorized access to information or systems.

Instead of attacking technology, the attacker manipulates people.

There are two primary types of such attacks.

Pretexting

Pretexting involves creating a convincing scenario that enables the attacker to obtain the desired information.

The attacker uses a carefully prepared cover story and impersonates a trusted individual.

How It Works

The attacker may pose as:

• a technical support employee;
• a physician;
• a police officer;
• a colleague;
• a bank representative;
• a government official.

The primary objective is to establish trust and persuade the victim to voluntarily disclose the required information.

Examples

Examples include private investigators who contacted hospitals or telecommunications companies while impersonating physicians or law enforcement officers.

By exploiting authority and a sense of urgency, they gained access to confidential patient and subscriber information.

Practical Experiment

Describing an experiment in which employees were trained to verify suspicious telephone requests.

Despite the training provided, approximately thirty fraudulent requests per week were still successful.

This result demonstrates how difficult it is to overcome the natural human tendency to trust others and the desire to help the person on the other end of the conversation.

Why It Works

Pretexting exploits fundamental aspects of human behavior:

• respect for authority;
• the desire to comply with social norms;
• the willingness to be helpful;
• readiness to respond to urgent situations.

This is why technical knowledge alone does not guarantee resilience against such attacks.

Phishing

Phishing involves the mass distribution of fraudulent messages that imitate communications from legitimate organizations.

The goal of such attacks is to obtain:

• credentials;
• banking information;
• personal data;
• verification codes.

The Evolution of Phishing

Early phishing messages were relatively primitive and easy to identify.

A typical example is emails about inheritances from "Nigerian princes."

Modern attacks have become significantly more sophisticated.

They employ:

• the branding of well-known companies;
• convincing design;
• accurate terminology;
• domain names that visually resemble legitimate ones;
• scenarios designed to trigger strong emotional reactions.

Attackers frequently use messages such as:

"Your account will be suspended."

or

"Verify your information to avoid access restrictions."

Why Phishing Remains Effective

Despite widespread awareness of such threats, phishing continues to be highly successful.

The reasons lie in the characteristics of human perception.

Superficial URL Inspection

Most users do not examine website addresses carefully.

Attention is often focused only on the first few characters of the address or a familiar brand name.

Trust in Visual Indicators

A company logo, a padlock icon, or a familiar interface creates a sense of security.

Users tend to perceive such elements as evidence of a resource's authenticity.

Emotional Manipulation

Fear, greed, or a sense of urgency significantly reduce critical thinking abilities.

This is why attackers actively use emotionally charged messages.

Errors and Violations: An Important Distinction

It is important to distinguish between two types of unsafe user behavior.

Errors (Slips and Mistakes)

Errors occur in situations where a person intends to perform the correct action but makes a mistake.

For example:

• clicking the wrong button;
• accidentally sending information to the wrong recipient;
• forgetting a password;
• misinterpreting a system message.

Such problems usually indicate shortcomings in the design of interfaces and processes.

Violations

Violations occur when users consciously choose not to follow established rules.

The reasons may include:

• inconvenient procedures;
• the desire to speed up work;
• the intention to simplify task completion;
• the belief that restrictions are excessive.

If an employee intentionally disables security mechanisms because they interfere with work, the problem lies not only with the user but also with poor security system design.

Cognitive Biases: Why Rational People Make Unsafe Decisions

One of the key ideas is understanding that most user errors are not caused by a lack of intelligence or knowledge. The reason lies in the characteristics of human cognition.

To make decisions quickly, the brain relies on so-called heuristics—simplified rules that help conserve cognitive resources. In most life situations, these heuristics are useful; however, in the field of information security, they often become a source of vulnerabilities.

Availability Heuristic

People tend to assess the likelihood of events based on how easily relevant examples come to mind.

Events that receive extensive media coverage or have recently occurred within a person's environment are perceived as more probable.

How This Affects Security

Users often overestimate rare and dramatic threats:

• attacks by "super hackers";
• sophisticated movie-style viruses;
• large-scale cyberattacks against nation-states.

At the same time, they underestimate much more common risks:

• using weak passwords;
• reusing credentials;
• clicking phishing links;
• disclosing information through social engineering.

For example, a person may fear sophisticated technical attacks while readily entering their password on a fraudulent website because such a threat appears less obvious to them.

Loss Aversion

One of the fundamental discoveries of behavioral economics is that people perceive losses much more intensely than equivalent gains.

In other words:

Losing 100 dollars generates stronger emotions than the joy of gaining the same 100 dollars.

Use in Attacks

Attackers actively exploit this psychological mechanism.

Phishing messages often contain warnings such as:

• "Your account will be blocked within 10 minutes."
• "You will lose access to your account."
• "To prevent unauthorized charges, urgently verify your identity."

The fear of losing something valuable causes people to act impulsively and reduces their ability to critically assess the situation.

Anchoring Effect

Initial information exerts a disproportionately strong influence on subsequent judgments and decisions.

Once an initial impression has formed, it becomes more difficult for a person to objectively analyze later indicators.

In the Context of Security

If an email contains:

• a familiar bank logo;
• a recognizable design;
• a correctly formatted greeting using the recipient's name;
• an official tone of communication,

the user begins to perceive the message as legitimate.

Even after noticing suspicious details, such as an unusual URL or grammatical mistakes, they may ignore them because the initial impression has already been established.

Social Psychology and Obedience to Authority

Security cannot be considered outside of its social context.

Human behavior is strongly influenced by other people and social norms.

Let us consider classic psychological experiments that demonstrate how profoundly social influence shapes our actions.

Milgram's Experiment: Obedience to Authority

Psychologist Stanley Milgram investigated people's willingness to obey instructions from an authoritative figure.

Participants in the experiment were instructed to administer increasingly powerful electric shocks to others for making mistakes during assigned tasks.

Despite obvious discomfort and moral concerns, a significant proportion of participants continued following the experimenter's instructions.

Significance for Information Security

People tend to comply with requests from individuals they perceive as authority figures or experts.

This is why attackers often impersonate:

• technical support personnel;
• law enforcement representatives;
• system administrators;
• bank employees;
• organizational executives.

When a person perceives someone as an authority figure, the likelihood of following dangerous instructions increases substantially.

A user may:

• disclose a password;
• install malicious software;
• grant access to a system;
• reveal confidential information.

At the same time, they may sincerely believe that their actions are appropriate.

Asch's Experiment: The Power of Conformity

Solomon Asch studied the influence of group opinion on decision-making.

During the experiment, participants were exposed to obviously incorrect answers given by a group regarding simple visual tasks.

Despite the clear error, many participants agreed with the majority.

Significance for Security

The behavior of others has a substantial impact on compliance with security rules.

If employees within an organization:

• use simple passwords;
• ignore browser warnings;
• bypass security mechanisms;
• fail to follow established procedures,

new employees are highly likely to adopt similar behaviors.

The security culture within an organization may be no less important than the technical security measures being used.

Cognitive Dissonance

People strive to maintain internal consistency between their beliefs and actions.

Realizing that one has become a victim of fraud causes psychological discomfort.

To reduce this discomfort, individuals tend to rationalize their own actions.

How Attackers Exploit This

Once a person has taken a small initial action, they become more likely to continue participating.

For example:

1. The user clicks a link in a suspicious email.
2. They then enter their username.
3. Afterward, they provide their password.
4. Later, they confirm the transaction using an SMS verification code.

At each stage, it becomes psychologically more difficult for the individual to admit that they are making a mistake.

Instead, they seek to justify their previous decisions by continuing to engage with the attackers.

Why User Education Is Not Always Effective

The traditional approach to security assumes that teaching users proper behavior is sufficient.

However, this perspective should be viewed with a degree of skepticism.

The reasons are obvious:

• cognitive limitations cannot be completely eliminated;
• emotional pressure affects even well-trained professionals;
• social mechanisms operate regardless of technical knowledge levels;
• maintaining constant vigilance requires significant psychological resources.

Even well-informed users can become victims of social engineering.

This means that security should not be placed entirely on the shoulders of individuals.

Designing Systems with Human Nature in Mind

Since human errors are inevitable, security systems should be designed to minimize the consequences of those errors.

The key principles of this approach include:

• reducing cognitive load;
• preventing errors by default;
• using secure default settings;
• creating intuitive interfaces;
• implementing additional layers of protection.

Security engineers should not assume that users will behave perfectly, but rather recognize that:

People will make mistakes, become distracted, rush, and occasionally make poor decisions.

Therefore, the designer's task is not to change human nature but to create systems that are resilient to its manifestations.

Passwords: A Compromise Between Security and Human Capabilities

Despite the emergence of new authentication methods, passwords remain one of the most widespread mechanisms for protecting digital systems.

However, they also represent one of the most problematic areas of information security.

The primary reason is that password systems require people to perform tasks for which human memory is poorly suited.

Users are expected to:

• create complex secrets;
• remember dozens of unique combinations;
• update them regularly;
• avoid writing them down;
• avoid reusing them;
• recognize attempts at compromise.

In practice, such requirements often prove unrealistic.

Why Passwords Become a Problem

Human memory works well with information that has meaning and associative connections.

Random sequences of characters, by contrast, are extremely difficult to remember.

As a result, users naturally seek to simplify the task.

This leads to the emergence of predictable behavioral patterns.

Common User Mistakes

Using Simple Passwords

Many users choose passwords based on easily memorable information:

• names;
• dates of birth;
• pet names;
• common words;
• character sequences (123456, qwerty).

Such combinations are highly vulnerable to dictionary attacks.

Password Reuse

One of the most widespread practices is using the same password across multiple services.

The reasons for this behavior are obvious:

• limited memory capacity;
• the desire to reduce cognitive load;
• convenience.

However, the compromise of a single service automatically places all other user accounts at risk.

Even if major platforms have strong security measures in place, a data breach at a less secure website can lead to the compromise of critical accounts.

Writing Down Passwords

Traditionally, organizations prohibit users from writing down passwords.

However, it is worth noting an interesting paradox.

A written-down password that is securely stored may sometimes be safer than a single simple password used across dozens of different services.

For example, a complex, unique password written down and stored in a safe may present less risk than an easily guessed password used everywhere.

This observation highlights the importance of considering actual user behavior when developing security policies.

The Problem with Security Questions

Many systems use security questions for account recovery.

Typical examples include questions such as:

• mother's maiden name;
• name of the first pet;
• school attended by the user;
• place of birth.

This approach has fundamental shortcomings.

The Information Is Not Secret

In the modern world, much of this information can be obtained through:

• social media platforms;
• public government records;
• personal data breaches;
• publicly accessible information databases.

Secrets Cannot Be Changed

If a password is compromised, it can be replaced.

However, it is impossible to change:

• biographical facts;
• family relationships;
• events from the past.

Once such information has been compromised, restoring security becomes significantly more difficult.

We regard the use of such questions as an extremely unreliable authentication mechanism.

Mandatory Password Changes: Good Intentions and Real-World Consequences

For many years, requiring users to change passwords regularly was a common practice.

Organizations frequently enforced mandatory password changes every:

• 30 days;
• 60 days;
• 90 days.

The assumption was that this measure would limit the period during which stolen credentials could be exploited.

However, in practice, the results proved far from straightforward.

How Users Behave

Most people do not create entirely new, complex passwords.

Instead, they use minor variations of existing ones:

• Password01
• Password02
• Password03

or

• Summer2025
• Summer2026

Such patterns are easily predicted by attackers.

Unintended Consequences

Frequent password changes lead to an increase in unsafe practices:

• writing passwords down on paper;
• storing them in unencrypted files;
• using predictable sequences;
• increasing the burden on support services.

Thus, a policy intended to improve security can produce the opposite effect.

This example clearly demonstrates the importance of considering human behavior when designing security mechanisms.

Attacks on the Password Entry Process

Even if a user creates a strong password, it can still be compromised at the moment of entry.

Shoulder Surfing

One of the simplest methods involves directly observing the user.

An attacker may obtain a password by watching it being entered:

• in public places;
• in offices;
• near ATMs;
• on public transportation.

Short PIN codes are particularly vulnerable.

Such attacks require no sophisticated technical tools and completely bypass cryptographic protections.

Keyloggers

Keyloggers are designed to record users' keystrokes.

They may exist in various forms.

Software Keyloggers

These are malicious software programs installed on the victim's device.

Once installed, they are capable of capturing:

• usernames;
• passwords;
• bank card numbers;
• the contents of communications.

Hardware Keyloggers

These are physical devices connected between the keyboard and the computer.

Such devices may remain unnoticed for extended periods while collecting entered information.

On-Screen Keyboards and Their Limitations

To combat keyloggers, some financial institutions introduced virtual keyboards.

Users entered their passwords using a mouse by clicking buttons displayed on the screen.

The assumption was that the absence of physical keystrokes would prevent information interception.

However, attackers quickly adapted.

Modern malware is capable of:

• taking screenshots;
• tracking cursor coordinates;
• analyzing sequences of mouse clicks.

As a result, virtual keyboards did not eliminate the problem entirely.

Attacks on Password Storage

Even a perfectly designed password entry process cannot protect users if the credential storage system itself is compromised.

Password Hashing

Instead of storing passwords in plaintext, systems typically store their cryptographic hashes.

When a password is entered:

1. the system computes its hash;
2. compares the result with the stored value;
3. grants access only if they match.

This approach eliminates the need to store the original passwords.

However, it does not guarantee absolute security.

Dictionary Attacks

An attacker can systematically compute hashes for commonly used passwords and compare them against a stolen database.

If users choose weak combinations, compromise can occur relatively quickly.

Rainbow Tables

Rainbow tables are precomputed collections of mappings between passwords and their hashes.

The use of such tables significantly accelerates credential-cracking attempts.

If a system stores hashes without additional protective mechanisms, the attack becomes substantially easier.

The Importance of Salt

To defend against such attacks, random values known as salts are used.

A salt is added to a password before computing its hash.

As a result, identical passwords used by different users produce different hashes.

This makes the use of precomputed rainbow tables significantly less effective.

The WordPress Vulnerability Example

Let us consider an example of an architectural decision that demonstrates how dangerous mistakes in authentication system design can be.

In one implementation of WordPress, cookie files stored values derived from password hashes.

If an attacker gained access to the database containing user accounts, they could use the available information to log in as an administrator without knowing the original password.

This example illustrates an important principle:

The security of a system depends not only on the strength of cryptographic algorithms but also on their correct implementation.

Even the use of strong cryptographic primitives cannot protect against design flaws.

The Main Lesson of Password Authentication

Most password-related problems arise not because of user shortcomings or weaknesses in algorithms.

The primary cause is the mismatch between human capabilities and the requirements imposed by security systems.

If a security mechanism demands the impossible from users, they will inevitably seek workarounds.

Therefore, effective authentication systems must take real human behavior into account rather than assuming the existence of ideal users.

Two-Factor Authentication (2FA)

One of the most common methods of improving account security is the use of two-factor authentication.

The concept involves combining multiple independent factors:

• something you know (a password);
• something you have (a phone, token, or device);
• sometimes also something you are (biometrics).

How It Works

Even if an attacker obtains a user's password, they cannot access the system without the second authentication factor.

This significantly complicates attacks, particularly in cases of large-scale phishing campaigns or database breaches.

Limitations of 2FA

Despite its effectiveness, two-factor authentication is not an absolute form of protection.

One important limitation is real-time man-in-the-middle attacks.

Man-in-the-Middle Attack

In such scenarios, the attacker proceeds as follows:

1. The user enters their credentials on a fraudulent website.
2. The website forwards this information to the legitimate service in real time.
3. The system sends a verification code to the user.
4. The user enters the code.
5. The attacker immediately uses it to gain access to the account.

Thus, even one-time codes can be intercepted and exploited in real time.

Biometric Authentication: Convenience and the Illusion of Security

Biometric methods (fingerprints, facial recognition, iris recognition) are widely used as a means of improving convenience.

Advantages

• no need to remember a password;
• rapid identity verification;
• ease of use in everyday scenarios.

The Fundamental Problem

Biometric data is not secret in the traditional sense.

Unlike passwords:

• fingerprints are left on objects;
• faces can be photographed;
• voices can be recorded.

The Inability to Replace Biometrics

If biometric data is compromised, it cannot be changed.

It is impossible to replace:

• fingerprints;
• facial structure;
• iris patterns.

This makes biometrics vulnerable when used as the sole authentication factor.

Conclusion

Biometrics can be used as an additional factor but should not serve as the only protection mechanism.

CAPTCHA: Protection Against Automation

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is used to distinguish humans from automated programs.

The Core Idea

The user must complete a task that is easy for humans but difficult to automate:

• recognizing distorted text;
• selecting images;
• solving logical challenges.

Problems with CAPTCHA

Despite its usefulness, this mechanism has several limitations:

• it degrades the user experience;
• it creates barriers for people with disabilities;
• it is becoming increasingly vulnerable to modern machine learning algorithms;
• it can be bypassed through "CAPTCHA farms," where tasks are solved by real people for payment.

Therefore, CAPTCHA is not an absolute solution to the problem of automated attacks.

Why User Education Is Insufficient

One of the common approaches to security is educating users about proper behavior.

However, it is emphasized that this approach has fundamental limitations.

Reasons Why Training Is Ineffective

• human cognitive limitations cannot be eliminated through training;
• emotional pressure reduces critical thinking;
• social engineering operates regardless of knowledge level;
• maintaining constant vigilance requires significant mental resources.

Even highly trained professionals can become victims of attacks.

Conclusion

User education alone cannot be relied upon as the primary security mechanism.

A Systemic Approach to Security

The main conclusion of this article is the necessity of designing systems with real human behavior in mind.

Design Principles

1. Reducing Cognitive Load

The system should minimize demands on users' memory and attention through:

• the use of password managers;
• authentication automation;
• simplified interfaces.

2. Secure by Default

The system should remain secure even when users make mistakes.

Errors should not lead to critical consequences.

3. Error Prevention

Interfaces should be designed to reduce the likelihood of accidental actions through:

• confirmation of critical operations;
• clear warnings;
• restrictions on dangerous actions.

4. Realistic User Modeling

Engineers should assume that:

• users make mistakes;
• users are in a hurry;
• users become distracted;
• users can be deceived.

Key Takeaway

This leads us to a fundamental conclusion:

The security of a system is determined not only by cryptography and technical mechanisms but also by the behavior of the people who interact with that system.

Ignoring the human factor results in even the most sophisticated security mechanisms becoming vulnerable.

Therefore, security engineering must consider psychology, human behavior, and the real limitations of users alongside the technical aspects of the system.