British Library cyber incident review [pdf]

> "Don't make me think" - Krug

That quote has nothing to do with cybersecurity, it's the title of a book by Steve Krug about web usability.

I am unfortunately old enough to have read that book when it first came out, and it's exclusively around how to design front-end UIs on websites to reduce user complexity. There is no mention of infrastructure or security at all.

You're making a quote around how we should make websites more usable and understandable to users - so they can use them without thinking - into something it isn't.

It has everything to do with it.

I know exactly what the book is and I read it. It's actually an excellent book on UX and I expect Steve Krug picked the title because it sounds cool.

No disrespect to that author intended, but it (maybe unwittingly) expresses a sentiment that has grave implications about the position of technology in human affairs. To understand why, please look deeper into what we used to call Human Computer Interaction (HCI) or "Cognitive Ergonomics".

I think I recently mentioned it in this online chat [0]

Explicit cognition is the "thinking slow" part of our brains that uses so-called left-brain linear reasoning and logic. It sits high in the cognitive stack. But as people use devices today, in what McLuhan [4] or Innes [5] would call an "acoustic" (nothing much to do with actual sound) way, we drop down a cognitive level to a faster, visual-haptic loop that bypasses explicit reasoning.

Designing applications that bypass this has major effects on security. The work of B J Fogg will show you more about this [1].

Tristan Harris also has lots on it [2,3].

One of the disastrous effects of this "distracted" level of HCI is that people use more emotional cues, rote, colour, word association, implicit trust and other models that make them easy prey for phishing and other kinds magic and trickery.

If you're interested in a much broader understanding of cybersecurity I give you a sincere invitation to check us out here [6].

[0] https://www.youtube.com/watch?v=hYnOf4PWGpA

[1] https://behaviordesign.stanford.edu/people/bj-fogg

[2] https://www.youtube.com/watch?v=LUNErhONqCY

[3] https://www.wired.com/story/our-minds-have-been-hijacked-by-...

[4] https://en.wikipedia.org/wiki/Marshall_McLuhan

[5] https://en.wikipedia.org/wiki/Harold_Innis

[6] https://cybershow.uk/

Exposing RDP to the Internet directly has been frowned-upon because of the attack surface being presented, there's no two factor "story" out-of-the-box, and you're opened up to brute force attempts on cruddy user passwords.

Older versions of the Microsoft Remote Desktop Protocol had a much larger attack surface than current versions. The current versions with Network Level Authentication (starting in Windows Vista/Server 2008) present a smaller attacks surface. Older versions used "homegrown" Microsoft crypto, whereas current versions use TLS.

Disclosure: I made a FLOSS fail2ban-like tool for RDP many years ago[0]. I had a situation where I was forced to expose RDP to the Internet and I didn't like having it open w/o some protection against brute force attacks. This tool happens to still work in Server 2022 and will slow the velocity of brute force attacks. I still highly recommend not exposing RDP directly to the Internet anyway.

(The ts_block tool is missing some fairly essential functionality that I never got around to implementing. It works fine and is really easy to install but some things are sub-optimal.)

[0] https://github.com/EvanAnderson/ts_block