Inher­ent human vul­ner­a­bil­i­ties need to be taken into account when design­ing secu­rity systems/processes, sug­gests a study that looks at a dozen con­fi­dence tricks from the UK TV show The Real Hus­tle to deter­mine recur­ring behav­ioural pat­terns con artists use to exploit victims.

The study was a col­lab­o­ra­tion between Frank Sta­jano of the Uni­ver­sity of Cam­bridge Com­puter Lab­o­ra­tory and Paul Wil­son, writer and pro­ducer of the afore­men­tioned TV show (Wil­son was an IT con­sul­tant for twelve years before mov­ing into entertainment).

The seven prin­ci­ples of human behav­iour that con artists exploit, accord­ing to the article:

  • The dis­trac­tion prin­ci­ple: While you are dis­tracted by what retains your inter­est, hus­tlers can do any­thing to you and you won’t notice.
  • The social com­pli­ance prin­ci­ple: Soci­ety trains peo­ple not to ques­tion author­ity. Hus­tlers exploit this “sus­pen­sion of sus­pi­cious­ness” to make you do what they want.
  • The herd prin­ci­ple: Even sus­pi­cious marks will let their guard down when every­one next to them appears to share the same risks. Safety in num­bers? Not if they’re all con­spir­ing against you.
  • The dis­hon­esty prin­ci­ple: Any­thing ille­gal you do will be used against you by the fraud­ster, mak­ing it harder for you to seek help once you real­ize you’ve been had.
  • The decep­tion prin­ci­ple: Thing and peo­ple are not what they seem. Hus­tlers know how to manip­u­late you to make you believe that they are.
  • The need and greed prin­ci­ple: Your needs and desires make you vul­ner­a­ble. Once hus­tlers know what you really want, they can eas­ily manip­u­late you.
  • The Time prin­ci­ple: When you are under time pres­sure to make an impor­tant choice, you use a dif­fer­ent deci­sion strat­egy. Hus­tlers steer you towards a strat­egy involv­ing less reasoning.

via Schneier on Security