SAINTCON 2018 - Troy Jessup

### Overview This transcript captures the opening session of SAINTCON 2018 in Utah, featuring conference logistics and opening remarks followed by keynote presentations and session introductions. Conference organizer Jupiter welcomes attendees, covers attendance milestones (selling out at roughly 1,000 tickets), acknowledges the volunteer committee, and highlights sponsors such as Uber sponsor CenturyLink, whose representative David Dubois details their global fiber footprint and threat intelligence sensing capabilities. Following these remarks, the event transitions to keynote presentations by Dr. Bonnie Anderson and Richard Thieme, concluded by an introduction to the NeverLAN CTF team.

### Key Topics - **Conference Organization & Logistics**: Jupiter outlines SAINTCON's mission in the Utah cybersecurity community, the volunteer-driven operations, sponsor involvement, lunch networking formats, and Slack communications. - **ISP-Scale Threat Intelligence**: CenturyLink's David Dubois discusses monitoring 130 billion netflow records and 500 million DNS queries daily, tracking 5,000 C2-managed botnets, and providing threat intelligence and DDoS mitigation at events like Black Hat. - **Neuroscience & Security Usability**: Dr. Bonnie Anderson from BYU presents research from the BYU Neurosecurity Lab exploring how brain biology influences user security behavior across three core phenomena: dual-task interference (DTI), habituation, and generalization of habituation. - **Geopolitical & Philosophical Impacts of Computing**: Richard Thieme discusses how information technologies alter cognitive artifacts, erode traditional boundaries (geopolitical borders, nation-states, and individual privacy), and impact intelligence and security professionals. - **Youth CTF Initiatives**: Introduction of NeverLAN CTF, a student-founded international Capture the Flag organization mentored by Dan Daggett.

### Technical Details - **Dual-Task Interference (DTI)**: Dr. Anderson's fMRI experiments showed that interrupting users during primary tasks causes blood flow decreases in medial temporal lobe (MTL) regions (such as the amygdala and hippocampus). When interrupted by a security extension warning during memory encoding, user disregard rates spiked from 7% to nearly 23%. Field experiments with Google Chrome demonstrated that displaying security messages at low-DTI times (e.g., after completing a video or while waiting for a page task to complete) markedly reduced user disregard compared to high-DTI moments (such as during video playback or typing). - **Habituation & Polymorphic UI Warnings**: Repeated exposure to identical security warnings causes decreased activation in attention-related areas (superior parietal cortex) and increased activation in the default mode network. Longitudinal studies pairing 3T fMRI with MR-compatible long-range eye tracking demonstrated that polymorphic UI modifications—such as color changes (red), warning symbols, and animations (jiggle, zoom)—maintained higher levels of visual fixation and neural attention over time. A 15-day Android field study confirmed that polymorphic warnings significantly increased adherence rates against risky application permissions. - **Generalization of Habituation**: In the "Batman protocol" study, participants habituated to frequent benign progress notifications generalized that habituation to critical security warnings (e.g., browser location requests, extension installs, executables, and Excel macros) sharing similar layout and visual elements, resulting in rapid, erroneous dismissals. - **Metadata and Borderless Networks**: Richard Thieme highlighted how metadata analysis reveals detailed human behavioral patterns (up to 94% predictive accuracy for future locations via mobility tracking) without decrypting content, eroding traditional concepts of nation-state defenses and personal privacy.

### Takeaways - Security warnings should be engineered around human cognitive biology: defer non-critical prompts to low-interruption moments to prevent dual-task failure. - Visual variation (polymorphism) in security prompts helps combat habituation, while distinct visual styling prevents users from confusing security-critical alerts with routine benign notifications. - In the modern digital and intelligence landscape, porous boundaries and pervasive metadata analysis shift cybersecurity responsibility from isolated perimeter defense to maintaining systemic, global stability.