Here’s a photo of the grounds of the conference center — it was a gorgeous place, and a really interesting procedural setup for a workshop. There were only around 30-40 participants, and an hour was devoted to each paper. The presenter was given 5 uninterrupted minutes at the beginning of that hour to say whatever they wanted to say about the paper, and then the floor was opened to the rest of the workshop to ask questions. There was also a discussant assigned to each paper whose job it was to call on people who signaled that they had questions, and generally keep the discussion on track in a direction that would be helpful for the presenter rather than an off-topic or destructive rathole.

Rick presented our paper, and we got a lot of really excellent and thought-provoking feedback, particularly about the idea that a mental model doesn’t necessarily have to be accurate to achieve a desirable effect or result. In the context of computer security, this might mean that a person who believes hackers are all teenage boys out to commit mischief could feel like they are more likely to be a target and take more steps to protect their computers, than someone who believes hackers are criminals out to make money (and therefore might only target online businesses or something like that). There was a very interesting conversation during our session about whether creating interventions that lead to incorrect mental models is ever OK, even when the result is that people may behave in a more secure manner. People at the workshop even came up with instances in the real world where this exact thing happens — for example, the way the temperature controls on a fridge/freezer combo work. Look it up! (hint: there’s only one compressor / cooling device)

It was extremely valuable for me to attend, because I don’t have much experience with the computer security community, and this was a great way for me to learn more about what current and emerging topics are in that area, as well as to experience and think about the reactions to our ideas. All in all, a great experience, and an interesting group of people to get to know! The oysters were fabulous, too

Anyway, the changes to the site mainly consist of the blog becoming more of a “news and announcements” venue, than my random musings — I don’t have much time for random musing these days, it seems. I’m also putting together more information about current projects, and shifting some effort to keeping that stuff more up-to-date. Project-related non-random musing may work its way back into the blog at some point, but while I’m ramping up here at MSU I can’t make any promises about how frequently that will happen. I’ve also removed much of the old blog content form the past few years — if you’re particularly sad about losing something that is now missing, send me mail and I can restore it.

I also received some very exciting news while this transition was taking place: my first NSF proposal was funded, and work on that project is just getting started. The funding comes from the “Trustworthy Computing” program, and grant is titled “Influencing Mental Models of Security“. The goals of the project are

• to better understand how non-expert computer users understand and think about home computer security — their “mental models” — by investigating where and how these models are developed
• to correlate their beliefs and attitudes with measures of actual security behaviors
• and to propose and develop ideas for interventions that might help people form better mental models that lead to better home computer security

I will be slowly updating this (horribly out of date!) website over the next few weeks, starting with the Home page, and including descriptions of current projects and exciting research updates. Yay, Science!