A few weeks ago I was fortunate to attend a talk concerning the utility of virtual and synthetic worlds.  One idea mentioned was the concept of using virtual environments as a means of which to visualize and interact with complex systems.  From a security perspective, complex systems and the amalgamation of varying components often result in many unforeseen security issues.  Systems interacting with, and depending upon one another in ways they were not originally designed will leave holes in the fabric (a fun platitude for security folks to chew on once more).  Unfortunately, no revolutionary solution for devising uniform, comprehensively secure systems from their genesis are coming any time soon.  So what can the security community do to compliment these manifold systems?
 
This idea of using virtual environments to visualize complex systems is very powerful, especially from a security perspective.  Visualization would provide security engineers (network admins, application developers, etc) to see, dynamically, how systems are working and interacting.  For instance, if a Web server begins to see heightened traffic rates, perhaps a visual image of the Web server (a blue server box or something to make it uniquely distinguishable) would expand to raise a red flag of a potential DDoS attack.  Perhaps, a visualization of a complex system would allow admins to see what different protocols (lines w/ different colors?) are being used for disparate systems to communicate.  Maybe, with regards to the "cloud", visual representations for depicting VM segmentation and resource allocation could be used to symbolize data leaks between VMs, exposure to the host and hypervisor.  The potential ways to use system visualizations via a virtual environment are endless.  The next question is, how can one trust the visualizations one is seeing?  But that's for another day...
 
What about the ease of which users would be able to interact with their infrastructure?  No more manually grep'ing through log files and modifying systems via command line and shell scripts.  It'd be much easier to visually see a comprehensive view of one's infrastructure and be able to make modifications with a few mouse clicks.  Instead of interacting with complex systems by means of such complex methodology, we should be working to interact with them in more simplistic, intuitive ways.
 
Today, every systems engineer devises many system and network diagrams before deployment and implementation.  But these forms of documentation are static.  We need to begin implementing living visualizations that dynamically interact with our living systems. 
 

Dr. Nick Yee, of the Daedalus Project, is an American researcher who studies self-representation and social interaction in virtual environments.  The Daeldulus Project is Dr. Yee’s research initiative into the psychology and sociology of MMORPGs.  Yee, well respected by academia and extensively cited, has published a number of articles concerning the power of social context in virtual environments.  One in particular, “The Proteus Effect: The Effect of Transformed Self-Representation on Behavior”, at a high level depicts how similarities in social interaction in the real world extend virtual environments.  Malicious users, comprehending these social similarities can effectively instigate social actions as a means to expose expected social reactions.  This understanding gives attackers a powerful platform to utilize contextually and socially relevant phishing and social engineering attacks not yet possible in today’s two-dimensional Web.
 
Yee’s “The Proteus Effect” discusses an idea known as the behavioral confirmation, which is the process, whereby the expectations of one person (typically referred to as the perceiver) cause another person (typically referred to as the target) to behave in ways that confirm the perceiver’s expectations (Snyder, Tanke, & Berscheid, 1977).  For instance, a perceiver, using an attractive avatar to interact with a target will likely find the target to behave more friendly and in an altruistic manner. It is important to note that the source of behavioral change from the effects of behavioral confirmation stem from the perceiver rather than the target. It is the perceiver’s behavior that in turn causes a change in the target’s behavior (Yee 2007).  
 
In virtual, three-dimensional social contexts, attackers will understand aspects of behavioral confirmation and initiate perceiver behavior that will help better facilitate phishing and social engineering attacks.  Attackers will expose how individuals feel inclined to help others given certain social circumstance.
 
Lets say I am an attacker, in the perceiver’s social role, aware that how I look and act will influence my social target(s) to respond in a manner I can readily predict.  Perhaps, my avatar is displayed as an attractive female mulling about at a chessboard in Second Life looking confused.  Perhaps, my avatar sits down and stands up at the board multiple times.  Maybe my avatar wonders around the board in circles.  These signs taciturnly suggest that I am confused and in need of help.  Without initiating conversation, there is an excellent chance another user’s avatar will approach me to see if I need help.  At this point, as an attacker, I have an excellent chance of getting my overly altruistic target to interact with my malicious chessboard that perhaps runs a malicious script upon moving a piece (or something along those lines).
 
What is unequivocally powerful concerning this method of attack is that attackers no longer need to seek out victims.  Attackers can manipulate social context and drive unsuspecting victims to the attackers themselves.  Instead of baiting a hook and placing it in water hoping for fish to bite, fish are jumping out of water and directly into a fisherman’s clutches.