Simulating Perceptions of Security

This document is the Accepted Manuscript of a conference paper published in Proceedings of the Cambridge International Workshop on Security Protocols 2017. Under embargo until 29 November 2018. The final publication is available at Springer via: https://doi.org/10.1007/978-3-319-71075-4_7Systems complicated enough to have ongoing security issues are difficult to understand, and hard to model. The models are hard to understand, even when they are right (another reason they are usually wrong), and too complicated to use to make decisions. Instead attackers, developers, and users make security decisions based on their {\em perceptions} of the system, and not on properties that the system actually has. These perceptions differ between communities, causing decisions made by one community to appear irrational to another. Attempting to predict such irrational behaviour by basing a model of perception on a model of the system is even more complicated than the original modelling problem we can't solve. Ockham's razor says to model the perceptions directly, since these will be simpler than the system itself.Final Accepted Versio