Accessible and Inclusive Cyber Security: A Nuanced and Complex Challenge

Abstract

It has been argued that human-centred security design needs to accommodate the considerations of three dimensions: (1) security, (2) usability and (3) accessibility. The latter has not yet received much attention. Now that governments and health services are increasingly requiring their citizens/patients to use online services, the need for accessible security and privacy has become far more pressing. The reality is that, for many, security measures are often exasperatingly inaccessible. Regardless of the outcome of the debate about the social acceptability of compelling people to access public services online, we still need to design accessibility into these systems, or risk excluding and marginalising swathes of the population who cannot use these systems in the same way as abled users. These users are particularly vulnerable to attack and online deception not only because security and privacy controls are inaccessible but also because they often struggle with depleted resources and capabilities together with less social, economic and political resilience. This conceptual paper contemplates the accessible dimension of human-centred security and its impact on the inclusivity of security technologies. We scope the range of vulnerabilities that can result from a lack of accessibility in security solutions and contemplate the nuances and complex challenges inherent in making security accessible. We conclude by suggesting a number of avenues for future work in this space.

Economic Impact of a Hospital Cyberattack in a National Health System: Descriptive Case Study

“…Quantifying the impacts of cyberattacks on health care organizations can be a challenge as many factors should be considered. Among these are limited data (as these data tend be self-reported, which can limit the accuracy of results), the methodologies used (whether they consider direct costs or both direct and indirect costs), the cost variation (as it depends on factors such as the type of attack, downtime, organization size, and value of compromised data), or the context (how these incidents affect the organization’s daily operations, patient safety, and public trust) [ 24 , 25 ]. Moreover, the ramifications of cyberattacks transcend economic impacts, and health outcomes should also be considered, which may be more difficult to measure and quantify compared to the financial costs of such incidents [ 23 ].…”

“As Usual, I Needed Assistance of a Seeing Person”: Experiences and Challenges of People with Disabilities and Authentication Methods

“…populations". This results in a narrow picture of users that assumes they are fully abled, cognitively unimpaired, and have the necessary resources and required dexterity to interact with security systems [56]. Apart from recruitment, people with disabilities can effectively be excluded by the study designs, depending on the impairment.…”

“…Apart from recruitment, people with disabilities can effectively be excluded by the study designs, depending on the impairment. Lack of research and support can leave them more vulnerable in the realm of S&P [56], [72] -and may violate existing guidelines and regulations [72]. In 2017, Wang [72] advocated for a third wave of security research, aiming at designing S&P mechanisms "that are inclusive to people with various characteristics, abilities, needs and values".…”

“…Renaud finds that especially assistive technologies pose problems for security, as they are "designed to ease the usual web-related activities, not cyber security actions" and that "usability of cyber security mechanisms is not the same as usability of a web page" [55]. Extending this argument, Renaud & Coles-Kemp [56] argue to further take into account socio-economic and political factors, as users with disabilities are not only affected by inaccessible S&P mechanisms, "but also because they often struggle with depleted resources and capabilities together with less social, economic, and political resilience". While it is argued that accessibility may benefit people without disabilities as well [55], [69], it usually still holds a "medical disability perspective" [56].…”

“…Only the new WCAG 2.2 [70] (in draft) introduces the criterion for accessible authentication. Despite these existing guidelines, norms, and laws, researchers conclude that "for many, security measures are often exasperatingly inaccessible" [56]. To ensure the secure use of digital technologies for people with different abilities, an "inclusive approach to cybersecurity" is necessary [56] -especially as more and more products and services are moved online.…”