Eight Lightweight Usable Security Principles for Developers

Abstract

We propose eight usable security principles that provide software developers with a lightweight framework to help them integrate security in a user-friendly way. These principles should help developers who must weigh usability and security tradeoffs to facilitate adoption.C ybersecurity is a basic precondition for our digital society and should work for everyone, from children to grandparents, from citizens to policymakers, from industry to the military and so on. Security must also work in a wide range of domains, from casual personal use to critical infrastructures, each with its own set of requirements. There are many technical security measures that can be put in place to fulfill these requirements. However, there are major challenges in designing and integrating such measures into systems so that they are used correctly, or at all. When security failures inevitably occur, human error is often identified as the cause. For some security experts and developers, this has shaped the idea that users are the weakest link. There is also the related misconception that security and usability are incompatible qualities of a digital system. The growing discipline of "usable security" addresses this myth 1 by developing scientific insights into how security and usability can be reconciled and how existing conflicts of requirements can be balanced from the perspective of the overarching goal of "effective cybersecurity. "Since its emergence some 25 years ago, the field of usable security has offered many important insights into how security features can be aligned with users' needs, abilities, and expectations. However, the transition of these findings into practice has been less well explored. Key players in this regard are software developers as they need to integrate security mechanisms into products in a way that meets security requirements but also fit users' capabilities. However, as security is rarely the main purpose or selling point of a product, developers have to balance the effort for themselves and their users. In some cases, (like plain email) very little security was implemented. In others (like PGP), the implementation was so complex that adoption was minimal. Both situations are not ideal.The body of knowledge in the field of usable security, which could help address this issue, is often quite specific. This makes it a less-than-ideal source of guidance for many software developers with limited resources, who cannot, for instance, set up and run complex security user studies. To see a broader adoption of usable