Exploring the meaning of usable security – a literature review

Abstract

Purpose For decades, literature has reported on the perceived conflict between usability and security. This mutual trade-off needs to be considered and addressed whenever security products are developed. Achieving well-balanced levels of both is a precondition for sufficient security as users tend to reject unusable solutions. To assess it correctly, usability should be evaluated in the context of security. This paper aims to identify and describe universally applicable and solution-independent factors that affect the perceived usability of security mechanisms. Design/methodology/approach The selected methodology was a systematic literature review during which multiple database resources were queried. Application of predefined selection criteria led to the creation of a bibliography before backward snowballing was applied to minimize the risk of missing material of importance. All 70 included publications were then analyzed through thematic analysis. Findings The study resulted in the identification of 14 themes and 30 associated subthemes representing aspects with reported influence on perceived usability in the context of security. While some of them were only mentioned sparsely, the most prominent and thus presumably most significant ones were: simplicity, information and support, task completion time, error rates and error management. Originality/value The identified novel themes can increase knowledge about factors that influence usability. This can be useful for different groups: end users may be empowered to choose appropriate solutions more consciously, developers may be able to avoid common usability pitfalls when designing new products and system administrators may benefit from a better understanding of how to configure solutions and how to educate users efficiently.

Lost in the middle – a pragmatic approach for ERP managers to prioritize known vulnerabilities by applying classification and regression trees (CART)

“…Over the past 20+ years, there has been increased emphasis on identification and reporting of known vulnerabilities in a national database (NVD) maintained by the NIST (NVD, Sengupta et al , 2011; Amankwa et al , 2022). However, past research has focused on the growth of vulnerabilities and focused on predicting the trends in growth patterns (Biswas and Mukhopadhyay, 2018; Scholte et al , 2012; Erola et al , 2022), while little focus is on remediation of vulnerabilities in an ERP environment, ignoring the gap in cybersecurity remediation between usability and security (Lennartsson et al , 2021).…”

Usable Security: A Systematic Literature Review

“…Despite this, we identified a few systematic reviews on the subject, although they primarily dig into more specific aspects over relatively brief periods [6,11,12].…”

PrivExtractor: Toward Redressing the Imbalance of Understanding between Virtual Assistant Users and Vendors

“…The field of usable security examines, amongst other aspects, how security is traded with usability; a review by Lennartsson et al finds that "Usability is hampered when users' primary tasks are disturbed." [30]. Further findings, that "Necessary security actions should be arranged in ways that minimize interruptions" and "compelling users to remember passwords repeatedly interrupts other tasks as enforced context switches may cause confusion" are of interest when viewing security implications of a VA -a tool that is, by design, friction-free in its use of a voice interface.…”