Stakeholder involvement, motivation, responsibility, communication: How to design usable security in e-Science

Abstract

e-Science projects face a difficult challenge in providing access to valuable computational resources, data and software to large communities of distributed users. On the one hand, the raison d'être of the projects is to encourage members of their research communities to use the resources provided. On the other hand, the threats to these resources from online attacks require robust and effective security to mitigate the risks faced. This raises two issues: ensuring that (1) the security mechanisms put in place are usable by the different users of the system, and (2) the security of the overall system satisfies the security needs of all its different stakeholders. A failure to address either of these issues can seriously jeopardise the success of e-Science projects.The aim of this paper is to firstly provide a detailed understanding of how these challenges can present themselves in practice in the development of e-Science applications. Secondly, this paper examines the steps that projects can undertake to ensure that security requirements are correctly identified, and security measures are usable by the intended research community. The research presented in this paper is based on four case studies of e-Science projects. Security design traditionally uses expert analysis of risks to the technology and deploys appropriate countermeasures to deal with them. However, these case studies highlight the importance of involving all stakeholders in the process of identifying security needs and designing secure and usable systems.For each case study, transcripts of the security analysis and design sessions were analysed to gain insight into the issues and factors that surround the design of usable security. The analysis concludes with a model explaining the relationships between the most important factors identified. This includes a detailed examination of the roles of responsibility, motivation and communication of stakeholders in the ongoing process of designing usable secure socio-technical systems such as e-Science.

Human, organizational, and technological factors of IT security

“…It is necessary to broaden the study of security issues to include not only the technical, but also the human and organizational dimensions [11]. A better understanding of real world conditions and constraints during the adoption of security practices would help developers and designers make secure systems more usable [3].…”

Finding and resolving security misusability with misusability cases

“…This entails making the assigned stakeholders liable for addressing the obstacle. Flechais and Sasse [31] argue that this motivates the assigned stakeholders. This is because failure to act responsibly damages both the project's assets and its reputation; this reputation loss may lead to loss of trust in the whole system.…”

The different roles of ‘Design Process Champions’ for digital libraries in African higher education

“…Some participatory design researchers have extended the stakeholder base to include others whose participation is similar to that of the users. Flechais and Sasse [14] for instance in their study of design of usable security in e-Science included multiple stakeholders in their four case studies. Besides the end users and developers, they added owners of the systems, security experts and a data provider.…”