User-centered security

Abstract

We introduce the term user-centered security to refer to security models, mechanisms, systems, and software that have usability as a primary motivation or goal. We discuss the history of usable secure systems, citing both past problems and present studies. We develop three categories for work in user-friendly security: applying usability testing and techniques to secure systems, developing security models and mechanisms for user-friendly systems, and considering user needs as a primary design goal at the start of secure system development. We discuss our work on user-centered authorization, which started with a rules-based authorization engine (MAP) and will continue with Adage. We outline the lessons we have learned to date and how they apply to our future work.We evaluate the pros and cons of this effort, as a precursor to further work in this area, and include a brief description of our current work in user-centered authorization. As our conclusion points out, we hope to see more work in user-centered security in the future; work that enables users to choose and use the protection they want, that matches their intuitions about security and privacy, and that supports the policies that teams and organizations need and use to get their work done. II. USABILITY IN SECURE SOFTWARE

Stakeholder involvement, motivation, responsibility, communication: How to design usable security in e-Science

“…Software engineering approaches to security are generally focussed on providing technical security, but there is growing evidence [Saltzer & Schroeder, 1975] that these approaches do not consider the needs of people sufficiently [Zurko & Simon, 1997]. Although developers have been identified as being a target group that requires usable security [Zurko & Simon, 1997], no efforts seem to have been made to ensure security development methods are well suited to the needs of developers.…”

“…Although developers have been identified as being a target group that requires usable security [Zurko & Simon, 1997], no efforts seem to have been made to ensure security development methods are well suited to the needs of developers. In fact, by putting the onus on the developers to build better user interfaces, the current trend in HCISec research is arguably adding to the complexity of building secure systems.…”

“…The idea presented in that paper was later taken up by [Zurko & Simon, 1997], who argued for user-centred security design to ensure that users, developers and system administrators made correct decisions. Studies of existing security mechanisms, such as passwords [Adams & Sasse, 1999] or PGP [Whitten & Tygar, 1999], also highlighted the important role that users play in the overall success of secure systems.…”

Relating Interactive System Design and Information Theory from Information Leakage Perspective

“…But while security facilitation, how it was affecting the usability and interactive system designing haven"t been discussed. In [19] M. E. Zurko and R. T. Simon provided theoretical analysis to balance the usability, security and interactive system design. But the principles presented were theoretical and unable to design the crisp boundary between usability and security.…”

Finding and resolving security misusability with misusability cases

“…The second standpoint is characterised by Zurko and Simon's work on user-centred security [61]. User-centred security refers to ''security models, mechanisms, systems, and software that have usability as a primary motivation or goal''.…”