Towards improving mental models of personal firewall users

ABSTRACT

Windows Vista's personal firewall provides its diverse users with a basic interface that hides many operational details. However, our study of this interface revealed that concealing the impact of network context on the security state of the firewall results in mental models that are unclear about the protection provided by the firewall resulting in an inaccurate understanding of the firewall configuration. We developed a prototype to support more contextually complete mental models through inclusion of network context information. Results from our initial evaluation of the prototype support our approach of improving user understanding of underlying system states by revealing hidden context, while considering the tension between complexity of the interface and security of the system.

REFERENCES

• 1: Guanling Chen , David Kotz, A Survey of Context-Aware Mobile Computing Research, Dartmouth College, Hanover, NH, 2000
• 2: Chiasson, S., van Oorschot, P. C., and Biddle, R. Even experts deserve usable security: Design guidelines for security management systems. In USM 2007, 4 pages.
• 3: Lorrie Faith Cranor, A framework for reasoning about the human in the loop, Proceedings of the 1st Conference on Usability, Psychology, and Security, p.1-15, April 14-14, 2008, San Francisco, California
• 4: Rogério de Paula , Xianghua Ding , Paul Dourish , Kari Nies , Ben Pillet , David Redmiles , Jie Ren , Jennifer Rode , Roberto Silva Filho, Two experiences designing for effective security, Proceedings of the 2005 symposium on Usable privacy and security, p.25-34, July 06-08, 2005, Pittsburgh, Pennsylvania [doi>10.1145/1073001.1073004]
• 5: Edwards, W. K., Shehan, E., Stoll, J. Security Automation Considered Harmful? In NSPW '07 (2007).
• 6: Roy A. Maxion , Robert W. Reeder, Improving user-interface dependability through mitigation of human error, International Journal of Human-Computer Studies, v.63 n.1-2, p.25-50, July 2005 [doi>10.1016/j.ijhcs.2005.04.009]
• 7: Jennifer Rode , Carolina Johansson , Paul DiGioia , Roberto Silva Filho , Kari Nies , David H. Nguyen , Jie Ren , Paul Dourish , David Redmiles, Seeing further: extending visualization as a basis for usable security, Proceedings of the second symposium on Usable privacy and security, July 12-14, 2006, Pittsburgh, Pennsylvania [doi>10.1145/1143120.1143138]
• 8: S. W. Smith, Humans in the Loop: Human-Computer Interaction and Security, IEEE Security and Privacy, v.1 n.3, p.75-79, May 2003 [doi>10.1109/MSECP.2003.1203228]
• 9: Windows Vista Help: Choosing a network location.
• 10: Ka-Ping Yee, Aligning Security and Usability, IEEE Security and Privacy, v.2 n.5, p.48-55, September 2004 [doi>10.1109/MSP.2004.64]

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.2 User Interfaces (D.2.2, H.1.2, I.3.6)
          Subjects: Evaluation/methodology

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Information flow controls

General Terms:
Design, Human Factors, Security

Keywords:
configuration, firewall, mental model, usable security