Revealing hidden context: improving mental models of personal firewall users

ABSTRACT

The Windows Vista personal firewall provides its diverse users with a basic interface that hides many operational details. However, concealing the impact of network context on the security state of the firewall may result in users developing an incorrect mental model of the protection provided by the firewall. We present a study of participants' mental models of Vista Firewall (VF). We investigated changes to those mental models and their understanding of the firewall's settings after working with both the VF basic interface and our prototype. Our prototype was designed to support development of a more contextually complete mental model through inclusion of network location and connection information. We found that participants produced richer mental models after using the prototype than when working with the VF basic interface; they were also significantly more accurate in their understanding of the configuration of the firewall. Based on our results, we discuss methods of improving user understanding of underlying system states by revealing hidden context, while considering the tension between complexity of the interface and security of the system.

REFERENCES

• 1: P. Arjmandi, R. Boeck, F. Raja, and G. Viswanathan. Usability of Vista firewall: A labratory user study. EECE412 course project at the University of British Columbia, 2007.
• 2: A. Chebium, P. Jaferian, N. Kaviani, and F. Raja. Usability analysis of Vista firewall. CSCP544 course project at the University of British Columbia, 2008.
• 3: Guanling Chen , David Kotz, A Survey of Context-Aware Mobile Computing Research, Dartmouth College, Hanover, NH, 2000
• 4: S. Chiasson, P. C. van Oorschot, and R. Biddle. Even experts deserve usable security: Design guidelines for security management systems. In SOUPS Workshop on Usable IT Security Management (USM), pages 1--4, Pittsburgh, PA, July 2007.
• 5: Joëlle Coutaz , James L. Crowley , Simon Dobson , David Garlan, Context is key, Communications of the ACM, v.48 n.3, March 2005 [doi>10.1145/1047671.1047703]
• 6: L. F. Cranor. Designing a privacy preference specification interface: A case study. In Proceedings of the Workshop on Human-Computer Interaction and Security Systems, page 4 pages, 2003.
• 7: Lorrie Faith Cranor, A framework for reasoning about the human in the loop, Proceedings of the 1st Conference on Usability, Psychology, and Security, p.1-15, April 14-14, 2008, San Francisco, California
• 8: Rogério de Paula , Xianghua Ding , Paul Dourish , Kari Nies , Ben Pillet , David Redmiles , Jie Ren , Jennifer Rode , Roberto Silva Filho, Two experiences designing for effective security, Proceedings of the 2005 symposium on Usable privacy and security, p.25-34, July 06-08, 2005, Pittsburgh, Pennsylvania [doi>10.1145/1073001.1073004]
• 9: Paul Dourish , E. Grinter , Jessica Delgado de la Flor , Melissa Joseph, Security in the wild: user strategies for managing security as an everyday, practical problem, Personal and Ubiquitous Computing, v.8 n.6, p.391-401, November 2004 [doi>10.1007/s00779-004-0308-5]
• 10: W. Keith Edwards , Erika Shehan Poole , Jennifer Stoll, Security automation considered harmful?, Proceedings of the 2007 Workshop on New Security Paradigms, September 18-21, 2007, New Hampshire [doi>10.1145/1600176.1600182]
• 11: W. Geng, S. Flinn, and J. DeDourek. Usable firewall configuration. In PST '05: Proceedings of the 3rd Annual Conference on Privacy, Security and Trust, page 11 pages, 2005.
• 12: A. Herzog and N. Shahmehri. Usability and security of personal firewalls. New Approaches for Security, Privacy and Trust in Complex Environments, pages 37--48, 2007.
• 13: Almut Herzog , Nahid Shahmehri, User help techniques for usable security, Proceedings of the 2007 symposium on Computer human interaction for the management of information technology, March 30-31, 2007, Cambridge, Massachusetts [doi>10.1145/1234772.1234787]
• 14: S. Hohn. Bringing the user back into control: A new paradigm for usability in highly dynamic systems. Lecture notes in computer science, pages 114--122, 2006.
• 15: P. Jaferian. Usability study of Windows Vista's firewall. EECE512 course project at the University of British Columbia, 2008.
• 16: J. Johnston, J. H. P. Eloffa, and L. Labuschagneb. Security and human computer interfaces. Computers and Security, 22:675--684, 2003.
• 17: D. Jonassen and Y. H. Cho. Understanding Models for Learning and Instruction, chapter Externalizing Mental Models with Mindtools, pages 145--159. Springer US, 2008.
• 18: Waldemar Karwowski, International Encyclopedia of Ergonomics and Human Factors, Second Edition - 3 Volume Set, CRC Press, Inc., Boca Raton, FL, 2006
• 19: Predrag Klasnja , Sunny Consolvo , Jaeyeon Jung , Benjamin M. Greenstein , Louis LeGrand , Pauline Powledge , David Wetherall, "When I am on Wi-Fi, I am fearless": privacy concerns & practices in eeryday Wi-Fi use, Proceedings of the 27th international conference on Human factors in computing systems, April 04-09, 2009, Boston, MA, USA [doi>10.1145/1518701.1519004]
• 20: Roy A. Maxion , Robert W. Reeder, Improving user-interface dependability through mitigation of human error, International Journal of Human-Computer Studies, v.63 n.1-2, p.25-50, July 2005 [doi>10.1016/j.ijhcs.2005.04.009]
• 21: Joanna McGrenere , Ronald M. Baecker , Kellogg S. Booth, An evaluation of a multiple interface design solution for bloated software, Proceedings of the SIGCHI conference on Human factors in computing systems: Changing our world, changing ourselves, April 20-25, 2002, Minneapolis, Minnesota, USA [doi>10.1145/503376.503406]
• 22: Microsoft. Windows Vista Help: Choosing a network location.
• 23: Microsoft. Windows Vista Help: What is a firewall.
• 24: Microsoft. Microsoft's annual revenue reaches $60 billion. http://www.microsoft.com, 2008.
• 25: Microsoft. Windows firewall with advanced security - content roadmap. http://technet.microsoft.com, 2008.
• 26: Robert W. Reeder , Lujo Bauer , Lorrie Faith Cranor , Michael K. Reiter , Kelli Bacon , Keisha How , Heather Strong, Expandable grids for visualizing and authoring computer security policies, Proceeding of the twenty-sixth annual SIGCHI conference on Human factors in computing systems, April 05-10, 2008, Florence, Italy [doi>10.1145/1357054.1357285]
• 27: Jennifer Rode , Carolina Johansson , Paul DiGioia , Roberto Silva Filho , Kari Nies , David H. Nguyen , Jie Ren , Paul Dourish , David Redmiles, Seeing further: extending visualization as a basis for usable security, Proceedings of the second symposium on Usable privacy and security, July 12-14, 2006, Pittsburgh, Pennsylvania [doi>10.1145/1143120.1143138]
• 28: S. W. Smith, Humans in the Loop: Human-Computer Interaction and Security, IEEE Security and Privacy, v.1 n.3, p.75-79, May 2003 [doi>10.1109/MSECP.2003.1203228]
• 29: Jennifer Stoll , Craig S. Tashman , W. Keith Edwards , Kyle Spafford, Sesame: informing user security decisions with system visualization, Proceeding of the twenty-sixth annual SIGCHI conference on Human factors in computing systems, April 05-10, 2008, Florence, Italy [doi>10.1145/1357054.1357217]
• 30: M. Tungare and M. Pérez-Quinones. Thinking outside the (beige) box: Personal information management beyond the desktop. In Proceedings of the 3rd Invitational Workshop on Personal Information Management, page 8 pages, 2008.
• 31: Alma Whitten , J. D. Tygar, Why Johnny can't encrypt: a usability evaluation of PGP 5.0, Proceedings of the 8th conference on USENIX Security Symposium, p.14-14, August 23-26, 1999, Washington, D.C.
• 32: A. Whitten and J. Tygar. Safe staging for computer security. In the Workshop on Human-Computer Interaction and security Systems, page 4 pages, Ft. Lauderdale, FL, 2003.
• 33: A. Wool. The use and usability of direction based filtering in firewalls. Computers and Security, 37:459--468, 2004.
• 34: Ka-Ping Yee, User Interaction Design for Secure Systems, Proceedings of the 4th International Conference on Information and Communications Security, p.278-290, December 09-12, 2002
• 35: Ka-Ping Yee, Aligning Security and Usability, IEEE Security and Privacy, v.2 n.5, p.48-55, September 2004 [doi>10.1109/MSP.2004.64]

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.2 User Interfaces (D.2.2, H.1.2, I.3.6)
          Subjects: Evaluation/methodology

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Information flow controls

General Terms:
Design, Human Factors, Security

Keywords:
configuration, firewall, mental model, usable security