Security and usability research using a microworld environment

ABSTRACT

Technological developments and the addition of new features to existing applications or services require the inclusion of security mechanisms to protect the user. When using these mechanisms the user faces a tradeoff between more risky and more efficient or safer and less efficient use of the system. We discuss this tradeoff and present a novel complementary experimental system which provides researchers and corporations the ability to explore and model the usability and security tradeoff in the context of user interaction with security systems and psychological acceptability, even before the actual development and implementation processes have ended.

REFERENCES

• 1: Ben-Asher, N., Meyer, J., Moeller, S. and Englert, R. 2009. An Experimental System for Studying the Tradeoff between Usability and Security. In Proceedings of the 4^th International Conference on Availability, Reliability and Security (Fukuoka, Japan, March 16--19, 2009).
• 2: Cañas, J. J. and Waern, Y., 2005. Cognitive research with microworlds. In Theoretical Issues in Ergonomics Science vol. 6 (1), pp. 1--3.
• 3: Cranor, L. F. 2008. A Framework for Reasoning About the Human in the Loop. In Symposium on Usable Privacy and Security (Pittsburgh, Pennsylvania, USA).
• 4: Egelman, S., Cranor, L. and Hong, J. 2008. You've Been Warned: An Empirical Study of the Effectiveness of Web Browser Phishing Warnings. In ACM SIG-CHI Conference on Human Factors in Computing Systems (CHI '08I) (Florence, Italy, April 5--10, 2008).
• 5: Gonzalez, J. J. and Sawicka, A., 2002. A Framework for Human Factors in Information Security. In The 2002 WSEAS International Conference on Information Security (ICIS'02) (Barcelona, Spain, December 15--18, 2002).
• 6: Green, D. and Swets, J., 1966. Signal detection theory and psychophysics. New York: John Wiley and Sons.
• 7: Gross, J. B. and Rosson, M. B. 2007. Looking for trouble: understanding end-user security management. In Proceedings of the 2007 Symposium on Computer Human interaction For the Management of information Technology (Cambridge, Massachusetts, March 30--31, 2007).
• 8: Johnston, J., Eloff, J. H. P., and Labuschagne, L. 2003. Security and human computer interfaces. In Computers & Security, Vol. 22 No. 8, pp. 675--84.
• 9: Leavitt, N. 2005. Mobile phones: The next frontier for hackers. In Computer, 38(4), pp. 20--23.
• 10: Renaud, K. 2005. Evaluating Authentication Mechanisms. Security and Usability, Cranor, L. and Garfinkel, S, ed., O'Reilly.
• 11: Schneier, B. 2000. Secrets and Lies: Digital Security in a Networked World. John Wiley and Sons.
• 12: West, R. 2008. The psychology of security. Commun. ACM 51, 4 (Apr. 2008)

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)
          Subjects: Invasive software (e.g., viruses, worms, Trojan horses)

Additional Classification:
  H. Information Systems
  H.1 MODELS AND PRINCIPLES
      H.1.2 User/Machine Systems
          Subjects: Software psychology; Human factors

General Terms:
Experimentation, Human Factors, Security

Keywords:
alerts, experimental system, security, security settings, usability