Security and Usability: Analysis and Evaluation Ronald Kainda, Ivan - PowerPoint PPT Presentation

Introduction Security-usability threat model Security and usability evaluation Summary Security and Usability: Analysis and Evaluation Ronald Kainda, Ivan Flechais, and A.W. Roscoe Oxford University Computing Laboratory Availability, Reliability and Security (ARES) Conference Krakow, Poland 18 February, 2010

Introduction Security-usability threat model Security and usability evaluation Summary Outline Introduction 1 Security-usability threat model 2 Security and usability evaluation 3 Summary 4

Introduction Security-usability threat model Security and usability evaluation Summary Human-Computer Interaction (HCI) Human-Computer Interaction (HCI) ...discipline concerned with the design, evaluation and implementation of interactive computing systems for human use and with the study of major phenomena surrounding them (Source: SIGCHI, 1992)

Introduction Security-usability threat model Security and usability evaluation Summary Human-Computer Interaction (HCI) Human-Computer Interaction (HCI) ...discipline concerned with the design, evaluation and implementation of interactive computing systems for human use and with the study of major phenomena surrounding them (Source: SIGCHI, 1992) Usability The extent to which a product can be used by specified users to achieve specified goals with effectiveness, efficiency and satisfaction in a specified context of use (ISO 9241-11)

Introduction Security-usability threat model Security and usability evaluation Summary Human-Computer Interaction (HCI) HCI Effectiveness Learnability Efficiency Memorability Satisfaction

Introduction Security-usability threat model Security and usability evaluation Summary Human-Computer Interaction Security (HCISec) Technical security Formal proofs Focus on malicious attacks Technical solutions typical

Introduction Security-usability threat model Security and usability evaluation Summary Human-Computer Interaction Security (HCISec) Technical security Formal proofs Focus on malicious attacks Technical solutions typical Effective security Secure systems are socio-technical (Sasse et al.) Humans forget, make mistakes Human failures are not covered by formal proofs

Introduction Security-usability threat model Security and usability evaluation Summary Human-Computer Interaction Security (HCISec) Technical security Formal proofs Focus on malicious attacks Technical solutions typical Effective security Secure systems are socio-technical (Sasse et al.) Humans forget, make mistakes Human failures are not covered by formal proofs Human-Computer Interaction Security (HCISec) Focusses on the design, evaluation, and implementation of interactive secure systems.

Introduction Security-usability threat model Security and usability evaluation Summary Human-Computer Interaction Security (HCISec) Security software properties (Whitten, ’99) Secondary goal property

Introduction Security-usability threat model Security and usability evaluation Summary Human-Computer Interaction Security (HCISec) Security software properties (Whitten, ’99) Secondary goal property Hidden failure property

Introduction Security-usability threat model Security and usability evaluation Summary Human-Computer Interaction Security (HCISec) Security software properties (Whitten, ’99) Secondary goal property Hidden failure property Barn door property

Introduction Security-usability threat model Security and usability evaluation Summary Human-Computer Interaction Security (HCISec) Security software properties (Whitten, ’99) Secondary goal property Hidden failure property Barn door property Weakest link property

Introduction Security-usability threat model Security and usability evaluation Summary Human-Computer Interaction Security (HCISec) Security software properties (Whitten, ’99) Secondary goal property Hidden failure property Barn door property Weakest link property Abstraction property

Introduction Security-usability threat model Security and usability evaluation Summary Human Computer Interaction Security (HCISec) HCI Secure software Effectiveness Secondary goal Learnability Hidden failure Efficiency Barn door Memorability Weakest link Satisfaction Abstraction Human Computer Interaction Security (HCISec)

Introduction Security-usability threat model Security and usability evaluation Summary Analysis and evaluation of secure software What factors are crucial to usability analysis? What factors are crucial to security analysis? How do we use these factors for evaluating security and usability of secure systems?

Introduction Security-usability threat model Security and usability evaluation Summary Security-usability threat model User Usability Security Attention Effectiveness Vigilance Memorability Satisfaction Conditioning Accuracy Knowledge/Skill Motivation Efficiency Social context

Introduction Security-usability threat model Security and usability evaluation Summary Security measurable metrics Factor Metrics Attention Failures Vigilance Failures Conditioning Failures Motivation Perceived benefits, susceptibility, barriers, severity Memorability Recall Knowledge/skill Failures, mental models Context Impact of context

Introduction Security-usability threat model Security and usability evaluation Summary Process for security and usability evaluation Security Usability Identify Identify threat usage scenarios scenarios Assess ease-of-use Assess difficulty-of-use Identify system Identify system motivators de-motivators Identify external Identify external motivators de-motivators Make recommendations

Introduction Security-usability threat model Security and usability evaluation Summary Make recommendations Usability factors Security factors Conflicting factors

Introduction Security-usability threat model Security and usability evaluation Summary Make recommendations Usability factors Security factors Conflicting factors NIST Risk-Level Matrix Impact Likelihood Low Medium High High Low Medium High Medium Low Medium Medium Low Low Low Low

Introduction Security-usability threat model Security and usability evaluation Summary Summary and future work Conclusion Secure systems have properties that differentiate them from other systems We propose a security-usability threat model A process for evaluating security and usability is also proposed Threat scenarios Usage scenarios Both internal and external factors may cause users to engage in insecure behaviours

Introduction Security-usability threat model Security and usability evaluation Summary Summary and future work Conclusion Secure systems have properties that differentiate them from other systems We propose a security-usability threat model A process for evaluating security and usability is also proposed Threat scenarios Usage scenarios Both internal and external factors may cause users to engage in insecure behaviours Future work Empirical validation Extend to malicious users Developing metrics for comparing different elements of a system

Introduction Security-usability threat model Security and usability evaluation Summary THANK YOU ANY QUESTIONS?