Human factors and usability issues have traditionally played a limited role in security research and secure systems development. Security experts have largely ignored usability issues--both because they often failed to recognize the importance of human factors and because they lacked the expertise to address them.
But there is a growing recognition that today's security problems can be solved only by addressing issues of usability and human factors. Increasingly, well-publicized security breaches are attributed to human errors that might have been prevented through more usable software. Indeed, the world's future cyber-security depends upon the deployment of security technology that can be broadly used by untrained computer users.
Still, many people believe there is an inherent tradeoff between computer security and usability. It's true that a computer without passwords is usable, but not very secure. A computer that makes you authenticate every five minutes with a password and a fresh drop of blood might be very secure, but nobody would use it. Clearly, people need computers, and if they can't use one that's secure, they'll use one that isn't. Unfortunately, unsecured systems aren't usable for long, either. They get hacked, compromised, and otherwise rendered useless.
There is increasing agreement that we need to design secure systems that people can actually use, but less agreement about how to reach this goal. Security & Usability is the first book-length work describing the current state of the art in this emerging field. Edited by security experts Dr. Lorrie Faith Cranor and Dr. Simson Garfinkel, and authored by cutting-edge security and human-computerinteraction (HCI) researchers world-wide, this volume is expected to become both a classic reference and an inspiration for future research.
Security & Usability groups 34 essays into six parts:
- Realigning Usability and Security---with careful attention to user-centered design principles, security and usability can be synergistic.
- Authentication Mechanisms-- techniques for identifying and authenticating computer users.
- Secure Systems--how system software can deliver or destroy a secure user experience.
- Privacy and Anonymity Systems--methods for allowing people to control the release of personal information.
- Commercializing Usability: The Vendor Perspective--specific experiences of security and software vendors (e.g.,IBM, Microsoft, Lotus, Firefox, and Zone Labs) in addressing usability.
- The Classics--groundbreaking papers that sparked the field of security and usability.
This book is expected to start an avalanche of discussion, new ideas, and further advances in this important field.
|Publisher:||O'Reilly Media, Incorporated|
|Sold by:||Barnes & Noble|
|File size:||7 MB|
About the Author
Dr. Lorrie Faith Cranor is an Associate Research Professor in the School of Computer Science at Carnegie Mellon University. She is a faculty member in the Institute for Software Research, International and in the Engineering and Public Policy department. She is director of the CMU Usable Privacy and Security Laboratory (CUPS).
Simson Garfinkel, CISSP, is a journalist, entrepreneur, and international authority on computer security. Garfinkel is chief technology officer at Sandstorm Enterprises, a Boston-based firm that develops state-of-the-art computer security tools. Garfinkel is also a columnist for Technology Review Magazine and has written for more than 50 publications, including Computerworld, Forbes, and The New York Times. He is also the author of Database Nation; Web Security, Privacy, and Commerce; PGP: Pretty Good Privacy; and seven other books. Garfinkel earned a master's degree in journalism at Columbia University in 1988 and holds three undergraduate degrees from MIT. He is currently working on his doctorate at MIT's Laboratory for Computer Science.
Table of Contents
|Part 1||Realigning Usability and Security||xxi|
|1||Psychological Acceptability Revisited||1|
|3||Design for Usability||31|
|4||Usability Design and Evaluation for Privacy and Security Solutions||47|
|5||Designing Systems That People Will Trust||75|
|Part 2||Authentication mechanisms||101|
|6||Evaluating Authentication Mechanisms||103|
|7||The Memorability and Security of Passwords||129|
|8||Designing Authentication Systems with Challenge Questions||143|
|11||Identifying Users from Their Typing Patterns||199|
|12||The Usability of Security Devices||221|
|Part 3||Secure Systems||245|
|13||Guidelines and Strategies for Secure Interaction Design||247|
|14||Fighting Phishing at the User Interface||275|
|15||Sanitization and Usability||293|
|16||Making the Impossible Easy: Usable PKI||319|
|17||Simple Desktop Security with Chameleon||335|
|18||Security Administration Tools and Practices||357|
|Part 4||Privacy and Anonymity Systems||379|
|19||Privacy Issues and Human-Computer Interaction||381|
|20||A User-Centric Privacy Space Framework||401|
|21||Five Pitfalls in the Design for Privacy||421|
|22||Privacy Policies and Privacy Preferences||447|
|23||Privacy Analysis for the Casual User with Bugnosis||473|
|24||Informed Consent by Design||495|
|25||Social Approaches to End-User Privacy Management||523|
|26||Anonymity Loves Company: Usability and the Network Effect||547|
|Part 5||Commercializing Usability: The Vendor Perspective||561|
|27||ZoneAlarm: Creating Usable Security Products for Consumers||563|
|28||Firefox and the Worry-Free Web||577|
|29||Users and Trust: A Microsoft Case Study||589|
|30||IBM Lotus Notes/Domino: Embedding Security in Collaborative Applications||607|
|31||Achieving Usable Security in Groove Virtual Office||623|
|Part 6||The Classics||637|
|32||Users Are Not the Enemy||639|
|33||Usability and Privacy: A Study of KaZaA P2P File Sharing||651|
|34||Why Johnny Can't Encrypt||669|