1. NSF Cyber Trust Annual Principal Investigator Meeting Sept. 25 -27 th 2005 Newport Beach California ITR: Usable Security: Towards a Trustable Information Infrastructure EFFECTIVE SECURITY In exploring the difference between theoretical and effective security in the development of innovative design principles, we intend to help users (1) become security aware and consequently (2) securely make informed decisions. Impromptu P2P file sharing application. Rogério de Paula, Xianghua Ding, Paul Dourish, Kari Nies, Ben Pillet, David Redmiles, Jie Ren, Jennifer A. Rode and Roberto Silva Filho. http://www.isr.uci.edu/projects/swirl/ Our approach helps to reveal the outcomes of people’s actions, helping them make informed decisions about their security and privacy needs. Comparison to state of the art Current approach to security focuses on mathematical security guaranteesfocuses on mathematical security guarantees is often based on “all-or-nothing” decisionsis often based on “all-or-nothing” decisions is based on a design proposition that attempts to hide security measures and features from the usersis based on a design proposition that attempts to hide security measures and features from the users Effective security approach focuses on practical security and privacy issues people deal with in their everyday workfocuses on practical security and privacy issues people deal with in their everyday work integrate configurations and actions, creating various levels of security and privacyintegrate configurations and actions, creating various levels of security and privacy increases user security awareness through visualizations, allowing them to take informed decision about their current securityincreases user security awareness through visualizations, allowing them to take informed decision about their current security In this project, we developed a peer-to- peer file sharing test bed application, Impromptu, that creates effective security by (1) exposing particular features of the infrastructure to the interface, rather than hiding, and (2) integrating configuration and actionon the same interface. In this project, we developed a peer-to- peer file sharing test bed application, Impromptu, that creates effective security by (1) exposing particular features of the infrastructure to the interface, rather than hiding, and (2) integrating configuration and action on the same interface. We designed, implemented and assessed this application. Impromptu is an test bed application built upon event-based infrastructures that integrate open source implementations of standards, including the Jetty HTTP server and Slide WebDAV server. It integrates configuration and action in an interface that allows users: To share files between participants of an ad-hoc networkTo share files between participants of an ad-hoc network Modify the file sharing level by dragging files aroundModify the file sharing level by dragging files around Visualize security-related activities when others read or modify shared filesVisualize security-related activities when others read or modify shared files Our pilot study shows that Impromptu: Accommodated various kinds of collaboration - each group used it differentlyAccommodated various kinds of collaboration - each group used it differently Provided a strong sense of embodiment and sharing - participants assumed a seamless integration between applicationsProvided a strong sense of embodiment and sharing - participants assumed a seamless integration between applications Conveyed a strong sense of others’ presences - participants perceived the presence of new members and changed their behaviorConveyed a strong sense of others’ presences - participants perceived the presence of new members and changed their behavior Supported rather than replaced face-to-face coordinating and cooperative actionsSupported rather than replaced face-to-face coordinating and cooperative actions David F. Redmiles Paul Dourish circles represent different sharing levels: view, read-only, read- write, persistent private file group persistent files Pie sections represent different users