1. Usable Security (unusable security ain’t secure)
Jeff Offutt
SWE 205
Software Usability Analysis and Design
Based on slides from Paul Ammann
Keynote talk at SECTEST 2014
(with liberal help from Angela Sasse of UCL)

2. Outline A Poll Consequences of unusable security
Myths about usable security
The path forward
11 June 2019

3. I hope you will all disagree by the time I finish today
A Poll
“In the past decade our community has recognized a tension between security and usability: it is generally easy to provide more of one by offering less of the other.”
Bonneau et al., Oakland S&P 2012
How many of you :
Agree ?
Disagree ?
I hope you will all disagree by the time I finish today
11 June 2019

4. Outline A Poll Consequences of unusable security
Myths about usable security
The path forward
11 June 2019

5. Unusable Security Costs Money
11 June 2019

6. Standard Security Thinking: “Users Should Make the Effort”
“An hour from each of the US’s 180 million online users is worth approximately US$2.5 billion. A major error in security thinking has been to treat users’ time—an extremely valuable resource—as free.”
C. Herley, IEEE S&P Jan/Feb 2014
11 June 2019

7. Does This Really Help Security?
11 June 2019

8. Productivity Impact – Lost Sales
Not a particularly effective security measure
Not usable: failure rate around 40% — so customers go elsewhere
“CAPTCHAs waste
17 years of human effort every day”
(Pogue, Scientific American March 2012)
11 June 2019

9. Unusable Security is Ridiculous …
11 June 2019

10. Password Recovery
“A significant percentage of users use the password recovery system every time they log in to their bank account”
— Security executive at a major bank
11 June 2019

11. “Through 20 years of effort, we've successfully trained everyone to design passwords that are hard for humans to remember, but easy for computers to guess.”
11 June 2019

12. Unusable Security Costs Security
User errors — even when trying to be secure
Non-compliance and workarounds to get tasks done
Security policies that cannot be followed make effort seem futile:
“It creates a sense of paranoia and fear, which makes some people throw up their hands and say, `there’s nothing to be done about security,’ and then totally ignore it.”
Expert Round Table IEEE S&P Jan/Feb 2014
11 June 2019

13. Are these legitimate users?
Noncompliance
Are these legitimate users?
11 June 2019

14. Classification of Errors (Norman)
Slips
Goal is correct
But execution is flawed
Mistakes
Goal is wrong
Attacks
Goal is immoral, anti-social, or illegal
User errors ≠ security attacks
Don’t treat legitimate users like criminals
11 June 2019

15. Impact on Security – Long-Term
Increased likelihood of security breaches
“Noise” created by habitual non-compliance makes malicious behavior harder to detect
Lack of appreciation of and respect for security creates a bad security culture
Frustration can lead to disgruntlement: intentional malicious behavior — insider attacks, sabotage
11 June 2019

16. Outline A Poll Consequences of unusable security
Myths about usable security
The path forward
11 June 2019

17. Beliefs of Usable Security
These are based on a survey of security and usability professionals at several companies
Belief 1
Software engineers and security experts understand usability
Belief 2
Usability is the same as user interface design
Belief 3
Usability is a luxury, not a necessity
11 June 2019

18. Myths of Usable Security
These are based on a survey of security and usability professionals at several companies
Belief 1
Software engineers and security experts understand usability
Myth 1
Software engineers and security experts understand usability
Myth 2
Usability is the same as user interface design
Belief 2
Usability is the same as user interface design
Belief 3
Usability is a luxury, not a necessity
Myth 3
Usability is a luxury, not a necessity
11 June 2019

19. Beliefs of Usable Security (2)
Making access more difficult for legitimate users also makes access more difficult for illegitimate users
Belief 5
Usability and security conflict with each other
Belief 6
The right process will lead to usable security
11 June 2019

20. Myths of Usable Security (2)
Making access more difficult for legitimate users also makes access more difficult for illegitimate users
Belief 4
Making access more difficult for legitimate users also makes access more difficult for illegitimate users
Myth 5
Usability and security conflict with each other
Belief 5
Usability and security conflict with each other
Belief 6
The right process will lead to usable security
Myth 6
The right process will lead to usable security
11 June 2019

21. The Cost Confusion Low usable security Death Zone
Cost for authorized users
Our goal is to drive this down
Sweet Spot
High usable security
Cost for unauthorized users
11 June 2019

22. Outline A Poll Consequences of unusable security
Myths about usable security
The path forward
11 June 2019

23. ? ? Pain and Consequences pain Executive Programmers Purchasing
Designers ?
Users
pain
11 June 2019

24. Pain and Consequences
Purchasing
Executive
Programmers
Achieving usable security requires a pain-path from the users to the designers
Designers
Users
pain
11 June 2019

25. Technology Should be Smarter
Move from explicit to implicit authentication:
Proximity sensors
Car key fobs
Bio-metrics
Thumbprints, facial recognition, etc.
Web fingerprinting
Two-factor authentication
11 June 2019

26. Summary
Security can only be achieved by designing security systems that are usable
Unusable Security
Ain’t
11 June 2019