Security and Usability: Designing Secure Systems that People Can...

Features

• Cover Type: Paperback with 738 pages
• Published by: O'Reilly Media, Inc. August 25, 2005
• Written in: English
• ISBN 10 Number: 0596008279
• ISBN 13 Number: 978-0596008277
• Book Dimensions: 9.2 x 6.9 x 1.5 inches
• Weighs: 2.3 pounds

Product Review
"It's good. Buy it for your team library." - Lindsay Marshall, news@UK, June 2006

Product Description
Human factors and usability issues have traditionally played a limited role in security research and secure systems development. Security experts have largely ignored usability issues--both because they often failed to recognize the importance of human factors and because they lacked the expertise to address them.

But there is a growing recognition that today's security problems can be solved only by addressing issues of usability and human factors. Increasingly, well-publicized security breaches are attributed to human errors that might have been prevented through more usable software. Indeed, the world's future cyber-security depends upon the deployment of security technology that can be broadly used by untrained computer users.

Still, many people believe there is an inherent tradeoff between computer security and usability. It's true that a computer without passwords is usable, but not very secure. A computer that makes you authenticate every five minutes with a password and a fresh drop of blood might be very secure, but nobody would use it. Clearly, people need computers, and if they can't use one that's secure, they'll use one that isn't. Unfortunately, unsecured systems aren't usable for long, either. They get hacked, compromised, and otherwise rendered useless.

There is increasing agreement that we need to design secure systems that people can actually use, but less agreement about how to reach this goal. Security & Usability is the first book-length work describing the current state of the art in this emerging field. Edited by security experts Dr. Lorrie Faith Cranor and Dr. Simson Garfinkel, and authored by cutting-edge security and human-computer interaction (HCI) researchers world-wide, this volume is expected to become both a classic reference and an inspiration for future research.

Security & Usability groups 34 essays into six parts:

• Realigning Usability and Security---with careful attention to user-centered design principles, security and usability can be synergistic.
• Authentication Mechanisms-- techniques for identifying and authenticating computer users.
• Secure Systems--how system software can deliver or destroy a secure user experience.
• Privacy and Anonymity Systems--methods for allowing people to control the release of personal information.
• Commercializing Usability: The Vendor Perspective--specific experiences of security and software vendors (e.g., IBM, Microsoft, Lotus, Firefox, and Zone Labs) in addressing usability.
• The Classics--groundbreaking papers that sparked the field of security and usability.

This book is expected to start an avalanche of discussion, new ideas, and further advances in this important field.

Reader Reviews
Security and Usability; pick one at the expense of the other is the story we've all heard time and again. More secure systems are harder to use; for example longer secure passwords are harder to remember than shorter, more easily guessed ones. In the real world it has been recently noticed that when security "gets in the way"; it is often circumvented by the users. For example, systems that "upgrade security" by requiring lengthy passwords often result in sticky notes appearing as people begin to write their passwords down. The book explores a number of topics from the perspective that improved usability can enhance the real world security of a system. The chapters are written by different authors and grouped around related topics. It's hard to pull off these kinds of books well, but I believe this one succeeds. I put the chapters into three categories; talking points, patterns I can use, and presentations. Talking point chapters help me explain to others how improving usability can improve security; examples include "Usable Security" and "Design for Usability". Patterns I can use chapters present a framework for evaluating different approaches to common security problems; such as evaluating authentication mechanisms. Presentation chapters discuss a particular topic presenting pros and cons, such as "Identifying Users from Their Type Patterns" or "Informed Consent by Design". I enjoyed reading this book. If you're considering buying or designing a secure system I recommend checking it out.