# Getting Rid of the Usability/Security Trade-Off: A Behavioral Approach
## 3 Usable Security  
When employing the term \"usability\", it is difficult to avoid falling back on expressions such as \"ease of use\", \"simplicity\", or \"intuitiveness\". However, the concept fails to be captured exclusively by these terms. Although we are often content to define usability as ease of learning and using an artifact, there are many ways in which the quality of user-technology interaction can be described and measured. The ISO 9241 standard, introduced by the International Organization for Standardization in 1998 (and revised in 2018), describes \"usability\" as the degree to which specific users can use an artifact to achieve certain goals with effectiveness, efficiency, and satisfaction in a specific context of use [4]. Typically, effectiveness coincides with the achievement of goals, efficiency with the time it takes to perform a task, and satisfaction with users' subjective ratings. These are, of course, simplifications of a more complex concept. However, although this \"standard\" definition represents a compromise between different theoretical instances, it does not provide clear operational indications. The standard highlights an important aspect that is often overlooked by different theoretical and procedural approaches: usability is not a characteristic of the product itself but depends on the characteristics of the users of the system, on the goal that they intend to achieve, and on the context in which the product is used. Implicitly, the standard underlines how usability cannot be traced back to the presence/absence of characteristics but must be assessed considering the individual'ssubjective experience. With their abilities and limitations, users intend to achieve an objective using technology and wish to do so using the least number of resources possible and not having to invest more, paradoxically, because of the technology they use. Design, therefore, cannot disregard the knowledge of the users' needs, limits, and potentialities and the careful task analysis that will have to be carried out while using a device in each context. Information technology security also needs to be usable; the expression \"usable security\" indicates managing security information in the user interface design. In this context, usability is fundamental at different levels: (1) from the user's point of view, because it allows completing a task effectively, efficiently, and satisfactorily, avoiding errors that may cause security problems; (2) from the developer's point of view, as it is crucial for the success of a system; (3) from the management's point of view, considering that weak security mechanisms could represent a limitation to the usability of the system [22]. Security, then, is not a functionality divorced from usability but is related to it, and the designer's goal must be to ensure both security and usability while preventing one from compromising the other [22]. [PERSON] [23] (p.278) pointed out that \"the presentation and usability of security features, in some cases, are less than optimal\", requiring effort from the user to use them correctly. This effort is necessary but, in some cases, reduces the usability of a procedure and, therefore, discourages its use. [PERSON] and colleagues [24] reached the same conclusion when comparing the usability of two authentication methods in automated telephone banking. They conducted empirical research involving customers of a bank. The objective of the study was to compare the level of usability perceived by users using one-factor and two-factor authentication methods. Two-factor authentication is a security procedure in which users provide two different authentication factors to verify their identity. The results confirmed how participants considered the two-factor authentication less easy to use but, at the same time, they were aware that it was the most secure method [24]. This example precisely describes the problem of managing usability and security, with the two components often being at odds.