Poster: Expectations, Perceptions, and Misconceptions of Personal Firewalls Fahimeh Raja, Kirstie Hawkey, Pooya Jaferian, Konstantin Beznosov, Kellogg S. Booth University of British Columbia Vancouver, Canada {fahimehr,hawkey,pooya,beznosov}@ece.ubc.ca, ksbooth@cs.ubc.ca 1. INTRODUCTION Personal ﬁrewalls are recognized as the ﬁrst line of de- fense for personal computers. However, the protection they aﬀord depends strongly on their correct conﬁguration [4]. Therefore, their usability is key to their eﬀectiveness. In particular, as users become increasingly mobile, it is impor- tant for them to be able to judge whether their computer is secure enough for the usage context at hand [2]. Our prior research [5] revealed that the lack of an ac- curate mental model about the ﬁrewall’s system model is one of the root causes of users’ errors when conﬁguring the ﬁrewall. The results of a laboratory study showed that an improved user interface design that incorporated feedback about the state of the ﬁrewall in diﬀerent network contexts could help users develop more eﬀective mental models of the ﬁrewall and improve their understanding of ﬁrewall’s conﬁg- uration, resulting in fewer dangerous errors. However, we also learned that a large proportion of users did not see the need for multiple proﬁles based on context. In this research, our goal is to better understand users’ knowledge, expectations, perceptions, and misconceptions of personal ﬁrewalls. We conducted interviews with 30 par- ticipants and analyzed the data using qualitative descrip- tion [7]. The results from 10 interviews are presented in [6]. In this paper we present our aggregated results and examine their implications for the design of personal ﬁrewalls. 2. METHODOLOGY We conducted semi-structured interviews to answer the following research questions: 1) What do users know and what misconceptions do they have about personal ﬁrewalls and the protection provided by them? 2) What expectations do users have of an application such as a personal ﬁrewall? 3) How do users prefer to interact with an application such as a personal ﬁrewall (i.e., the level of automation, feedback)? 4) Do the users need to have diﬀerent levels of protection for an application such as a personal ﬁrewall? Why? and 5) What factors, do the users think, aﬀect their required level of protection from an application such as a personal ﬁrewall? We recruited 30 participants from both the university and general community. They had a wide range of edu- cational levels, backgrounds, and occupations. Almost all (28) used a laptop in a variety of network contexts. We classiﬁed their security knowledge and experience into three categories: high (H), medium (M), and low (L) in order to examine their expectations, perceptions, and misconcep- tions of a personal ﬁrewall in relation to their level of security knowledge and expertise. Table 1 shows their demographics. Group L M H Total Security Level Low Medium High N/A Group Size (N) 13 11 6 30 Age Mean 28.4 26.5 26.2 27.3 Range 20-51 22-32 26-27 20-51 Gender Female 9 3 1 13 Male 4 8 5 17 Student Yes 5 6 4 15 No 8 5 2 15 Table 1: Participants’ demographics. 3. RESULTS None in group L knew about the functionality of a ﬁrewall. Their comments show their misconceptions about the pro- tection provided by diﬀerent security software. Most of them did not know whether or not they had a ﬁrewall on their computer. All in group H and 6 in group M had previous experience conﬁguring a ﬁrewall. Others in group M were not sure about the functionality of a ﬁrewall. Some com- ments from these participants show that they faced problems in conﬁguration of their ﬁrewall (e.g., in allowing a printer connection), which resulted in them turning the ﬁrewall oﬀ. We examined if participants’ required level of protection from their personal ﬁrewall varies depending on the context. All in group H and 7 in group M wanted varying levels of protection based on their activity (e.g., online banking vs.