esigners of security-sensitive software applications sometimes speak of a trade-off between achieving strong security and making software easy to use. When we look for ways to adjust an existing design, usability improvements seem to yield more easily compromised software, and adding security measures seems to make software tedious to use or hard to understand. Yet designers cannot afford to neglect either-both security and usability failures can render a product useless. Conflicts between security and usability can often be avoided by taking a different approach to security in the design process and the design itself. Every design problem involves trading off many factors, but the most successful designs find ways to achieve multiple goals simultaneously. To this end, in this article I discuss when and how we can bring security and usability into alignment through these main points: • Security and usability elements can't be sprinkled on a product like magic pixie dust. We must incorporate both goals throughout the design process. When security and usability are no longer treated as add-ons, we can design them together to avoid conflicts. • We can view security and usability as aspects of a common goal: fulfilling user expectations. This involves maintaining agreement between a system's security state and the user's mental model, both of which change over time. • An essential technique for aligning security and usability is incorporating security decisions into the users' workflow by inferring authorization from acts of designation that are already part of their primary task. I apply these points to three classes of everyday security problems: worms, cookie management, and phishing attacks. Two assumptions frame my discussion. First, I assume a known user, setting aside the problem of authenticating the user. This article will not contribute any insights on authentication. Second, I assume that the parties we intend to serve have a mutually understood framework of acceptable behavior. (Malicious parties might attempt unacceptable behavior, but we are not interested in serving their needs.) For example, if music distributors wish to impose copying restrictions that music listeners find unreasonable, then software designers cannot serve both distributors and listeners without compromising. In such a situation, the conflict stems not from usability issues but from disagreements between people about policy, which is a different problem. Resolving such disputes is outside the scope of this discussion. To understand how security and usability come into conflict during software design, it might be helpful to look at this tension from both points of view. As a security practitioner, you might have been asked to take a nearly complete product and make it more secure. You then know firsthand how difficult and ineffective it is to try to add on security at the last minute. Although we
In a paper advocating Security and Usability together during design to address any concerns with the trade-off between Usability and Security, REF opined that "conflicts between Security and Usability can often be avoided by taking a different approach to security in the design process and the design itself".
Aligning Security and Usability
IEEE Security and Privacy
Computer Science