可用的安全Usable Security.pdf

Usable Security Mary Theofanos September 10, 2015 Cyber Security can only be achieved in partnership with users. What is Usability? ISO 9241-210 “Usability: The extent to which a product can be used by specified users to achieve specified goals with effectiveness, efficiency, and satisfaction in a specified context of use.” Definition Identifies How to Proceed: What to measure How to measure • Users • Effectiveness • Goals • Efficiency • Context of Use • Satisfaction 1st Tenet of Usability: Know thy User! Many different user groups:  Policy Makers/Corporate decision makers/investors  Cyber Security researchers/developers/implementers  CIO’s and those who implement cyber within an organization  End users 4 Set out to understand our end users? We found our end users:  Don’t have a good mental model of security or privacy Are overwhelmed with passwords What We Did Interviewed 40 people about: Gender 21-29 30-39 40-49 50-59 60+ Total Experiences with Males 4 1 2 9 3 19 online privacy Females 5 6 6 2 2 21 and/or security Total 9 7 8 11 4 40 Use of mental models as they Area HS Some BA/BS BA+ JD/PhD/ College MA/M MD think about S privacy and/or Central 0 2 6 2 2 1 security in th