Tag Archive for: or human–computer interaction

You are here: / or human–computer interaction

Posts

An Annotated Bibliography of Human-Computer Interaction Security (HCISec) Body of Works 3/3

An annotated bibliography is a bibliography that gives a summary of a body of work such as an article, research or thesis. The purpose of annotations is to provide the reader with a summary and an evaluation of the source. Each summary should be a concise exposition of the source’s central idea and give the reader a general idea of the source’s content.

HCISec is the study of interaction between humans and computers, or human–computer interaction, specifically as it pertains to information security. Its aim, in plain terms, is to improve the usability of security features in end user applications.

An annotated bibliography was conducted on 5 bodies of work focused on HCISec and Usability Security.

 

Annotated Bibliography

Sasse, M. and Flechais, I. (2005). Usable Security: Why do we need it? How do we get it?. O’Reilly Media Inc.

This article begin with a common theme used in many HCISec and Usability Security literature by stating users are the weakest link in the chain of system security. The authors further explained how the famous hacker Kevin Mitnick hardly ever had to crack a password, since it was easier to trick users to tell him with the use of social engineering. The author also explained as the system become more complex, they become harder to configure, manage and maintain. The errors become issues; increasing the chance of poorly configured systems and improper management, therefore reducing the security of the system.

The author introduces the principle of psychological acceptability that states security controls should not make accessing the resources more difficult than it would be if the security control were not present. The author also provides various examples, for example, passwords add minimal overhead for the user, providing it is easy to remember. To allow for effective security, the password must be difficult. Therefore, a balance must be in place. If a password is too long and hard, the user will resort to writing it down, if a password is too simple a hacker can guess it and compromise the system. The author also discusses the process in patching a system should be transparent to the user. That is not always the case on system with custom code or when system reacts adversely to the patch.

The article concludes by stating, the information from the examples provided are key to implementing the principle of psychological acceptability based systems.

Greiter, F. (2011). Situated Usability Testing for Security Systems. Pacific Northwest National Laboratory. PNNL-2-201

The article explains usable security is a concept that has emerged to ensure the security and privacy of computer systems while usability refers to how well a system supports the user’s needs and its ability to accomplish a task. The author acknowledge, while usability testing is a common practice, usability of security software needs more consideration.

The author examines why the common computer user may lack confidence in the security system they use or why they often circumvent the security mechanisms in places. He describes the concept of primary goal and secondary goal into the discussion. Primary goal pertains to completing a task, for example, sending an email or producing a document. The secondary goal pertains to adding the layer of security needed for the primary functions. Often the user may not be focused on the secondary goal even though it may be just as important as the primary goal. Recent research depicts users forced to implement security task, but the authors concludes the introduction of bias is added. The author states the security issues must be concealed behind the primary goal, thus making the software more acceptable to the user. Differing setups between the real-world environment and the testing environment will conclude conflicting data.

The author provided an example using online banking requiring different security controls. The primary task is the completion of the transaction, but the secondary task is the authentication that must occur beforehand. In the study, the author depicted an online banking scenario were security was employed, but the primary focus was not security. In other environments, the more difficult the secondary task, the less likely it will be implemented.

Ackerman, S. and Mainwaring, S. (2005). Privacy Issues and Human-Computer Interaction. O’Reilly and Associates.

The paper reviews privacy being a key aspect of the user experience when online as well as on computing devices by examining how users view computer system to aid in improving privacy through Human-Computer Interaction (HCI).

The authors explain, privacy is the process in which users can effectively control personal data and like security, it contains risk. To build a system that takes user’s privacy into consideration, the core HCI rules must be examined. For example, basic design consideration, reviewing how users interact with and through the system, how users differ in their capabilities and lastly, the role of HCI in next generation architecture.

The authors surveyed current computer-supported cooperative work (CSCW) literature related to privacy and discovered as people interested in privacy area aware, people have very nuanced views of their interactions with other people and find it problematic when those social interactions are constrained.

Other applications have cause concerns in CSCW privacy such as, shared calendar. Users may access a manager’s calendar to conclude information about a company’s hiring or lay off status. These privacy concerns are being research to understand the balance between information awareness and information privacy. It was stated in the article, awareness requires the release of personal information, thus conflicting with privacy.

The authors concluded there are a number of research areas in the field of HCI that can help design better privacy mechanisms such as usable evaluations and requirements gathering.

Schultz, E. (2006). Research on Usability in Information Security.

The article states, usability engineering focuses on optimizing the interaction between humans and the tasks they perform. The author explains, even though authors in the field argue for the need to consider usability when applied to software, in actuality, there are very few papers displaying results to the fact.

The author, examines research in the area of usability and discusses their findings. For example, a review conducted on Whitten and Tygar (1999) looked into the usability problems within PGP 5.0. This is one of the first researches that incorporated the balance between usability and security. PGP is email encryption software and in the test, users were allotted 90 minutes to digitally sign and encrypt an email. A majority of the test subject failed to do so. It was concluded, even though PGP had an attractive graphical user interface, there were a number of user design weaknesses.

The author also examined the usability problems in firewalls. Configuring a firewall is often a resource intensive task. Rules in the firewall determine what various systems and network in an organization interact with the outside world. Using a graphical user interface can ease the process and provide a more usable implementation.

The author concludes, the review he examined is but a subset of the total research conducted in the usability security space, but notes the total amount of research is still not enough. All is the above reviews point to the need for attention in the human-factors in information security related task.

 

An Annotated Bibliography of Human-Computer Interaction Security (HCISec) Body of Works 2/3

An annotated bibliography is a bibliography that gives a summary of a body of work such as an article, research or thesis. The purpose of annotations is to provide the reader with a summary and an evaluation of the source. Each summary should be a concise exposition of the source’s central idea and give the reader a general idea of the source’s content.

HCISec is the study of interaction between humans and computers, or human–computer interaction, specifically as it pertains to information security. Its aim, in plain terms, is to improve the usability of security features in end user applications.

An annotated bibliography was conducted on 5 bodies of work focused on HCISec and Usability Security.

 

Annotated Bibliography

Kluever, K. (2008). Evaluating the Usability and Security of a Video CAPTCHA. Rochester Institute of Technology. Master of Science Thesis

The thesis discusses the security and usability of a Completely Automated Public Turning Test to Tell Computers and Humans Apart (CAPTCHA), which is a variation of the turning testing, used to determine humans from computers. The author provides a new approach in which the users provide three words that describe a video. The author states, many users find the traditional form frustrating and carry a break rate of approximately 6o percent.

The author explains, in order to evaluate the success of a CAPTCHA, a list of desirable properties must first be established. The following sets of properties include, automation, in which the machine can generate and grade challenges on its own. The second property is “Open” which pertains to the algorithm be publicly available. “Usable” is the third property and it pertains to challenges should be easily and quickly solved the humans and lastly, it should be secure. The author performed an experiment in which 184 participants where used on over 20 videos. The author was able to increase humans pass rates of the CAPTCHA video from 69.7% to 90.2%.

The author does state limitations and assumptions in the experiment. For example, it is language dependent with English tags needed to determine the human subjects. In addition, the video from the online database exposes the ID of the video and lastly, the usability and security analyses are preliminary assumptions.

The author concluded only 20% of the participant preferred text-based CAPTCHA while 58% preferred the video-based alternative. The author also presented how extending the ground truth tags allowed for different usability and security trade-offs.

Patrick, A., Long, A. and Flinn, S. (2003). HCI and Security Systems. CHI 2003, April 5-10. ACM 1-58113-630-7/03/0004

The authors explain, the human factor is often the weakest part of a security system and users are often thought of the weakest link in the security chain. The goal is to provide other researchers and software developers with an understanding of the roles and demands place on users as well as provide design solutions to assist with the creation of secure and usable system.

The authors state, three areas of interest includes authentication, security operations and developing secure systems for security. The authors stated, authentication, the most common form of security consisting of using username and password is the weakest link due to the human factor. Users tend to use guessable passwords, write them down or even forget them. In security operations, the human factor is not just focused on the end-user; system operators can also improperly implement solution to open security flaws. Lastly, developing security systems is critical. If developers do not create user-friendly systems, it will not sell. However, if developers create a secure system, user may try to circumvent to increase usability. The authors states, usability and security are often thought to be contrary to each other is not the case by recent research from Yee (2002). In Yee (2002), he provided ten HCI design principles that can be used to improve the usability of security.

The authors concluded the goal is to build a cohesive and activate the HCISEC community researchers and practitioners. The authors further states, security is a large topic so there are many areas where Chisel in important.

Flechais, I. (2005). Designing Security and Usable System. PhD. Dissertation. University of London

The thesis aimed to investigate the process of designing secure systems and how developers can ensure security controls are effective and usable at the same time. The article reiterate a common notation that users are the weakest link within information security and the result of an unusable user interface with result in ineffective security. The author explained, while HCISec had identified the need to improve usability in computer systems, most of the research is this area are addressing the issue by improving user interface to security tools. The thesis provides an interesting insight into the cause of data breach by suggesting, research efforts to address human factors in security have concluded that security mechanisms are too difficult to use, and that most users do not maliciously break security policies, but do so as a result of bad design.

The author states, the thesis does not seek to evaluate security system design, instead it plan to evaluate the Appropriate and Effective Guidance for Information Security (AEGIS). AEGIS is a secure system design technique that actively adopts a socio-technical approach in order to assist developers in designing secure systems. Thus, any research that will affect design methods are difficult in the empirical form. The author conducted the research in two parts, first, he identified the issues in the development process of the secure systems and secondly, the presentation and evaluation of a socio-technical design method for secure systems.

The results from the research identified important factors for usable security; the model provides insight into real-world issues and will be useful into improving current and future secure system design methodologies.

An Annotated Bibliography of Human-Computer Interaction Security (HCISec) Body of Works 1/3

An annotated bibliography is a bibliography that gives a summary of a body of work such as an article, research or thesis. The purpose of annotations is to provide the reader with a summary and an evaluation of the source. Each summary should be a concise exposition of the source’s central idea and give the reader a general idea of the source’s content.

HCISec is the study of interaction between humans and computers, or human–computer interaction, specifically as it pertains to information security. Its aim, in plain terms, is to improve the usability of security features in end user applications.

An annotated bibliography was conducted on 3 bodies of work focused on HCISec and Usability Security.

 

Annotated Bibliography

Piazzalunga, U. & Salvaneschi, P. (2006). How to test usability of security sensitive systems.

This paper focuses on providing information to individuals responsible for conducting and ensuring security within an organizations’ application system for end-user use. The specific target audiences addressed in the paper are information security testers and software developers. In the article, the authors present a test methodology that can be used to assess that a proper balance between usability and security is in place.

Within the article the authors explains by using a define set of metrics and the approach of the quality models (ISO 9126 1991); they are able to create a usability test method. The literature review includes the following steps. First, purpose, context and roles definitions. This part defines the aims of the test and sets the limits as well. Secondly, user selection and task definitions were the selection criteria are set and defined. Thirdly, measurement apparatus design in which the usability attributes, metrics and relationship are computed. Fourthly, conduct the execution and the collection of date, followed by the processing for statistical significance. Finally, a computation of the quality attributes scores using the ISO 9126 quality model and conducts an interpretation of the results to support design recommendations.

The author selected 10 participants whom were either second or third year engineering students with computer knowledge but no experience in processing secure email for the user test. Before commencing the test, the researchers introduced each participant to the test scenario and required task.

The conclusion indicates that the number of hardware components users have to deal with increases the complexity and negatively affect security. Furthermore, the authors suggest the methodology used can be applied to any end-user security system.

Soriano, M. and Ponce, D. (2002). A Security and Usability Proposal for Mobile Electronic Commerce. IEEE Communication Magazine. 0163-6804/02

In this article, the authors provide information pertaining to key proposals that will allow security and usability in the mobile electronic commerce industry. It investigates three basic aspects to conduct effective mobile commerce such as business and service delivery, timely information and immediate completion of transaction.

The article explains end-to-end security as well as speed of information delivery is necessary conditions for mobile electronic commerce. By using constraints in conjunction to mobile agent technology, improvements to the overall systems can occur. The authors also suggest the users should have the following facilities in place such as negotiation and immediate delivery, fast methods of micro and macro payment and usability on the mobile environment.

The author went into depth discussing the wireless environment and its limitation to provide adequate security for mobile electronic commerce use. By using the Wireless transport layer security protocol, they were able to determine that secure channels between the clients and the WAP gateway occurred, but the channel between the WAP gateway and the Internet is supported by TLS that does not guarantee privacy and data integrity.

The authors introduced an alternate approach for end-to-end security in the mobile e-commerce environment. They described, in order to provide a secure end-to-end tunnel between the Internet and the mobile user a modified version of WAE called WAE-Sec. WAE-Sec would provide end-to-end security, be TLS compliant, it would also be transparent to the user and avoid double compression and translation for performance purposes.

The authors conclude advancements in wireless data communication as well as in portable devices allow for unlimited access to information and services anytime and anywhere. Developers should be aware of the limitations within mobile devices and the unpredictable communication medium they use. The limitations provide challenges that are not in traditional client-server approaches to electronic commerce solutions.

Graham, C. (2012). Address Security, Collaboration, and Usability with Tactical Edge Mobile Devices and Strategic Cloud Base Systems. Defense Transformation and Net-Centric Systems. 10.1117/12.919410

This paper discusses security, collaboration and usability of cloud-based data on mobile devices that will be used in the battlefield. The target audience on the article pertains to military based organization with a mandate to produce for military customers in the current reduced budget placed on them.

The author explains the three tenants are necessary components of a successful system. The security, privacy and data integrity must be ensured in the battlefield, effective collaboration must also be ensured so mission objectives are not jeopardized and lastly usability must be achieved and complexity reduces on the mobile devices used is the field.

The author also explains the use of cloud-based services in the model, using Software as a Service (SaaS) as the primary focus. SaaS a software delivery model for mobile cloud interaction is based on create, read, update and delete services. It can be compare to social media applications such as LinkedIn and Twitter. Security is another aspect covered by the author explaining the importance of the mobile environment. For example, the need for OS trustworthiness, application/device management, user management and additional security capabilities all work to address the protection levels.

The author concludes by explaining the differences between user interface and user experience. In user interface, the concern focuses on the interaction the user has with the system, while user experience address all facets of the end-user’s usage of a computer system. He further expresses, when creating a mobile interface, avoiding a complex interface is of the highest importance. The author provides two key concepts to usability. Never listen to the users and simple flourishes, while complex dies.