Security and Usability 65
ewuehler writes "I don't think I've ever heard a security application, be it a consumer anti-virus application or an enterprise IPS application, described as "user-friendly" or "easy to use". When I read the title of the O'Reilly book Security and Usability: Designing Secure Systems That People Can Use, I took the bait and requested a copy for review. The title could also double as my current job description, so I was equally interested from a "job education" point of view. The book is a collection of (mostly) academic articles, grouped in sections and chapters. Each article/chapter is written by different authors; from Bruce Tognazzini who founded Apple's Human Interface Group to Blake Ross of Firefox fame to names previously unknown to me. Read on for ewuehlers' review.
| Security and Usability | |
| author | Edited by Lorrie Faith Cranor & Simson Garfinkel |
| pages | 714 |
| publisher | O'Reilly |
| rating | 8 |
| reviewer | Eric Wuehler |
| ISBN | 0-596-00827-9 |
| summary | Designing Secure Systems That People Can Use |
Along with the variety of authors, their backgrounds are equally diverse. The majority of the articles come from academia, with a few corporate names and open source authors. While not exclusively US authors, the majority of the articles come from US institutions. Generally, I would expect the "new author every chapter" approach to be a distraction, but the editors have done a good job at grouping the articles and cross-referencing chapters where appropriate. However, I did not find this a cover-to-cover read, the book lends itself well to "flipping and skipping" around.
The editors claim the goal of the book is "first for researchers in the field of security of usability, then for students, and finally for professionals." While I fit in the "professionals" category (not a term I'd use, but I had to pick one of the three), I found the information very helpful and educational with respect to my current job. With a majority of the chapters coming from an academic perspective, there is room for debate and interpretation of the conclusions. For example, several chapters discuss the fallibility of passwords, making it obvious the issue of password security is not just simply whether or not to write them down.
The book is divided into six parts. The first, Realigning Usability and Security, introduces the premise of the book. These five chapters discuss the importance of usability when designing security applications. It is well known that the human element is "the weakest link in the chain" of system security. For example, "Kevin Mitnick revealed that he hardly ever cracked a password, because it 'was easier to dupe people into revealing it' by employing a range of social engineering techniques. He points out that to date, attackers have paid more attention to the human element in security than security designers have." The implication being the less usable the security, the less likely it will be used correctly, no matter how good it actually is. The chapters go on to describe different processes for designing usable secure systems and applications.
The Authentication Mechanisms section discusses the usability requirements around passwords and other authentication techniques. The information in this section dealt more with implementation than theory as compared to the other sections. The expected chapters covering the prevailing forms of authentication; text passwords, challenge questions, graphical passwords, and biometrics are there. I found most interesting the chapter Identifying Users from Their Typing Patterns. This refers to "keystroke biometrics" which "seeks to identify individuals by their typing characteristics." The concept has been around for a while and first suggested for identification in 1975. (Random fact I found interesting, it finds its roots in 19th century telegraph operators who could often identify each other by listening to the rhythm of each individual's Morse code keying pattern.) Despite the fact that the concept has been around for quite a while, it does not seem to appear much on the authentication mechanism radar.
Secure Systems is the "make or break" section covering the secure user experience. These chapters cover things such as fighting "phishing" at the user interface, making PKI easy, and "deleting" files vs. really deleting files. One of the more interesting chapters looks at security tools and practices based on ethnographic field studies. While ethnography (the study of customs of individual peoples and cultures) initially does not sound like a "security or usability" issue, it is used (and the author claims quite effectively) to understand "the work practices of computer users in context, informing the design of computer systems to better suit their needs."
The section Privacy and Anonymity Systems contains a chapter discussing Google's Gmail privacy policy with respect to "informed consent". For the most part, the authors give Gmail high marks, with the privacy concerns rooted in differing definitions of "privacy". For example, if you believe that content-targeted advertisements should require the consent of all parties involved, you (in sending an email to a Gmail user) have not consented to the targeted ads the recipient sees. The chapter describes two other cases of informed consent and presents a list of ten design principles based on the information. Another chapter discusses leveraging social processes for managing browser cookies. The concept being when a cookie is saved stored, it will provide you aggregate community data such as X percent of the people visiting this site blocked the cookie. One obvious benefit is the ability to educate "less knowledgeable" users about "good" cookies vs "bad" cookies.
The remaining sections discuss usability of products, for which the chapter titles are description enough. Overall, I found the book useful. The variety of authors and subject matter made it easy to skip around and choose what piqued my interest at the time. Along with the academic feel of the book, each chapter is generally descriptive enough to get an idea as to what subject matter will be covered. While the book's target is "researchers and students" first, as a "professional" working for a security company, I found it helped me better explain the pros and cons of these topics to the less technical people I work with every day. I'd recommend it to anyone involved with the usability of security applications and systems."
You can purchase Security and Usability from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
Re:Buy it HERE! (Score:3, Funny)
Re:Buy it HERE! (Score:3, Funny)
"security applications and systems" only?? (Score:5, Informative)
Re:"security applications and systems" only?? (Score:5, Informative)
The adage that security is the opposite of usability is false, of course. The problem is that people aren't very good at making intelligent design decisions when faced with both sets of requirements.
There is a great paper on this subject by Ka-Ping Yee here [berkeley.edu] (PDF link).
Re:"security applications and systems" only?? (Score:3, Insightful)
IMHO they generally are. Having worked at a secure facility, it is expensive and inconvenient. That trickles all the way down to the desktop PC, having apps broken by firewalls, not being able to install software needed to get the job done, being unable to get access to network services I need because I can't keep track of dozens of randomly generated passwords that change every 6 months, having a computer that runs like molasses
Re:"security applications and systems" only?? (Score:5, Insightful)
If the security guys had to take responsibility for the indirect costs of their policies, I believe we would see a marked improvement in the usuability of the facilities being secured, probably bringing with it an increase in actual security because there would be less incentive for people to do bad things like write down a list of their 15 different passwords and what not.
Re:"security applications and systems" only?? (Score:1)
There would be no security.
Re:"security applications and systems" only?? (Score:3, Interesting)
They either get away with them, or the users find subtle ways to work around them, thus negating the policy completely. Either that or the users ignore the policy completely. The best security policies are the ones you can explain to the people who are affected by it and ha
Re:"security applications and systems" only?? (Score:2)
Re:"security applications and systems" only?? (Score:2)
But don't you see, the inconvenient password-protected applications you mention wouldn't need passwords at all if not for security.
It's true that a particular app can be more secure and more usable than another particular app; insecurity certainly doesn't guarantee usability! So, yes, I think a book like the one being discussed could be a great thing. Besides, in the real world security is sometimes more important tha
Re:"security applications and systems" only?? (Score:3, Informative)
Bibliography (Score:2)
Unfortunately it hasn't been updated for some years, but it's a good starting point for someone looking to put together a more complete bibliography.
Interesting (Score:3, Insightful)
Re: (Score:3, Funny)
The point is, it's usually not stupidity (Score:2)
Industrial and aerospace safety made their big improvements when they stopped blaming accidents on stupidity (or more politely, "pilot error" or "operator error"). Professionals in those fields took a step back and investigated whether the "stupid" user was even getting the information s/he needed, whether that information was being buried by irrelevancies, and whether the user was trained to understand the system well enough to build a correct
not called "easy to use" because... (Score:2, Interesting)
In fact, lim v->oo s/v = 0, where s=security and v=variables in your environment. No real security, but you try.
I cringe when I see all those books at the local computer mart with titles like "TCP/IP Security" with a cheesy rainbox-colored logo beside it that says "Made Easy" in an italic font. Publishers actually think people trying to secure networks will be fooled by a logo that belongs on a home decorating book or manual can opener package?
Having ranted, I'm sure the O'Reilly book
Re:not called "easy to use" because... (Score:1)
Re:not called "easy to use" because... (Score:5, Insightful)
security != easy.
But security doesn't have to be hard, either. Look at desktop firewalls. I last looked at them (zone, sygate, symantec)maybe two years ago, so perhaps they have gotten better, but, user install it and all of a sudden they get a bunch of pop-ups asking if this or that can access the internet and do you want to let it. No context, no explaination, your lucky if you can get the file path. So users start saying yes and pretty soon, that desktop firewall is swiss chese. Couldn't the vendors have at least profiles Windows services and common applications and told the user something like "The Windows Messenger service is trying to listen for connections. If your a home user, you probably don't need this, so say No. If your an company user, ask your IT staff if you need it." rather than some long path. That's useability.
What about all the vendors selling home internet firewalls? Most home users don't need a firewall, they need a NAPT router. If they are running games or an on-line service, then perhaps they need to port forward, but all the rest of that stuff is cruft. But for $50 more you can get a stateful firewall. You don't need it, but you can get it.
These are examples of making the deploymnet of security needlessly complex. Oh, and it gets no better in enterprise security.
There is a lot that could be done to make security easier to deploy while still being robust.
Re:not called "easy to use" because... (Score:2)
Maybe so, but ZoneAlarm free edition, at any rate, has some extraordinarily foolish shortfalls.
For instance, if you update Windows or your AV/AS software and ZA gives you the "This program has changed since it last ran" message, ZA won't tell you what settings you had for the program before it was updated.
Also, despite ZoneLa
The errors in your reasoning (Score:3, Insightful)
Security is a process, not a product. More on this below.
Now.... People usually say "there is a tradeoff between usability and security." What they really mean is "There is a tradeoff between
Re:not called "easy to use" because... (Score:1, Funny)
Re:In case of slashdotting (Score:2, Funny)
Social Engineering Becoming More Serious (Score:4, Insightful)
The "social engineering" concerns that were brought up in the paragraph about Mitnick have now become large-scale issues that affect everyone from site operators to end-users. Every phishing attack is essentially a social engineering attempt. Many worms, from "I Love You" on to the current IM worm, spread by convincing each new recipient that they're safe to execute— again, a social engineering attack.
It's too bad this 714-page book probably won't be read by the average end-user; the fact that the current IM worm is still spreading is ample proof that users still aren't sufficiently aware of social engineering issues. And that affects all of us; the spam I just cleared out of my inbox probably came through a zombie machine that got infected by just such a worm.
Re:Social Engineering Becoming More Serious (Score:3, Interesting)
Re:Social Engineering Becoming More Serious (Score:2, Insightful)
> You can have a system that requires users to have a 20 character randomly
> generated password, as well as a smart card, and they will still pass their
> password around along with their card, which will have the password written
> on the back.
Don't miss the correlation here. If you require users to have a 20 character randomly generated password, how could they remember it? Like rational beings presented with an impossible problem, they wouldn't--they'd write it down.
When security peop
Re:Social Engineering Becoming More Serious (Score:2)
Re:Social Engineering Becoming More Serious (Score:2)
> they want, many will choose a short, easy to guess password.
A good password needs to have some significant randomness in it and
people are really bad judges of randomness. Even some pretty nerdly
folks can be really näive on this.
> I guess if they don't have to write it down, then it's more secure
> than a 20 character password which they do write down, but it is
> still very insecure.
What's wrong with writing down a pass
"new author every chapter" (Score:2, Interesting)
On the other hand, sometime you can really tell that one author wrote a book and was interested in the topic - i.e., Component Development for the Java Platform [awprofessional.com] by Stuart Halloway comes to mind. This was an excellent book for intermediate to advanced Java programmers and Stuart's interest in
Residential products (Score:1)
Security and usability are mutually exclusive (Score:2, Interesting)
Re:Security and usability are mutually exclusive (Score:2)
Re:Security and usability are mutually exclusive (Score:1)
Re:Security and usability are mutually exclusive (Score:1)
Aha, here goes the point. One can pare down a software system by limiting the number of situations in which the software is supposed to work correctly. This is not possible in security -- you can limit what you do, not what a malicious adversary can do. It is a much scarier situation to deal with, and that is why crypto is hard.
Re:Security and usability are mutually exclusive (Score:2)
Re:Security and usability are mutually exclusive (Score:1)
you're in the wrong realm (Score:2)
(Unfortunately for this comment, I've promised not to do any astro-turfing for my company
Re:Security and usability are mutually exclusive (Score:1, Interesting)
Firewalls? (Score:3, Interesting)
Then again, once the little popup messages start rolling in, they have a few questions for me, but all in all I'm impressed with the ease of use.
Re:Firewalls? (Score:5, Insightful)
What the hell if the Subsystem spooler? Can it be used by other programs to avoid detection? I have no idea. It would be nice if Zone Alarm spend an once of effort explaining what all these things were.
Instant Messaging (Score:3, Informative)
Re:Instant Messaging (Score:1)
It may be possible to make something that is both incredibly easy to use and secure but this is definitely not it.
Why security can't be easy to use (Score:3, Insightful)
In contrast, the easiest systems require no passwords, no authentication, and let the user do anything they want to any file, anywhere. But that is not secure.
Yet I'd argue that security can be made easier. Single sign-on and password keychains help (although these arguably reduce security somewhat). The bigger solution is goal-oriented UIs, not mechanism-oriented UIs. Current security often assumes that the user understands the internals of the system -- that particular ports provide particular functions or vulnerabilities. Easy-to-use security software would guide the user is defining what they want to allow or disallow and hide technical details of how that is implemented.
Even if we add a wonderful UI to security, it will never be perfect. Security is about saying "no", ease of use is about saying "yes." To that extent, the gap between security and ease-of use is permanent.
Re:Why security can't be easy to use (Score:1)
True — but so is usability. It improves both security and usability to ensure that desirable events do happen and undesirable events don't happen.
Real usability isn't about "adding a wonderful UI" to things. Real usability means changing what the system requires you to know, changing how the system forces you to do things, and changing how the system responds to your actions,
Usable security app example (Score:2)
It's essentially a network monitor app similar to Zone Alarm for the PC but IMHO 1000% more usable.
When a request is made either by an app on your machine or from a remote machine to access a port, Snitch pops up a dialogue that asks you whether you want to allow or deny it, for that port or all ports, until the app quits or forever.
This simple selection is enough to cover 99% of all cases. ie: if
I found user-friendly and absolutelly secure! (Score:2, Funny)
It's called a power switch!
Once you fleep it "off", you can be sure your system is safe!
Are Usability & Security Opposites in Computin (Score:1)