Security Practitioners in Context: Their Activities and Interactions with...
This study investigates the context of interactions of IT security practitioners, based on a qualitative analysis of 30 interviews and participatory observation. We identify nine different activities...
View ArticleUsability Meets Access Control: Challenges and Research Opportunities
This panel discusses specific challenges in the usability of access control technologies and new opportunities for research. The questions vary from “Why nobody, even experts, uses access control lists...
View ArticleRevealing Hidden Context: Improving Mental Models of Personal Firewall Users
The Windows Vista personal firewall provides its diverse users with a basic interface that hides many operational details. However, concealing the impact of network context on the security state of...
View ArticleRevealing Hidden Context: Improving Mental Models of Personal Firewall Users
The Windows Vista personal firewall provides its diverse users with a basic interface that hides many operational details. However, concealing the impact of network context on the security state of the...
View ArticleUser Centered Design of ITSM Tools
IT Security Management (ITSM) requires collaboration between diverse stakeholders, has an environment of numerous technological and business specializations (is complex), has many issues that need to...
View ArticleRevealing Hidden Context: Improving Users' Mental Models of Personal Firewalls
Windows Vista’s personal firewall provides its diverse users with a basic interface that hides many operational details. However, our study of this interface revealed that concealing the impact of...
View ArticleA Multi-method Approach for User-centered Design of Identity Management Systems
Identity management (IdM) comprises the processes and infrastructure for the creation, maintenance, and use of digital identities. This includes designating who has access to resources, who grants that...
View ArticleA Case Study of Enterprise Identity Management System Adoption in an...
This case study describes the adoption of an enterprise identity management(IdM) system in an insurance organization. We describe the state of the organization before deploying the IdM system, and...
View ArticleTowards Developing Usability Heuristics for Evaluation of IT Security...
Evaluating the usability of specific information technology (IT) security tools is challenging. For example, laboratory experiments can have little validity due to the complexity of real-world security...
View ArticleInvestigating an Appropriate Design for Personal Firewalls
Personal firewalls are an important aspect of security for home computer users, but little attention has been given to their usability. We conducted semi-structured interviews to understand...
View ArticleInvestigating User Account Control Practices
Non-administrator user accounts and the user account control (UAC) approach of Windows Vista are two practical solutions to limit the damage of malware infection. UAC in Windows Vista supports usage of...
View ArticleDo Windows Users Follow the Principle of Least Privilege? Investigating User...
The principle of least privilege requires that users and their programs be granted the most restrictive set of privileges possible to perform required tasks in order to limit the damages caused by...
View Article"I did it because I trusted you": Challenges with the Study Environment...
We recently replicated and extended a 2009 study that investigated the effectiveness of SSL warnings. Our experimental design aimed to mitigate some of the limitations of that prior study, including...
View ArticleExpectations, Perceptions, and Misconceptions of Personal Firewalls
In this research, our goal is to better understand users' knowledge, expectations, perceptions, and misconceptions of personal firewalls. We conducted interviews with 30 participants and analyzed the...
View ArticleThe Challenges of Understanding Users’ Security-related Knowledge, Behaviour,...
In order to improve current security solutions or devise novel ones, it is important to understand users' knowledge, behaviour, motivations and challenges in using a security solution. However,...
View ArticleChallenges in evaluating complex IT security management systems
Performing ecologically valid user studies for IT security management (ITSM) systems is challenging. The users of these systems are security professionals who are difficult to recruit for interviews,...
View ArticleIt's Too Complicated, So I Turned It Off! Expectations, Perceptions, and...
Even though personal firewalls are an important aspect of security for the users of personal computers, little attention has been given to their usability. We conducted semi-structured interviews with...
View ArticleToward Understanding Distributed Cognition in IT Security Management: The...
Information technology security management (ITSM) entails significant challenges, including the distribution of tasks and stakeholders across the organization, the need for security practitioners to...
View ArticlePromoting A Physical Security Mental Model For Personal Firewall Warnings
We used an iterative process to design personal firewall warnings in which the functionality of a firewall is visualized based on a physical security mental model. We performed a study to determine the...
View ArticleHeuristics for Evaluating IT Security Management Tools
The usability of IT security management (ITSM) tools is hard to evaluate by regular methods, making heuristic evaluation attractive. However, ITSM occurs within a complex and collaborative context that...
View ArticlePassword Managers, Single Sign-On, Federated ID: Have users signed up?
Users have not signed up for OpenId. This presentation describes results of interviews with some 50 participants of several user studies on Web SSO.
View ArticleHeuristics for Evaluating IT Security Management Tools
The usability of IT security management (ITSM) tools is hard to evaluate by regular methods, making heuristic evaluation attractive. However, standard usability heuristics are hard to apply as IT...
View ArticleA Brick Wall, a Locked Door, and a Bandit: A Physical Security Metaphor For...
We used an iterative process to design firewall warnings in which the functionality of a personal firewall is visualized based on a physical security metaphor. We performed a study to determine the...
View ArticleTowards Supporting Users in Assessing the Risk in Privilege Elevation
To better protect users from security incidents, the principle of least privilege (PLP) requires that users and programs be granted the most restrictive set of privileges possible to perform the...
View ArticleInvestigating Users' Perspectives of Web Single Sign-On: Conceptual Gaps and...
OpenID and OAuth are open and simple web single sign-on (SSO) protocols that have been adopted by major service providers, and millions of supporting websites. However, the average user's perception of...
View Article
