Users Are Not The Enemy

• PDF
• Authors
  • Anne Adams
  • Martina Angela Sasse

Abstract

Abstract

Many system security departments treat users as a security risk to be controlled. The general consensus is that most users are careless and unmotivated when it comes to system security. In a recent study, we found that users may indeed compromise computer security mechanisms, such as password authentication, both knowing and unknowingly. A closer analysis, however, revealed that such behavior is often caused by the way in which security mechanisms are implemented, and users’ lack of knowledge. We argue that to change this state of affairs, security departments need to communicate more with users, and adopt a user-centered design approach.

Notes

• Human factors should be considered in the design of security protocols
• Many complaints about password policies
  • Very focused on passwords in general, actually
• Security is there to protect users, so should have user-centred design

Quotes

Quote

the conclusion that this behavior occurs because users are inherently careless and therefore insecure needs to be challenged