Week 8 - Usable Security

Question 1

What is the main focus of usable security?

Answer 1

designing security mechanisms that support end users, making it easier for them to follow security practices

Question 2

What does “security as a supporting task” mean?

Answer 2

Security is a secondary task.

Users engage in security tasks (authentication) because they are necessary to achieve their goals

Question 3

What is the difference between a primary task and a secondary task in security?

Answer 3

• primary task is the main goal a user is trying to achieve,
• secondary task (authentication) is something users must do to accomplish their primary goal

Question 4

What is human-centered security?

Answer 4

looking at the human factors behind users’ behavior and decisions when developing secure systems

Question 5

What are the nine guidelines for designing usable secure systems?

Answer 5

• Path of least resistance
• Explicit authorization
• Appropriate boundaries
• Revocability
• Expected ability
• Trusted path
• Identifiability
• Expressiveness
• Clarity

Question 6

What is the “path of least resistance” guideline?

Answer 6

the easiest way for a user to complete a task should also be the most secure.

Question 7

What does “explicit authorization” mean?

Answer 7

users must actively grant permission for actions, preventing unintentional authorization

Question 8

What is the “appropriate boundaries”?

Answer 8

interfaces should clearly distinguish between different objects

Question 9

What is “revocability”?

Answer 9

users should be able to revoke permissions or authorizations they’ve previously granted at any time.

Question 10

What is the “trusted path” ?

Answer 10

communication between the user and servers is secure and authenticated.

Question 11

What does “identifiability”?

Answer 11

distinct objects and actions are clearly distinguishable through the interface,

you can’t spoof them.

Question 12

What is “expressiveness”?

Answer 12

interface is allowed to clearly communicate security policies and enable users to implement their own security preferences,

e.g
setting rules for resource access.

Question 13

What is the “clarity”?

Answer 13

users are clearly informed of the consequences of actions that could affect security,

e.g
receiving warnings about changes in authorization.

Question 14

What is the importance of usability testing in creating secure systems?

Answer 14

essential for ensuring that security features are user-friendly and do not compromise usability