Download as PDF, PPTX
Uploaded byRachel Ilan Simpson
Usable security
The document discusses the challenges of usable security, emphasizing that human factors such as memory, attention, and cognitive load contribute to security vulnerabilities. It highlights issues with password management, phishing susceptibility, and the importance of user-friendly security measures. The authors propose strategies for improvement, including flexibility in security prompts and timely communication to better inform users.
![[Webinar Slides] Flexibility vs. Control: How to Work Beyond Corporate Firewa...](https://cdn.slidesharecdn.com/ss_thumbnails/flexibilityvs-160914164500-thumbnail.jpg?width=640&height=640&fit=bounds)
Usable security
- 1. USABLE SECURITY RACHEL SIMPSON(@RILAN) & GUY PODJARNY (@GUYPOD)
- 2.
- 4. 0 0 03 4 1 HIT COUNTER
- 9. FOR DIGITAL SECURITY,THE STAKES HAVE NEVER BEEN HIGHER.
- 11. ARE USERS REALLYTHE WEAKEST LINK?
- 12.
- 13.
- 14. USABLE SECURITY WHAT’S ONTHE AGENDA? ▸ Why do people do what they do? ▸ Passwords ▸ HTTPS errors ▸ SSL Interstitials ▸ Phishing ▸ Takeways
- 15. ARE USERS REALLYTHE WEAKEST LINK?
- 16.
- 17.
- 18. USABLE SECURITY HUMAN FACTORS ▸Memory ▸ Attention
- 19. USABLE SECURITY HUMAN FACTORS ▸Memory ▸ Attention ▸ Cognitive load
- 20. USABLE SECURITY HUMAN FACTORS ▸Memory ▸ Attention ▸ Cognitive load ▸ Previous context
- 21.
- 22.
- 27. 130 ACCOUNTS PER AMERICANUSER BLOG.DASHLANE.COM
- 29.
- 30. MEMORY IS ALIMITED RESOURCE
- 31. WE USE PASSWORDSTHAT ARE HARD FOR HUMANS TO REMEMBER, BUT EASY FOR COMPUTERS TO GUESS XKCD WWW.XKCD.COM/936
- 32.
- 33. FROM SPLASH DATA’SWORST PASSWORDS OF 2015 ATTACKERS ENUMERATE USERNAMES WITH COMMON PASSWORDS ▸ 123456 ▸ password ▸ 12345 ▸ 12345678 ▸ qwerty ▸ 123456789 ▸ 1234 ▸ baseball ▸ dragon ▸ football
- 35. WHAT CAN WEDO?
- 38. Photo by MateuszAdamowski
- 40.
- 41. (BUT NOT TOOFLEXIBLE) TAKEAWAY #1
- 42.
- 47. ATTENTION IS FOCUSED ONTHE TASK AT HAND
- 50. BE TIMELY &MEANINGFUL TAKEAWAY #2
- 51.
- 53. 63% CONTINUED THROUGH THEWARNING EXPERIMENTING AT SCALE WITH GOOGLE CHROME’S SSL WARNING
- 57. 38% CONTINUED THROUGH THEWARNING EXPERIMENTING AT SCALE WITH GOOGLE CHROME’S SSL WARNING
- 58.
- 59.
- 60.
- 61.
- 62.
- 63. THERE’S NO PATCHFOR HUMAN STUPIDITY Trolls GENERAL INTERNET WISDOM
- 64. 23% AVERAGE OPEN RATE THREATSIMSTATE OF THE PHISH STUDY
- 65. 11% AVERAGE CLICK THROUGHRATE THREATSIM STATE OF THE PHISH STUDY
- 66. YOU DON’T KNOWWHAT YOU DON’T KNOW.
- 67. USERS DO NOTGENERALLY PERCEIVE THE ABSENCE OF A WARNING SIGN. Chrome Security Team MARKING HTTP AS NON-SECURE
- 69. HOW BAD ISPHISHING REALLY?
- 70.
- 71.
- 72.
- 73. OUR LAST PHISHING EXAMPLE GUYGETS PHISHED
- 74. WHAT CAN WEDO?
- 75.
- 77.
- 78. BE MORE FLEXIBLE BETIMELY & MEANINGFUL OFFER AN OPINION USABLE SECURITY
- 79. BE MORE FLEXIBLE BETIMELY & MEANINGFUL USABLE SECURITY
- 80. BE MORE FLEXIBLE BETIMELY & MEANINGFUL OFFER AN OPINION USABLE SECURITY
- 81. WE’RE HIRING! RACHEL SIMPSON @RILAN GUYPODJARNY @GUYPOD
- 82. USABLE SECURITY RESOURCES ▸ Transformingthe ‘weakest link’ – a human/computer interaction approach to usable and effective security (M A Sasse, S Brushoff, D Weirich) ▸ Learning from “Shadow Security” (Iacovos Kirlappos, Simon Parkin, M. Angela Sasse) ▸ Users are not the enemy (Anne Adams, Martina Angela Sasse) ▸ Experimenting at scale with Google Chrome’s SSL Warning (Adrienne Porter Felt, Hazim Almuhimedi, Sunny Consolvo) ▸ Improving SSL Warnings: Comprehension & Adherence (Adrienne Porter Felt, Alex Ainslie, Robert W. Reeder, Sunny Consolvo, Somas Thyagaraja, Alan Bettes, Helen Harris, Jeff Grimes) ▸ The Emperor’s New Security Indicators (Stuart E. Schechter, Rachna Dhamija, Andy Ozment, Ian Fischer)