Usable and Secure Software Design: The State-of-the-Art

Abstract

This chapter reviews the current state-of-the-art in the design of usable and secure systems. This chapter should not be considered as a state of the art review of usability and security in general, and HCI-Security (HCI-Sec) in particular. For those readers interested in such a review, I would recommend [1]. I begin by identifying several common themes in the design of effective information security and reviews work by the HCI-Sec community towards designing usable security. Based on limitations in this existing work, I take a step back and review the prevalent HCI concepts available for designing usable and secure systems, including research on integrating these ideas with Software Engineering, and the potential consequences of these approaches to security. Because the concept of Requirement is shared by both the security and usability communities, I review how existing work in Security Requirements Engineering might be cogent to the design of usability. In particular, I review several dominant Requirements Engineering approaches, and consider issues which may arise when viewing them from a usability perspective. I also introduce the concept of a framework and illustrate how existing Requirements Engineering frameworks deal with eliciting security and usability concerns. I conclude this chapter with a brief review of the available tool-support for facilitating Usability and Security Requirements Engineering activities.