Press Release


Email. Email press release link

September 23, 2005

Security and Usability: Designing Secure Systems that People Can Use

Sebastopol, CA--Conventional wisdom dictates that there must be a tradeoff between security and usability. To illustrate the point, Lorrie Faith Cranor, DSc, and Simson Garfinkel, Ph.D., contrast a computer with no passwords with one "that makes you authenticate every five minutes with your password and a fresh drop of blood." The former is usable, but not secure, while the latter is secure but holds little appeal to most users. In their new book, Security and Usability (O'Reilly, US $44.95), Cranor and Garfinkel contend that security and usability are not inherently at odds; in fact, tomorrow's computers won't be secure unless researchers, designers, and programmers can invent new ways to make security systems easier to use.

"As the world around us makes clear every day, if people are unable to use secure computers, they will use computers that are not secure," Cranor and Garfinkel remark in the preface to their book. Although theoretically secure, computers that aren't usable do little to improve the security of their users because these machines push users to less secure platforms. "As it turns out, the converse is also true: systems that are usable but not secure are, in the end, not very usable either," they note. This is because these systems don't last: they get hacked, compromised, and otherwise rendered useless.

"Having each worked in the area of security for the better part of two decades, it has become increasingly clear to us that the question of usability is among the most important in determining the overall security of a system, yet it is also one of the issues that is most frequently ignored," observes Garfinkel. "Although it has long been recognized that security systems need to be usable, there has been astonishingly little work done in this area to date. Indeed, some scientists have gone so far as to say that usability and security are inherently at odds, and in building secure systems it is necessary to figure out just how much usability needs to be given up.

"We don't believe this," Garfinkel continues. "We believe that it is possible, through the use of good research and practice, to build systems that are both secure and usable. This book is a guide to practitioners on how to do that, as well as a guide to researchers regarding which directions are likely to bring more fruitful results."

In the first book to be focused entirely on the subject of usability and security, Cranor and Garfinkel present thirty-four groundbreaking essays from leading security, usability, and human-computer interaction (HCI) researchers around the world. Balancing theory and fundamental principles with practical advice, they examine this important issue in detail.

"In order to build systems that are both secure and usable, it is important to have some understanding of both the computer security field and the human-computer interaction field. Most researchers and practitioners have been trained in only one of these fields. Our hope is that this book can help bridge the gaps for them and fill in some of the important background they need to work in this interdisciplinary area," says Cranor.

Security and Usability offers a window into the future of computer security where usable design and secure systems are no longer at odds.

Topics include:

  • Realigning usability and security: psychological acceptability, designing for actual (not theoretical) security, tools for usability evaluation, and trust designs and models
  • Authentication mechanisms: password memorability, challenge questions, graphical passwords, biometrics, keystroke dynamics, smart cards, and USB tokens
  • Secure systems: secure interaction design, anti-phishing, sanitization and usability, usable PKI, compartmentalized security, and ethnographic analysis
  • Privacy and anonymity systems: privacy design pitfalls, the Privacy Space Framework, the Platform for Privacy Preferences (P3P), web bugs, informed consent on the Internet, social approaches to security, and anonymizing technologies
  • Commercializing usability: vendor experiences in addressing usability issues at Microsoft, IBM/Lotus, Firefox, Zone Labs, and Groove Networks
  • Security and Usability brings together research findings, actual implementation experiences, practical advice, and recommendations for constructing next-generation operating systems. This volume is sure to become a classic reference and an inspiration for further research.

    Additional Resources:

    Security and Usability
    Edited by Lorrie Faith Cranor and Simson Garfinkel
    ISBN: 0-596-00827-9, 714 pages, $44.95 US, $62.95 CA
    order@oreilly.com
    1-800-998-9938; 1-707-827-7000

    About O'Reilly

    O'Reilly Media spreads the knowledge of innovators through its books, online services, magazines, and conferences. Since 1978, O'Reilly Media has been a chronicler and catalyst of cutting-edge development, homing in on the technology trends that really matter and spurring their adoption by amplifying "faint signals" from the alpha geeks who are creating the future. An active participant in the technology community, the company has a long history of advocacy, meme-making, and evangelism.

    Return to: O'Reilly Press Room

    Recent Press Releases


    8/4/14 O'Reilly Media Acquires Full Ownership of Safari Books Online
    2/26/14 Solid Heralds the Merging of the Physical and Virtual Worlds
    2/4/14 O'Reilly Media & Safari Books Online Donate Over $100 Million in Technology Education Resources to US K-12 Schools
    12/3/13 Windows 8.1: The Missing Manual--New from O'Reilly Media
    11/20/13 iPad: The Missing Manual, 6th Edition--New from O'Reilly

    Press Release Archive »

    Resources

    Press Contacts

    Corporate

    Sara Winge
    800/998-9938 x7109

    Media Relations - North America

    Sara Peyton
    800/998-9938 x7118

    Media Relations - Germany

    Corina Pahrmann
    +49-221-973160-22

    Media Relations - Japan

    Kenji Watari
    +81-3-3356-5227

    Media Relations - United Kingdom

    Helen Coding
    +44 (0)1252-721284

    Media Relations - Conferences

    Maureen Jennings
    800/998-9938 x7083