Software Architect's Handbook

Security must be usable

Legitimate users who are using the software in the way that it was intended to be used should only be impacted to the point that is required to make the system secure. The security controls that are used for a software application cannot be so intrusive that they interfere greatly with the usability of the application. If the security controls that are used are too annoying, users will seek to circumvent them.

A software application must be as secure as it needs to be but it should not be overly secure to the point where usability is ruined. If usability is affected too much, users will not want to use the software.

When designing security controls, we should strive to do so in a user-friendly way. This includes ensuring ...