5
Overarching Challenges to Advancing Research in Usability, Security, and Privacy

Four overarching challenges facing researchers working in the field of usability, security, and privacy were apparent in the presentations and discussions at the workshop. Although these challenges apply to many emerging research areas, they are particularly relevant to research on usability, security, and privacy.

INCONSISTENT TERMINOLOGY AND DEFINITIONS

Participants in the breakout sessions devoted considerable time and attention to terminology and definitions. “Usable security” was the term frequently used to capture the notion of security measures developed with attention to usability considerations. Another commonly used term was “HCI-SEC” (human-computer interaction–security). Whatever the specific term used to describe the intersection of usability, security, and privacy, each participant tended to define the area in relation to his or her own background. Interestingly, usability practitioners tended to stress security issues, and security practitioners tended to stress usability issues.

Adding “privacy” to the mix complicated matters still further, as definitions of privacy were frequently based on personal philosophies and experience, perhaps reflecting the deeply personal way in which many individuals approach privacy issues. Moreover, some workshop participants noted that although some activities, such as the annual Symposium on Usable Privacy and Security mentioned above, explicitly call out both terms, neither “usable security” nor “HCI-SEC” explicitly invokes issues



The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 37
5 Overarching Challenges to Advancing Research in Usability, Security, and Privacy Four overarching challenges facing researchers working in the field of usability, security, and privacy were apparent in the presentations and discussions at the workshop. Although these challenges apply to many emerging research areas, they are particularly relevant to research on usability, security, and privacy. INCONSISTENT TERMINOLOGy AND DEFINITIONS Participants in the breakout sessions devoted considerable time and attention to terminology and definitions. “Usable security” was the term frequently used to capture the notion of security measures developed with attention to usability considerations. Another commonly used term was “HCI­SEC” (human­computer interaction–security). Whatever the specific term used to describe the intersection of usability, security, and privacy, each participant tended to define the area in relation to his or her own background. Interestingly, usability practitioners tended to stress security issues, and security practitioners tended to stress usability issues. Adding “privacy” to the mix complicated matters still further, as definitions of privacy were frequently based on personal philosophies and experience, perhaps reflecting the deeply personal way in which many individuals approach privacy issues. Moreover, some workshop partici ­ pants noted that although some activities, such as the annual Symposium on Usable Privacy and Security mentioned above, explicitly call out both terms, neither “usable security” nor “HCI­SEC” explicitly invokes issues 

OCR for page 37
 TOWARD BETTER USABILITY, SECURIY, AND PRIVACY OF IT related to privacy, despite the technical and policy links between the two concerns. Some may immediately associate privacy issues with the term “security,” but this is not universally true. Agreeing to a common defini­ tion or term that was inclusive of the concept of privacy proved challeng ­ ing throughout the workshop. LIMITED ACCESS TO DATA Several workshop participants cited the need for more and better empirical data and commented on the difficulties that they faced in gain ­ ing access to such data. For example, data on industry or government com­ puter system security breaches are generally unavailable—corporations are hesitant to disclose this information owing to the potential threat to reputation, stock price, and ongoing business; and information about breaches to government computer systems is frequently treated as sensi ­ tive or classified. Even data on matters less touchy than security breaches cannot be readily obtained. Participants noted, for example, the difficulty in obtaining data on the productivity impacts of security measures. Even when researchers are able to obtain data, nondisclosure agreements may restrict their ability to publish their results. If researchers do gain the ability to work with corporate data, an additional challenge is that of conducting research in a way that enables repeatability. SCARCENESS OF ExPERTISE AND uNFAMILIARITy WITH EACH OTHER’S WORk AT THE INTERSECTION OF uSAbILITy, SECuRITy, AND PRIvACy Many of the workshop participants commented that working in the area of usability, security, and privacy is especially challenging because of the need for researchers who are familiar with both computer security and human­computer interaction. These were, at least until recently, con­ sidered distinct disciplines—most security researchers have traditionally ignored usability issues, and vice versa (and likewise for usability and privacy). One consequence is unfamiliarity with each other’s work. Throughout the workshop, there were frequent instances in which either a computer security or a usability expert would identify a research question outside his or her area of expertise, only to receive immediate feedback from rel­ evant experts that this particular question had already been addressed. “I did not know that that research existed” was a common lament heard at the workshop. Although this immediate feedback was useful to the workshop participants, it also suggests there may be a significant lack of knowledge about usability­related work among security researchers and

OCR for page 37
9 OVERARCHING CHALLENGES about security­related work among usability researchers (with a similar situation existing with respect to usability and privacy). Another conse ­ quence pointed out by workshop participants is that valuable resources may be spent re­researching questions that are already well understood. Still another consequence is that although a few interdisciplinary research collaborations have emerged, there remain few individuals in either area with sufficient expertise to identify their counterparts on the other side—and fewer still with expertise in both areas. Research fund ­ ing at the intersection would foster the development of such expertise by training graduate students and attracting young faculty.

OCR for page 37