Users Are Not the Enemy Anna Adams Martina

Users Are Not the Enemy Anna Adams Martina Angela Sasse

Overview n n n n Introduction The Study Users Lack Security Knowledge Security Needs User-Centered Design Motivating Users and Password Behavior Recommendations Conclusion

Introduction n Confidentiality of computer security Identification n Authentication n n Password Security Key element is crack ability of password combination n Should have several criteria for password security n

Password Security n Password composition n n Password lifetime n n What type of characters used for passwords Changing passwords frequently Password ownership Increase individual accountability n Reduce illicit usage n Allow for an establishment of system usage n Reduce frequent password changes n

The Study n Web-based questionnaire n n Focused on password behaviors 4 factors influencing effective passwords Multiple passwords n Password Content n Perceived compatibility with work practices n Users’ perceptions of organizational security and information sensitivity n

The Study What was found n Multiple passwords n n Writing them down Poor design Linked passwords Password Content n n n No feed back from security experts Own rules for passwords Password restrictions n n Increase password disclosures Ways to circumvent restrictions

The Study What was found cont. n Compatibility between work practices and password procedures n n Not being informed of security issues n n Shared passwords Guided by what they see 2 main problems in password usage Systems factors n External factors n

Users Lack Security Knowledge n Need-to-know Principle The more know about security the easier it is to attack n Users not informed n Password behaviors n Correct password content n Cracking n n Not told of security breaches

Users Lack Security Knowledge n Misunderstanding of login process Confuse user identification with passwords n Think IDs are part of password n Using physical attributes that don’t require ID recall n Combine physical attributes with remote access to systems n

Security Needs User-Center Design n To achieve good user-center design in security mechanisms n n communication with users is needed Security has to think about the users n n n Requiring many passwords create usability problems Frequently changed passwords increase disclosure Need to take into account passwords used out of the office

Motivating Users n Simplistic Approach to user authentication Restricts data by identification and authentication n Does not work well for group work n n Authoritarian Approach to user authentication n Led to security departments reluctance to communicate with users with regard to work practices

Motivating Users cont. n n n Individual ownership of passwords increases accountability and decreases illicit usage of passwords If users perceive they are using shared passwords this increases groups responsibility and accountability Password mechanism has to be compatible with work practices

Motivating Users cont. n n Most users are security conscious just need to think that security is important Need to forget about Need-to-Know If done could lead to security leaks n Can also motivate users of real problems n n n Need to have communication between security department and users This is the only area in IT in which user training is not regarded as essential

Users and Password Behavior n Major problems with Security Insecure work practices n Low security motivation n n Personal thinking vs. drills and punishment Security procedures must work with user work practices Security departments have to see how their mechanisms are used in practice

Recommendations n Password Content Provide training on usable and secure passwords n Provide constructive feedback on password construction n n Multiple Passwords Reduce number of passwords n 4 or 5 passwords max n Smart cards when using multiple passwords n

Recommendations cont. n Users’ Perception of Security n n n System security needs to be visible to all Inform users of existing and potential threats Users awareness needs to be maintained over time Provide guidance as to which systems and information are sensitive and why Work Practices n Password mechanisms need to match organization and work procedures

Conclusion n Communication between security department and users Limiting passwords n Creating secure passwords n Sharing security issues n n n The users are not the enemy of security Users can help solve the problem Questions ?