Thursday, July 16, 2009

SOUPS 2009 Mental Modes Session: Study Demonstrates that Pursuit of Seamless Security can Lead to New Dangers, Particularly for Mobile Users



"The Windows Vista personal firewall provides its diverse users with a basic interface that hides many operational details. However, concealing the impact of network context on the security state of the firewall may result in users developing an incorrect mental model of the protection provided by the firewall." Fahimeh Raja, University of British Columbia

SOUPS 2009 Mental Modes Session: Study Demonstrates that Pursuit of Seamless Security can Lead to New Dangers, Particularly for Mobile Users

Paul Van Oorschot of Carelton University in Ottawa chaired the Mental Models session.

Fahimeh Raja of University of British Columbia (Vancouver) presented Revealing Hidden Context: Improving Mental Models of Personal Firewall Users, co-authored with her colleagues, Kirstie Hawkey and Konstantin Beznosov.

The goal of the study was to investigate the impact of adding contextual information to the Vista Firewall Basic Interface. The researchers looked at the impact of Vista Firewall functionality on users' mental models, as well as the impact of Vista Firewall configuration on users' understanding.

"The Windows Vista personal firewall provides its diverse users with a basic interface that hides many operational details. However, concealing the impact of network context on the security state of the firewall may result in users developing an incorrect mental model of the protection provided by the firewall."

Raja and her colleagues determined that because the security technology makes changes in the users' security state, it is important to somehow communicate these changes to users; "otherwise, these users can be left in dangerous situations; for example, only protected in the current network context but believing themselves to be protected for future network contexts."

Users could think that their firewall was turned on when it was turned off, or conversely, that their firewall was turned off when it was turned on.

"Users need to understand the effect of the configuration on the system's security state. We argue as users become more mobile, it is increasingly important to understand the security state for both current and future contexts of use."

They concluded that the design of the Vista Firewall Basic Interface does not provide enough context for mobile users. If unaware that configuration changes only apply to current network location, users may be left with dangerous misconceptions. The researchers also concluded that users' mental models can be supported by revealing context.

The implications of this study are important, i.e., it may be possible to balance complexity and security.

Two other papers were presented in this session:

Andrew Besmer of University of North Carolina (Charlotte) presented Social Applications: Exploring A More Secure Framework, a paper co-authored with colleagues Heather Richter Lipford, Mohamed Shehab and Gorrell Cheek, also from the Department of Software and Information Systems.

Ponnurangam Kumaraguru of Carnegie Mellon University CyLab presented on School of Phish: A Real-Word Evaluation of Anti-Phishing Training, a paper co-authored with fellow Carnegie Mellon researchers Justin Cranshaw, Alessandro Acquisti, Lorrie Cranor, Jason Hong, Mary Ann Blair and Theodore Pham.

Some Related Posts:

SOUPS 2009 Best Paper Award Goes to "Ubiquitous Systems and the Family: Thoughts about the Networked Home"

SOUPS 2009 Tutorial Explores Challenges of Evaluating Usable Security and Privacy Technology

CyLab Seminar Series Notes: User-Controllable Security and Privacy -- Norman Sadeh asks, "Are Expectations Realistic?"

CyLab Research Update: Locaccino Enables the Watched to Watch the Watchers

CyLab Chronicles: Wombat, the Latest CyLab Success Story

CyLab Chronicles: Q&A w/ Norman Sadeh

CyLab Chronicles: Q&A w/ Lorrie Cranor

Culture of Security: CUPS Research Takes on Both Widespread Attack Method & Dangerous Meme (Available to Cylab Partners Only)

For further commentary on SOUPS 2009, go to the CUPS Blog.

-- Richard Power