Towards Cognitive Aids For Stronger Computer Security

系统提供的安全性会受到用户行为的极大影响。这种影响在计算机安全的许多领域都可以观察到，比如用户选择弱密码的密码系统，用户已经学会忽略的应用程序安全警告，以及开发人员可能编写不安全代码的软件开发环境。在这些应用程序和许多其他应用程序中，用户理解安全注意事项所需的认知努力是非常重要的；因此，许多用户不太可能投入所需的时间和精力。不幸的是，许多安全实践者期望用户意识到安全注意事项，如果没有，用户将投入足够的认知努力来学习并采取相应的行动。这些有问题的期望激发了我的研究计划，其目的是通过创建可用的软件工具来帮助人们实现更强的安全性，并减少他们的认知负担（即认知辅助）。我的研究计划的目标是为用户创造新的解决方案和认知辅助，以在不同的环境（例如，web，移动和关键系统，如智能电网）中实现更强的安全性。我目前的重点是用户身份验证和安全软件开发领域。对于用户身份验证，我的重点是新颖的密码系统和创建策略，旨在减少选择安全和可记忆密码的认知负担。例如，用于帮助用户选择安全且容易记忆的文本密码的交互式密码指导系统，以及旨在增强人类记忆自然优势的新型密码系统（通过使用丰富的语义或视觉线索，如故事、视频和数字地图）。为了解决软件中的安全问题，我的研究旨在采取一种主动的方法，防止软件开发过程中的安全漏洞。目前，开发人员的认知负担很高，因为他们的任务是及时创建功能强大的高性能代码；安全方面的考虑进一步增加了这种负担。我的研究提出了易于使用的软件工具，这些工具几乎不需要培训，可以帮助开发人员轻松增强代码的安全性。

The security offered by a system can be dramatically influenced by its user's behaviour. This effect has been observed across many areas of computer security such as password systems in which users choose weak passwords, application security warnings that users have learnt to ignore, and software development environments in which developers might write insecure code. In these and many other applications, the cognitive effort required for users to understand security considerations is non-trivial; thus, it is unlikely that many users will invest the required time and effort. Unfortunately, many security practitioners expect that users are aware of security considerations and if not, that users will invest enough cognitive effort to learn and take action accordingly. These problematic expectations motivate my research program, which aims to help people achieve stronger security by creating software tools that are usable and reduce their cognitive burden (i.e., cognitive aids). The objective of my research program is to create new solutions and cognitive aids for users to achieve stronger security in different environments (e.g., web, mobile, and critical systems such as smart grids). My present foci are the areas of user authentication and secure software development. For user authentication, my focus is novel password systems and creation strategies that aim to reduce the cognitive burden of selecting secure and memorable passwords. Examples include interactive password guidance systems for helping users select secure and memorable text passwords, and novel password systems that aim to empower the natural strengths of human memory (by using rich semantic or visual cues such as stories, videos, and digital maps). To tackle security problems in software, my research aims to take a proactive approach by preventing security weaknesses during software development. The cognitive burden currently placed on developers is high as they are tasked with creating functional, high-performance code in a timely manner; security considerations further increase this burden. My research proposes easy-to-use software tools, which require little training, to help developers easily enhance the security of their code.