CT-ISG: Usable Cyber Trust Indicators

当系统依赖于“人在回路中”来执行安全关键功能时，网络信任指标通常用于传达何时以及如何执行该功能。 指示器通常用作警告或状态指示器，用于传达信息，提醒用户先前传达的信息，并影响行为。它们包括操作系统状态栏或浏览器Chrome中的各种安全和隐私相关符号、弹出警报、安全控制面板或嵌入Web内容中的符号。然而，越来越多的文献发现，其中许多指标的有效性相当令人失望。这项研究系统地研究了网络信任指标的有效性，并制定了使这些指标最有效和可用的方法。 研究人员正在使用认知心理学的“心理模型”方法来研究专家和非专家个人电脑用户如何理解常见的网络信任指标。他们还使用来自警报科学的“通信-人类信息处理”（C-HIP）模型来构建他们的评估，并提供对人类信息处理步骤的见解，在这些步骤中，警报最有可能失败。他们正在使用一种迭代设计过程，为几种常见的应用程序开发改进的指标，并评估这些指标的有效性。预期的结果包括一套具体的建议，以改善一套共同的网络信任指标，一套设计模式，设计有效的网络信任指标，以及一个课程模块，教学生如何设计有效和可用的网络信任指标。

When systems rely on a "human in the loop" to carry out a security-critical function, cyber trust indicators are often employed to communicate when and how to perform that function. Indicators typically serve as warnings or status indicators that communicate information, remind users of information previously communicated, and influence behavior. They include a variety of security- and privacy-related symbols in the operating system status bar or browser chrome, pop-up alerts, security control panels, or symbols embedded in web content. However, a growing body of literature has found the effectiveness of many of these indicators to be rather disappointing. This research is systematically studying the effectiveness of cyber trust indicators and developing approaches to making these indicators most effective and usable. The researchers are using cognitive psychology's "mental models" approach to study how both expert and non-expert personal computer users understand common cyber trust indicators. They are also using the "Communication-Human Information Processing" (C-HIP) model from warnings science to structure their evaluation and provide insights into the human information processing steps at which a warning is mostly likely to fail. Using an iterative design process, they are developing improved indicators for several common applications and evaluating the effectiveness of these indicators. The expected results include a set of specific recommendations for improving a set of common cyber trust indicators, a set of design patterns for designing effective cyber trust indicators, and a curriculum module for teaching students how to design effective and usable cyber trust indicators.