New Directions in Usable Security

现在生活的大部分都在网上，涉及安全和隐私的新挑战也出现了。特别是，随着用户数量的增加，以及使用的规模和多样性，人的因素变得越来越重要。“可用安全”领域最初是为了解决如何使安全软件更易于使用而出现的。这仍然是相关的，但该领域现在需要解决范围更广的复杂问题。例如，移动设备和云计算涉及新的和不断变化的使用环境，新的人群现在依赖于计算基础设施，组织现在必须确保安全性，以保护他们的业务利益和用户的利益。拟议的研究计划将开发和探索一个框架，为计算机安全的各种人为因素挑战提供实用的解决方案。

Much of life is now online, and new challenges have arisen involving security and privacy. In particular, the human factor has become increasingly important with the increase in the number of users, and the scale and diversity of usage. The field of "usable security" initially emerged to address making security software easier to use. This continues to be relevant, but the field now needs to address a wider range of complex issues. For example, mobile devices and cloud computing involve new and ever-changing contexts of use, new populations now rely on computing infrastructure, and organizations must now ensure security to protect their business interests and those of their users. The proposed research program will develop and explore a framework for practical solutions across the spectrum of human factors challenges to computer security. This research program is intended to move usable security onto a wider stage by addressing new kinds of challenges. While the agenda may seem diverse, there are several underlying concepts that unite the work. One is the idea that security and usability are not necessarily opposed, but can be connected by design that makes the secure outcome also the easiest path. We also leverage several theoretical frameworks across our work, in particular the idea of distributed cognition, where software offloads burden from the user, and special supporting roles supported by software allow users to devote undivided attention to key concerns. Finally, our work has a common empirical focus: we study real systems and usage environments, design practical software, conduct dispassionate evaluation, and aim for harm reduction.