New Directions in Usable Security

如今，人们的生活大部分都在网上，新的挑战也随之而来，涉及到安全和隐私。特别是，随着用户数量的增加以及使用的规模和多样性，人的因素变得越来越重要。“可用的安全性”领域最初出现是为了解决使安全软件更容易使用的问题。这仍然是相关的，但该领域现在需要解决更广泛的复杂问题。例如，移动的设备和云计算涉及新的和不断变化的使用环境，新的人口现在依赖于计算基础设施，组织现在必须确保安全性，以保护其业务利益和用户的利益。拟议的研究计划将开发和探索一个框架，为计算机安全面临的各种人为因素挑战提供切实可行的解决方案。这项研究计划旨在通过应对新的挑战，将可用的安全性推向更广阔的舞台。虽然议程可能看起来多种多样，但有几个基本概念将工作统一起来。一个是安全性和可用性不一定是对立的，但可以通过设计连接，使安全的结果也是最简单的路径。我们还利用我们的工作中的几个理论框架，特别是分布式认知的想法，其中软件卸载负担从用户，软件支持的特殊支持角色允许用户专注于关键问题。最后，我们的工作有一个共同的经验重点：我们研究真实的系统和使用环境，设计实用的软件，进行dispensable评估，并以减少危害为目标。

Much of life is now online, and new challenges have arisen involving security and privacy. In particular, the human factor has become increasingly important with the increase in the number of users, and the scale and diversity of usage. The field of "usable security" initially emerged to address making security software easier to use. This continues to be relevant, but the field now needs to address a wider range of complex issues. For example, mobile devices and cloud computing involve new and ever-changing contexts of use, new populations now rely on computing infrastructure, and organizations must now ensure security to protect their business interests and those of their users. The proposed research program will develop and explore a framework for practical solutions across the spectrum of human factors challenges to computer security.******This research program is intended to move usable security onto a wider stage by addressing new kinds of challenges. While the agenda may seem diverse, there are several underlying concepts that unite the work. One is the idea that security and usability are not necessarily opposed, but can be connected by design that makes the secure outcome also the easiest path. We also leverage several theoretical frameworks across our work, in particular the idea of distributed cognition, where software offloads burden from the user, and special supporting roles supported by software allow users to devote undivided attention to key concerns. Finally, our work has a common empirical focus: we study real systems and usage environments, design practical software, conduct dispassionate evaluation, and aim for harm reduction.