New Directions in Usable Security

现在生活的大部分都是在线的，涉及安全和隐私的新挑战也出现了。特别是，随着用户数量的增加，以及使用的规模和多样性，人的因素变得越来越重要。“可用安全”领域最初出现的目的是为了使安全软件更易于使用。这一点仍然重要，但该领域现在需要解决更广泛的复杂问题。例如，移动设备和云计算涉及新的和不断变化的使用环境，新的人口现在依赖于计算基础设施，组织现在必须确保安全以保护他们和用户的业务利益。拟议的研究计划将为计算机安全面临的各种人为因素挑战开发和探索实用解决方案的框架。 这项研究计划旨在通过应对新的挑战，将可用的安全转移到更广泛的舞台上。虽然议程可能看起来不同，但有几个基本概念将这项工作联系在一起。一种观点认为，安全性和可用性并不一定是对立的，但可以通过设计将两者联系起来，从而使安全的结果也是最容易的途径。我们还在我们的工作中利用了几个理论框架，特别是分布式认知的想法，其中软件从用户身上卸载负担，以及软件支持的特殊支持角色允许用户将注意力集中在关键问题上。最后，我们的工作有一个共同的经验焦点：我们研究真实的系统和使用环境，设计实用软件，进行冷静的评估，并以减少危害为目标。

Much of life is now online, and new challenges have arisen involving security and privacy. In particular, the human factor has become increasingly important with the increase in the number of users, and the scale and diversity of usage. The field of "usable security" initially emerged to address making security software easier to use. This continues to be relevant, but the field now needs to address a wider range of complex issues. For example, mobile devices and cloud computing involve new and ever-changing contexts of use, new populations now rely on computing infrastructure, and organizations must now ensure security to protect their business interests and those of their users. The proposed research program will develop and explore a framework for practical solutions across the spectrum of human factors challenges to computer security. This research program is intended to move usable security onto a wider stage by addressing new kinds of challenges. While the agenda may seem diverse, there are several underlying concepts that unite the work. One is the idea that security and usability are not necessarily opposed, but can be connected by design that makes the secure outcome also the easiest path. We also leverage several theoretical frameworks across our work, in particular the idea of distributed cognition, where software offloads burden from the user, and special supporting roles supported by software allow users to devote undivided attention to key concerns. Finally, our work has a common empirical focus: we study real systems and usage environments, design practical software, conduct dispassionate evaluation, and aim for harm reduction.