Human-oriented computer security

糟糕的网络安全影响到每个人，从个人到大公司、非营利组织或政府机构。虽然许多安全事件都有人为因素，但这些事件通常可以追溯到系统设计和配置，这些设计和配置忽略了人为能力和实际使用环境，从而对用户提出了不合理的要求。就像网络协议对网络中断或丢失的数据包具有弹性一样，我建议安全系统应该具有弹性，能够适应人类的行为。我的研究项目与这种以人为本的计算机安全有关。主要目标是确定现实世界安全机制中的优势和漏洞，开发改进的设计并了解其安全性和可用性含义，并确定适用于一般可用安全空间的基本设计原则。本基金将探讨以下三个主题。领域专家，如安全分析师或软件开发人员，并不是典型的终端用户，并且在可用安全性方面经常被忽视。然而，工具不可用或不充分的后果可能对整个网络或全球部署的软件造成毁灭性的影响。第一个研究方向包括通过开发工具来改进对安全代码审查的支持，这些工具可以帮助程序员检测安全漏洞，确定安全修复的优先级，并鼓励代码的协作审查，这在一定程度上受到了敏捷软件工程方法的启发。第二个方向涉及安全分析师，他们必须经常合并多个数据集，找到它们之间以前未确定的关联，并共享专业知识。我们打算探索这种协作工作，并设计新的大型数据集安全可视化。我们已经进行了大量的研究，以了解基于知识的身份验证的人为因素和安全影响，并将继续努力寻求现实世界的解决方案。例如，我们最近将注意力转向儿童用户认证，这是一个在研究界几乎没有受到关注的主题。我们正在努力建立一个儿童友好的认证方案和一个亲子密码管理器，以解决自主权和隐私的需求，同时确保父母的一些监督。在更多的探索性研究中，我们对物联网设备的可用安全性和隐私性以及对智慧城市的影响感兴趣。这个新兴领域对最终用户具有重要的可用隐私和安全含义，并提供了在新技术的设计仍然灵活的情况下影响其实现的机会。

Effects of poor cybersecurity impact everyone, from individuals to large corporations, not-for-profit organizations, or government agencies. While many security incidents have a human component, these can frequently be traced back to system designs and configurations that placing unreasonable demands on users by ignore human capabilities and real-world context of use. In the same way that network protocols are resilient to network interruptions or dropped packets, I suggest that security systems should be resilient and adaptable to human behaviour. My research program relates to such human-oriented computer security. The main objectives are to identify strengths and vulnerabilities in real-world security mechanisms, to develop improved designs and understand their security and usability implications, and to identify foundational design principles applicable to the general usable security space. For this grant, the following three themes will be explored.Domain experts such as security analysts or software developers are not typical end-users and are often overlooked in terms of usable security. However, consequences of unusable or inadequate tools can be devastating for entire networks or for software deployed worldwide. A first research direction includes improving support for security code reviews by developing tools to help programmers detect security vulnerabilities, prioritize security fixes, and encourage collaborative reviewing of code, partially inspired by Agile software engineering methods. A second direction relates to security analysts who must frequently merge several data sets, find previously undetermined associations among them, and share expertise. We intend to explore such collaborative work and devise new security visualization of large data sets.We have conducted significant research into understanding the human factors and security implications of knowledge-based authentication, and will continue working towards real-world solutions. For example, we have recently turned our attention to user authentication for children, a subject which has received almost no attention in the research community. We are working towards a child-friendly authentication scheme and a parent-child password manager addressing the need for autonomy and privacy while ensuring some parental oversight. In more exploratory research, we are interested in the usable security and privacy for the Internet of Things devices and implications for Smart Cities. This emerging area has significant usable privacy and security implications for end-users, and offers opportunity to affect the implementation of new technologies while their design is still flexible.