Authors:
Giampaolo Bella
1
;
Karen Renaud
2
;
Diego Sempreboni
3
and
Luca Viganò
3
Affiliations:
1
Dipartimento di Informatica, Università di Catania and Italy
;
2
Division of Cybersecurity, University of Abertay Dundee, U.K., University of South Africa and South Africa
;
3
Department of Informatics, King’s College London and U.K.
Keyword(s):
Beautiful Security, User Survey, Formal Analysis, Cyber Security.
Related
Ontology
Subjects/Areas/Topics:
Formal Methods for Security
;
Human Factors and Human Behaviour Recognition Techniques
;
Information and Systems Security
;
Information Assurance
;
Security in Information Systems
;
Security Metrics and Measurement
;
Security Protocols
;
Security Requirements
;
Security Verification and Validation
Abstract:
“Beautiful Security” is a paradigm that requires security ceremonies to contribute to the ‘beauty’ of a user experience. The underlying assumption is that people are likely to be willing to engage with more beautiful security ceremonies. It is hoped that such ceremonies will minimise human deviations from the prescribed interaction, and that security will be improved as a consequence. In this paper, we explain how we went about deriving beautification principles, and how we tested the efficacy of these by applying them to specific security ceremonies. As a first step, we deployed a crowd-sourced platform, using both explicit and metaphorical questions, to extract general aspects associated with the perception of the beauty of real-world security mechanisms. This resulted in the identification of four beautification design guidelines. We used these to beautify the following existing security ceremonies: Italian voting, user-to-laptop authentication, password setup and EU premises acce
ss. To test the efficacy of our guidelines, we again leveraged crowd-sourcing to determine whether our “beautified” ceremonies were indeed perceived to be more beautiful than the original ones. The results of this initial foray into the beautification of security ceremonies delivered promising results, but must be interpreted carefully.
(More)