ITR: Usable Security: Towards a Trustable Information Infrastructure

1
ITR Usable Security Towards a Trustable
Information Infrastructure

• Rogério de Paula, Xianghua Ding, Paul Dourish,
  Kari Nies, Ben Pillet, David Redmiles, Jie Ren,
  Jennifer A. Rode and Roberto Silva Filho.
  http//www.isr.uci.edu/projects/swirl/

David F. Redmiles
Paul Dourish

• EFFECTIVE SECURITY
• In exploring the difference between theoretical
  and effective security in the development of
  innovative design principles, we intend to help
  users (1) become security aware and consequently
  (2) securely make informed decisions.

In this project, we developed a peer-to-peer file
sharing test bed application, Impromptu, that
creates effective security by (1) exposing
particular features of the infrastructure to the
interface, rather than hiding, and (2)
integrating configuration and action on the same
interface. We designed, implemented and assessed
this application.
Pie sections represent different users
private file
group persistent files

Our approach helps to reveal the outcomes of
peoples actions, helping them make informed
decisions about their security and privacy needs.
circles represent different sharing levels view,
read-only, read-write, persistent
Impromptu P2P file sharing application.
Comparison to state of the art

• Current approach to security
• focuses on mathematical security guarantees
• is often based on all-or-nothing decisions
• is based on a design proposition that attempts to
  hide security measures and features from the users

• Effective security approach
• focuses on practical security and privacy issues
  people deal with in their everyday work
• integrate configurations and actions, creating
  various levels of security and privacy
• increases user security awareness through
  visualizations, allowing them to take informed
  decision about their current security

• Impromptu is an test bed application built upon
  event-based infrastructures that integrate open
  source implementations of standards, including
  the Jetty HTTP server and Slide WebDAV server.
• It integrates configuration and action in an
  interface that allows users
• To share files between participants of an ad-hoc
  network
• Modify the file sharing level by dragging files
  around
• Visualize security-related activities when others
  read or modify shared files
• Our pilot study shows that Impromptu
• Accommodated various kinds of collaboration -
  each group used it differently
• Provided a strong sense of embodiment and sharing
  - participants assumed a seamless integration
  between applications
• Conveyed a strong sense of others presences -
  participants perceived the presence of new
  members and changed their behavior
• Supported rather than replaced face-to-face
  coordinating and cooperative actions