syssec_red_book

10.4. What Is the Worst That Can Happen?create secure systems without isolating them from external influences—asApple does with the App Store, for instance. Even then, a reluctant user whoignores updates, for example, can still fall victim to various attacks. It is,therefore, the research community’s task to consider how a possible solutionto a given problem might be easily adopted by the end-user.10.4 What Is the Worst That Can Happen?To take this thought even further, let us consider the two most extreme cases.In a hypothetic scenario, security precautions are so complicated to utilize,that no ordinary user is actually using them. Instead, every online action isconsidered a public process. Consequently, the Internet for ordinary userswould lose a lot of potential and decrease to a pure information-retrievalfacility. Netbanking, online booking, or even private messaging would not bepossible anymore.In the other extreme case, users would be forced to use all available securitymechanisms, for instance by a security policy. The result would essentially bethe same. With more restrictions and access control, usability decreases to apoint where it is no longer feasible to even use a device. An example couldbe online banking, that can only be used from a single IP address over a VPNtunnel, where passwords have to be changed with every login and one-timesecurity tokens are sent to a mobile device. While this method would certainlybe more secure than a conventional login/password, it would cause most usersto fall back to conventional manual wire transfers.In reality, such an extreme case will hopefully never occur. Still, there is anatural balance between usable security mechanisms and convenience. Thisbalance also exists in corporate systems, where security experts are confrontedwith the task to decide where to put the bar between user restrictions andsecurity.10.5 State of the ArtSo, what is the situation today? This question can obviously not be answeredwith a simple good or bad. In 2005, Gutmann et al. made a very astute observation:a little more complexity is acceptable for a fair offering in value [202].It ultimately comes down to exactly this question. A security mechanism, ifnot enforced by the system itself, will only be accepted if it offers a certaindegree of added value. Usually, a trade-off between usability and security hasto be found. A trade-off, however, is always a compromise [112]. The resultis a system that is more complicated than one without security, but still lesssecure than it could be. Although acceptable, such a condition is certainly notdesirable. The optimal case would be a consensus between both categories.75