syssec_red_book

10.6. Research Gaps10.6 Research GapsSince the current state-of-the-art for usable security is hard to depict, defininga concrete research gap is equally hard. The underlying problem can, however,be reduced to some more specific issues.10.6.1 Security Design PrinciplesCurrently, there is no such thing as usability guidelines for security researchers.A newly developed method or prototype needs to function in order to berecognized. As already mentioned above, developers and researchers alike,simply lack the incentive to further their development in this direction. Insome cases it does not even make sense. A new method for protocol reverseengineering will certainly not profit from a fancy interface. A new methodfor mitigating injection attacks on web browsers, however, would profit froma seamless, transparent plugin with a simple option to enable it, instead ofa complicated setup procedure, with options that even experts have a hardtime understanding. It would therefore be highly profitable to have a basiccollection of do’s and dont’s for user interaction.10.6.2 Field Study: UsabilityAnother field worth investigating is the usability of already existing solutions.This problem usually arises when someone decides to create a solution that ispartially or completely based on existing solutions. In order not to invent thewheel from the beginning, it makes sense to build upon previously researchedand published techniques. The drawback of this method is that the researcheroften has to deal with prototype implementations or tailored solutions. A fieldstudy of the most recent developments would be of immense help in decidingwhether and how it is possible to use these approaches.10.6.3 Collateral Feasibility ConsiderationsFinally, the most important thing to do is incorporate usability decisions in thedevelopment process right from the beginning. This is something that cannotbe done in a thesis but only by raising the awareness of people designingsecurity solutions. Most companies are forced to do this at some level anyway,otherwise they will simply lose customers. The same does not hold truefor researchers, as they are not required to incorporate feasibility studies, orrewarded if they do so. By raising community awareness about the importanceof usability, however, this picture may change. The ultimate goal is still toprotect users from attacks by providing smart solutions that they can use.77