Usability and Security

Security aspects:• Confidentiality: in this aspect the property that information is not made available to unauthorizedindividuals is important. Passwords in the ‘high’ password complexity categories lead to behaviorforbidden by many security policies increasing the risk of being obtained by unauthorizedindividuals. This aspect is therefore only considered in the moderate-low password complexitycategory;• Integrity: in this aspect the property of safeguarding the accuracy and completeness of assets isimportant. Passwords in the ‘high’ password complexity categories lead to “work arounds”increasing the risk of being obtained by unauthorized individuals. This aspect is only considered inthe moderate-low and moderate-high password complexity categories;• Availability: in this aspect the property of being accessible and usable upon demand by anauthorized user, in this case the system is important. Passwords in the ‘high’ password complexitycategories lead to “work arounds” increasing the risk of being obtained by unauthorized individualswho can manipulate or remove data (= information) in the system, making the data unavailable.This aspect is therefore only considered in the moderate-low and moderate-high passwordcomplexity categories.As discussed in this paragraph, the goal is to get access to the system by means of password security. Wehave seen that users need to cope with complicated and/or complex passwords for different systems.Enforcing users to change their password periodically through the system makes it even more difficult forusers to remember their password. Passwords for systems that are not being used frequently are even moredifficult to remember. Users therefore behave in ways forbidden by security policies and ‘best practices’.We have also seen that there are ways to use both secure and usable passwords, but this is often notsupported by the system. Furthermore we think that the more complex and difficult to rememberpasswords are, the more ways users will find to make it more usable, thus decreasing the level of security.The table below illustrates the results of our classification based upon the analyses performed in thisparagraph:AspectsUsabilitySecurityEffectiveness Efficiency Satisfaction Level Confidentiality Integrity Availability LevelPassword complexity categoriesHigh X Low LowModerate-High X X Moderate X X ModerateModerate-Low X X X High X X X HighLow X X X High LowTable 2: Password levels3.3.2 Challenge questionsChallenge questions are amongst others used as an automated means of password or credential recovery.This can be performed by a help-desk call or performed automatically through confirmation of a user’sresponse to previously stored questions and answers. During recovery, the user is challenged with aquestion and therefore required to provide the correct answer. Challenge questions offer the same potential12