Usability and Security

More documents

Recommendations

Info

conclude that the most efficient biometric types are Iris and fingerprint, followed by face andhandprint. Retina takes a long time for scanning, thus not efficient. We therefore consider all typeswith the exception of the retina type;• Satisfaction: the users’ goal with satisfaction is a positive attitude towards getting access to asystem or building, without encountering any discomfort. Based on the discussions above we canconclude that the Iris, fingerprint, face and handprint types are effortless to use. Most convenient isfingerprint, followed by handprint and face. We therefore consider all types with the exception ofthe retina type.Security aspects:• Confidentiality: in this aspect the property that information is not made available to unauthorizedindividuals is important. However biometrics concerns the component “something you are”. Therisk of obtaining a ‘finger’ to forge the fingerprint reader or have access by identical siblings isconsidered very low. Based on the discussions above we can conclude that in this case the mostsecure biometric types are Iris, fingerprint and retina;• Integrity: in this aspect the property of safeguarding the accuracy and completeness of assets isimportant. Same explanation as confidentiality;• Availability: in this aspect the property of being accessible and usable upon demand by anauthorized user, in this case getting access to a building or remote access is important. Sameexplanation as confidentiality.In this paragraph we have seen that the different biometric technologies have a wide range of accuracy,reliability and usability. The actual performance of these devices are measured using False Accept Rates(FAR), False Reject Rates (FRR) and depend on the number of reference points and algorithms used. Eachbiometric type has its strengths and weaknesses and is primarily used for physical and information systemaccess.The table below illustrates the results of our classification based upon the analyses performed in thisparagraph:AspectsUsabilitySecurityTypes of biometricsEffectiveness Efficiency Satisfaction Level Confidentiality Integrity Availability LevelHandprint x x Moderate LowFingerprint x x x High x x x HighIris x x x High x x x HighRetina x Low x x x HighFace x x Moderate LowTable 6: Biometric type levelsThe relationship between usability and security will be discussed in chapter five.22
4 InterviewsWe have chosen two conduct two interviews to discuss the four authentication mechanisms discussed inthe previous chapter. The purpose of the interview was to obtain insights on how the authenticationmechanisms are dealt with in practice and how the relationship between usability and security isportrayed. We have deliberately chosen to conduct one interview with Martin Wijmaalen who providedinput from a security perspective and the other interview with Eric Velleman, who provided input from ausability perspective. Martin is senior manager at Ernst & Young EDP Audit in the Netherlands and hasmore than 8 years experience in information security and IT assurance. Eric Velleman is technical directorand accessibility expert. He has worked for more than twenty years at ‘Stichting Bartiméus Accessibility’with the visually impaired and has conducted research on accessibility, usability and user profiles forpeople with disabilities and ICT.Based upon the interviews we are able to conclude the following (for a summary of the interviews, pleaserefer to the appendix):• Identity and access management is one of the most important and most time consuming activitiesaddressed within organizations;• Companies spent a lot of time improving IT and operational efficiencies (e.g. password resets);• Passwords and/or PIN codes are difficult to remember and are often written down or a ‘workaround’ is chosen such as choosing an easy to guess password, which effects the security level;• Preference in the use of biometrics as an authentication mechanism is shown, but it’s not commonlyused by organizations. The use of biometrics would improve the usability;• Creating awareness amongst suppliers and emphasizing the importance of accessibility and usabilityis very important, but is unfortunately very low on the agenda on most organizations;• Usability and security are not taken into consideration from the start of the design phase.5 The optimal balance between usability and securityIn the previous chapters we have discussed the definitions of usability and security, the various types ofauthentication mechanisms and we have defined their usability and security levels. When we look moreclosely into the different types of the authentication mechanisms we are able to conclude that eachmechanism has its own strengths and weaknesses. We discussed four types of authentication mechanismsand were able to establish the following relationships between usability and security:• Passwords: Passwords in a high password complexity category result in a low level of both usabilityand security. Users have trouble with memorizing the passwords and therefore write it down.Passwords in a low password complexity category result in a high usability level but a low securitylevel. In this case users are able to memorize the passwords easily but are not obliged to change itoften which is at the expense of the security. Thus, passwords in a moderate complexity categoryresult in a well balanced level of usability and security;• Challenge questions: a fixed question type results in questions defined by administrators which aresecure for users such as IT professionals, but not for the common users, who are then obliged to usequestions from a fixed list. Using an open question/ answer type results in a user defined inputwhich provides flexibility and ease of use. On the other hand this tends to be less secure and easy to23
Page 1 and 2: Usability and SecurityUniversity: V
Page 3 and 4: ACKNOWLEDGMENTSThis thesis covers t
Page 5 and 6: IntroductionThe developments in Inf
Page 7 and 8: idging the gap between theory and p
Page 9 and 10: 2.1.3 Usability componentsIn order
Page 11 and 12: custom approach 12 . An example of
Page 13: put usability and security amongst
Page 16 and 17: Security aspects:• Confidentialit
Page 18 and 19: ambiguous. Controlled answers offer
Page 20 and 21: 3.3.3 TokensIn this paragraph the t
Page 22 and 23: Security aspects:• Confidentialit
Page 24 and 25: The strengths, weaknesses and usabi
Page 28 and 29: e guessed, which results in a low s
Page 30 and 31: To answer our main research questio
Page 32 and 33: AppendixInterview with Martin Wijnm
Page 34 and 35: Sources1 ISO 9241-11, Part 11: Guid

Usability and Security

Create successful ePaper yourself

Delete template?

Save as template?