Usability and Security

To answer our main research question: "To what extent is it possible to have a sufficient level of security,without losing usability?We have performed literary studies and analyzed case studies of tradeoffs between usability and securityfor various authentication mechanisms. We can conclude that a balanced level of usability and securitycan be obtained for each authentication mechanism and that security is not at the expense of usability orvice versa. Usability and security can co-exist and the extent to which an optimal balance between thesetwo aspects can be achieved is particularly determined by the following factors:• type of organization;• type of process;• the importance and sensitivity of the information that needs to be protected;• target audience.7 ReflectionTerren ChongI have always been very interested in doing business online (e-commerce) and have been involved (andstill is) in various website projects. Already familiar with the term web usability and research papers ofJacob Nielsen (some say, the ‘usability guru’), I knew I had to do something with usability. In thebeginning, I wasn’t sure how to incorporate the subject so it would relate to the postgraduate IT auditprogram, but found out soon that this would not be an issue.The idea to investigate the relationship between usability and security started when a client told me thattheir employees were writing their passwords down because they could not remember it. I was actually abit surprised, because the password policy at that time was not in line with best practice.The ‘real work’ started for me in January when I came back from my holidays. We had handed over ourplan of approach the month before and the actual work was ahead of us. Not sure what we would find onliterature, we kicked-off our literary study mid-January. The initial plan was to write the thesis in Dutch,but after a few days searching on the Internet, including electronic book repositories (e-books), I realizedthat there wasn’t sufficient material available or studies conducted in Dutch that would support theresearch question and overall topic. One-fourth of the thesis was already written in Dutch and with a busyperiod at work and overseeing that the actual time left to work on the thesis was limited, Andrew and Idecided to ‘switch’ to English. In my opinion it was the right choice to make. The risk of a possible delaywas accepted, but could not be avoided as the pressure was clearly felt in the last two weeks. Sundaysbecame a typical ‘thesis day’ were I would meet with Andrew for the day.The financial statement audit is important in meeting investor expectations. As an IT-auditor and havingkey-role in the financial statement audit, I feel that we need to pay more attention when writing ourrecommendations and not only recommend because it is considered to be a best practice, but to make therecommendation a piece of advise that the company would actually use or at least consider to implement.A good example is e.g. our advice on password policies. This not only concerns our role in financialstatement audits, but any audit and assurance related assignments where we are involved in.26