Keywords

1 Introduction

A lot of attention is currently given to the human, or user, side of information security and it is widely acknowledged that user behavior is a crucial factor in information security [74]. An important topic in this area is usable security, the notion that security tools and measures have to live up to usability demands in order to function as intended [73]. Tools that are lacking in usability are likely to not be used at all or be used incorrectly. If a given tool is not used, the security value that it is supposed to add will be lost. A tool that is used incorrectly can give a false sense of security, or even have a negative impact on security [81].

While there are many papers that provide usability evaluations on various tools and techniques, there is an ambiguity in the research community as to what the concept of usable security actually encompasses. There are several examples of papers that discuss or validate usability and two examples are [79] that evaluates certain usability criteria of a phishing defense mechanism and another is [75] where usability in access control in IoT is discussed. While valuable pieces of research, none of them discuss usability in a broader sense. Further, [77] evaluates usability around the keywords “convenience, annoyance, time-consuming and tiring” and builds on the System Usability Scale (SUS) presented by [72]. While the SUS scale measures important aspects of usability, it does not factor in ideas that [81] consider essential in usable security, for instance, that users should not make dangerous errors.

The existing research demonstrates that usable security is a complex area with many dimensions. However, to the best of our knowledge, there is no common definition or understanding of what the term actually includes. The aim of this paper is to address this gap by reviewing how the term is applied in recent research. The result will describe what researchers mean with usable security and can be used as a reference for future studies. Future research will build on this paper with the goal of establishing evaluation criteria for usability is security tools and measures designed to be used by end-users.

2 Methodology

The research was carried out using a structured literature review targeting research published in the past five years. The review followed the process described by [78]. The outcomes of a literature review are heavily dependent on the databases used, search terms are chosen, and the criteria applied to select relevant literature [76, 80]. The databases and search terms used in this study are shown in Table 1, below.

Table 1. List of used databases and search terms
Full size table

The initial searches resulted in 378 articles, papers that were duplicates or failed to meet inclusion criteria were removed resulting in 49 papers that were selected for further analysis. Backward snowballing, as described by [82], was employed and resulted in another 21 papers, resulting in 70 papers that were included for the study. Table 2 presents the inclusion and exclusion criteria used in this study and Table 3 shows the result of the initial selection process. Table 4 shows the results of the backward snowballing.

Table 2. Inclusion and exclusion criteria
Full size table
Table 3. Initial search process
Full size table
Table 4. Snowballing process
Full size table

The selected papers were analysed, using the software MAXQDA, using thematic coding as described by [71].

3 Results

Following the selection process, the included papers were analyzed using thematic coding. First, high-level aspects of usable security were identified. They were then refined into subcategories. The results are summarized in Fig. 1, below, where the high-level aspects and their subcategories are displayed. The number in parenthesis shows the number of papers connected to a given subcategory.

Fig. 1.
figure 1

Identified aspects of Usable Security. The number in parenthesis display the number of publications relation to each sub-category.

Full size image

The remainder of this chapter will describe the discovered aspects of usable security. The papers classified in each aspect will be referenced continuously and are listed in the reference list, preceded by an asterisk (*).

Cost of Use: This aspect addresses factors that users tend to perceive as inconvenient in terms of cost-effectiveness. Financial costs are mentioned repeatedly [1, 25, 34] and one publication [1] states that resource consumption (e. g. battery) might be of significance.

Consistency: Security solutions are perceived as usable when they are operating predictably. This applies to matters of behavior [31, 34], meaning that similar tasks work identically, and implementation [6, 55, 57] factors including standardized setups, consistent phrasing, and design that allows to easily recognize requirements and conditions.

Perception: Willingness to adopt security solutions depends partially on how they are perceived by individuals. One aspect relates to trust and reputation [4, 10,11,12, 25, 36, 45, 60, 61, 67]. Multiple studies report that users prefer solutions they feel confident with. Such beliefs arise when a solution is from reputable sources, verified by experts, or recommended. Additionally, the coolness factor [61] of authentication schemes might be another contributing aspect.

GUI (Graphical User Interface): This aspect is concerned with the way the GUI is constructed. First, it should be understandable and simple [5, 34, 40, 48, 49, 51, 54, 55, 57, 59, 66, 69]. This includes visualization of navigation options and clear menu arrangements in accordance to what users might anticipate. Also, the GUI should not require unnecessary user attention and merely display information necessary for decision making. A GUI that is adjustable [6, 31, 55] to the user’s preferences increases usability since it improves learnability.

Scalability: Another factor is the extent to which security solutions can deal with multiple user accounts and security keys. Usable account handling [22, 24, 57] does not restrict the number of allowed user accounts and allows to operate multiple accounts with mutual keys. Concerning key handling [12], a scalable solution should be able to install and control multiple keys without complicating usage.

Compatibility: Security solutions should be compatible with commonly used systems and services [1, 20, 22, 24, 57] to be perceived as usable. The trend of developing new security solutions with separate and fragmented user bases is a hinder to usability. Compatibility with other security solutions [1] is crucial since users will presumably reject overly incompatible products such as communication tools that only allow conversations with other instances of themselves.

Adaptability: How well a security solution can be adapted to the specific needs of individuals represents an important factor according to 19 publications. The first subcategory deal with the amount of allowed user control [20, 22, 28, 31, 40, 49, 55, 69]. Enabling users to customize configurations to their preferences increases convenience. Facilitating memorability by allowing users to choose their own passwords is also advantageous. Regarding user capacity [5, 12, 18, 27, 28, 34, 38, 49, 51, 55, 70], security solutions should be adaptable to various expertise levels and be able to, preferably intelligently, adapt to individual abilities and disabilities.

Interference: Usability is reduced when users’ primary tasks are disturbed. The first subcategory addresses workflow [20, 26, 27, 30, 49, 53, 63] interference. Necessary security actions should be arranged in ways that minimize interruptions. Even re-authentication [3, 6, 14, 24, 27, 39] requests are described as disruptive and inconvenient . They can be perceived as wasted time and cause increased complexity. Also, compelling users to remember passwords repeatedly interrupts other tasks since enforced context switches may cause confusion. Finally, there is a physical [15, 56, 57, 61] category to this aspect. Users are anxious to lack immediate access to a token when needed, fear of loss or theft are common.

Error Rate: [3, 4, 17, 20, 21, 26, 33,34,35,36,37,38,39,40, 53, 57, 58, 63, 66, 68, 70] To which extent a security solution enables users to conduct their primary task without having to deal with annoying completion failures is a prominent usability precondition. Increasing error rates cause substantial inconvenience since users are forced to repeat actions. Solutions become ineffective since they are unable to complete tasks as intended. In this context, it is secondary if errors are caused directly by the system or indirectly via users. When security solutions are error-prone, users may choose to circumvent them to preserve usability.

Error Management: Effective means of prevention [4, 6, 20, 28, 31, 33, 34, 48, 49, 54, 55, 57, 59, 67, 69] are required to reduce error rates. Users should be provided with clear and simple instructions that help to prevent frequent errors. Incorrect operations can be prevented by automatic means such as input validity checks. Before errors occur, easy-to-understand warning messages should be communicated clearly and point out problem causes. Making users aware of their actions’ negative consequences beforehand is beneficial. If such hints go unheeded, execution should be rejected. If errors cannot be prevented, proper means of error recovery [4, 8, 12, 14, 20, 22, 29, 34, 40, 40, 49, 54, 55, 57] should exist to maintain usability. One way to recover is to allow users to cancel or revert their actions. Laborious recovery procedures are harmful to usability. Giving simple hints about causes and recommended actions are preferable. Users should be empowered to address most errors without external help, but help should still be available if needed.

Simplicity: A great quantity of studies report that users become overwhelmed by overly complex systems. Lots of papers stress that the cognitive load [2, 3, 5,6,7, 9,10,11,12,13,14,15, 19, 21, 22, 24, 26, 28, 30, 30, 33, 34, 36, 39,40,42, 44, 45, 49, 51,52,55, 57, 60, 62,63,64, 66, 67] put on users needs to be minimized to preserve usability. Reducing the amount of required knowledge , things a user has to recall , or the number of available choices and necessary decisions are important in this context. This also applies for frequent task switching demands. Also, default configurations should be appropriate and safe to use. Twenty-one publications find that high amounts of interaction demands [1, 3, 4, 6, 10, 12, 16, 20, 22, 24, 25, 30, 37, 42, 46, 58, 60,61,62, 64, 67] affect usability negatively since users generally favor solutions that don’t require significant effort. Necessary interaction should be simple. Integrating security solutions into existing well-known systems reduces required efforts. So does centralized authentication.

Info and Support: This aspect is addressed by the second largest amount of studies. It covers how information should be presented to users. Firstly, it should be highly comprehensible [1, 2, 4,5,6, 9, 12, 15, 20, 22, 27, 28, 31, 33, 34, 40, 41, 49, 51, 55, 57,58,59, 66, 67, 69, 70] in both formulation and amount. Low abstraction levels facilitate understanding by non-experts. Reasonable amounts prevent overexertion of users. Furthermore, information needs to be findable [1, 15, 20,21,22, 28, 41, 49, 55, 59, 67], meaning that users should not have to conduct taxing searches, especially external ones. Information should also be complete [4,5,6, 9, 12, 14, 27, 31, 34, 43, 55, 57, 59] enough to sufficiently address potential problems regarding all functionalities. Explaining risks & benefits [9, 11, 12, 21,22,23, 26, 28, 51, 55, 59, 60, 70] of security solutions and particular user decisions reduces usability issues and increases trust. Making users aware of threats and consequences helps increasing acceptance of security requirements and enables better system understanding and utilization. Context related [6, 21, 22, 28, 55, 59, 62, 65] information corresponds directly to executed tasks and allows to exhibit specifically required actions without the need to interrupt said tasks. This reduces perceived complexity and strain.

Transparency: Systems should be transparent regarding status and completion [11, 22, 27, 36, 42, 46, 48,49,50, 54, 55, 57, 58, 61, 62, 67]. Feedback should be provided about underlying mechanisms, the progress of security actions, the system’s status, and task completion. This approach facilitates trust and reduces error rates. Providing knowledge about available choices [11, 28, 33, 65] when users need to make important decisions helps them to react properly and reduces error rates.

Time: Secondary only to cognitive load, invested time until successful task completion [4, 7, 11, 14, 16,17,18,19,20, 24, 28, 30,31,32,33,34,35, 37,38,40, 42, 44, 46, 47, 49, 51, 53, 54, 56, 58, 59, 61, 64,65,66, 68, 70] is one of the most prominent usability aspects. Inefficient time utilization due to delays can impair users’ primary objectives and thereby reduce usability significantly. Periods of delay and idle waiting should be minimized. Additionally, putting users under time pressure [56, 68] by time-out settings increases error rates and stress levels and reduces perceived usability.

4 Conclusions

This paper aimed to summarize the meaning of usable security by analyzing recently published research to identify the dimensions that encompass the term usable security. Using a structured literature review, this research identified 70 papers from the past five years that discussed the topic of usable security. Using thematic coding, 14 aspects were created from analyzing the included papers, the aspects were then refined into 31 subcategories that describe usability factors for security measures. The most discussed subcategories dictate that the time needed to complete security tasks, the cognitive load added by security tasks and the ease of completing security tasks. While this research does not attempt to weight the different identified aspects, this aligns well with the common understanding of a need for time-efficient and easy-to-use security functions.

The results of this paper is a summary of current research that can help researchers as well as practitioners to better understand the topic of usable security, a necessity in implementing user-centred security measures and applications. It also provides a better understanding of the users roles and challenges in security and can be used as a reference model when developing security functions, applications and procedures. While this research employs measures such as backwards snowballing to be as complete as possible, a given limitation is that it relies on previous research. A possible impact on that is that no previously unknown usability factors has been discovered.

An apparent direction for future work would be to research the identified usability factors from a user-centred standpoint. Such a project could aim to include users in an attempt to weight the different factors according to the users perception. Another direction for future work would be to continue the research by developing concrete guidelines for implementation of user-centered security. Such a project would include practitioners as well as researchers and users.