Less is More Usable: Measuring Security Usability as Energy Efficiency

Resonating with the theme “Blue Ocean Research”, this research explores the usability of informationsystems with concepts typically used to measure the efficiency of a mechanical system. Security ismeasured not by how often it succeeds, but how often it fails. Usability is frequently in the eye of thebeholder, and often measured by objective user response. This creates a challenge to developreproducible metrics. Security usability presents a more unique problem than ordinary usability. Unlikemost functionality in computer interfaces, navigating security is an interruption to the primary objective(Gebauer et al. 2011). If the security is sufficiently disruptive to progress toward the primary objective, auser will either go around the security, or turn it off (Cranor and Garfinkel 2005). Therefore securityusability is key to keeping the security in place.Predicting security usability of an interface challenges designers (Sasse et al. 2001). Providing a methodto quantify usability of security interfaces takes the guesswork out of security usability design andprovides an avenue for communicating the merits of a design. This paper proposes a usability metric thatapplies the 1st Law of Thermodynamics to the interaction of humans with computer security interfaces.