User-Centred Security

Cybersecurity attacks on organizations and services increasingly target the people who are involved, such as employees in companies or home computer users. Solutions to address this problem need to be feasible for individuals, alongside other user priorities (such as completing paid work). Without consideration of user skills or needs, solutions such as security training or browser warning pop-ups add effort and burden to the user, and encourage less secure behaviours as workarounds (such as writing down difficult-to-remember passwords to ensure system access).

In this course, students will learn about the user perspective of security technologies. This will leverage key human factors concepts, around security usability and its connections to decisions in policy, planning, and technology investment. This will include how to assess a security solution from the perspective of different kinds of technology users and their tasks. By assessing the strengths and weaknesses of particular security mechanisms for users in practice (policies, training, monitoring, etc.), security implementation and management decisions can be made which better fit the context in which mechanisms are used. This can ensure long-term security which better matches the requirements of a particular user organisation or community.