Attributes of information systems quality described in standard ISO/IEC25010 (2010) are analyzed. Some of them are contradictory, dependent and competing. One of the most competing characteristics are usability and security (U&S). The article considers two main aspects of U&S interaction called “usable security” and “secure usability”. The technique of qualitative assessment of the U&S interaction based on analysis of subcharacteristics and metrics is suggested. An example of the technique application to assess U&S interaction for university web-site is discussed.
1.1
Information systems are characterized by a set of characteristics/attributes that are
defined by international standards. The standard ISO/IEC 25010 «System and
software quality model» [
First of all, we need give of description for U&S attributes. Usability – degree to
which a product or system can be used by specified users to achieve specified goals
with effectiveness, efficiency and satisfaction in a specified context of use [
Problems of U&S characteristics interaction are well known, researched and presented in materials of conferences, in articles and books. Analysis of works in this field gave us possibility make some conclusions and divide of accessible works on following groups in some fields:
most part of works are about concrete problems in U&S field and mechanisms
for their solutions [
following group of works about general conceptual questions in the U&S field
[
part of works about problems and peculiarities of U&S interaction on required
levels [
small group includes works about U&S problems for mobile applications
[13,14];
separate works about analysis of literature in U&S problems field [15];
some articles about U&S characteristics evolution. Authors of such works
represent the evolution and interaction of usability and security characteristics [
Preliminary analysis of works in U&S field permitted to make the following conclusions and determine goal of the paper:
firstly, characteristics of U&S which described in last program engineering
standards [
Thus, goal of article is determination, analysis and assessment of U&S interaction on subcharacteristics and metrics levels.
The paper has the following structure. Main second section contains: description of "Usable security" and "Secure usability" interaction problem; analysis of U&S interaction on subcharacteristics level and variants U&S subcharacteristics interaction;
analysis of U&S interaction on metrics level.
The third section analyses and assesses U&S interaction for university web-site and the fourth section concludes and describes directions of the future research. 2 2.1
Exist of two possible aspects of research and development (i.e. two sides of the same coin): usable security and secure usability. Let’s consider in more details what are the differences between these two aspects.
First aspect gives an answer on a question: how to develop functions secure access to resources such, in order to ensure acceptable/necessary level of usability of user interfaces. In order to link of U&S characteristics in the usable security aspect was more understandable, we need represent example of such an interaction. Very often procedure of registration on web-site requires from users to confirm their presence near personal computer. It needs to exclude automatic registration on the Internet. As a rule, web-site offers to users input data for CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) [20]. In majority of cases, the CAPTCHA is information, which automatic generator on picture of web-page and which necessary input to textbox. Sometimes users have problems with input of information from CAPTCHA (i.e. have problem with Public Turing test), because information which is represented on picture periodically cannot be discernible. (Fig. 1). Defect of such technique of identification can provoke discomfort for user. For solution of such problem user necessary, periodically manually reload the picture of CAPTCHA waiting for recognizable information. User can wait long time of appearance recognizable information. User can also delay or cancel, for example, web-site registration procedure. This is an example, when «complex» security kills usability – (cSkU) Information systems developers necessary take into account such aspect, when they make project of user interfaces. We have to exclude situation, when high level of security «kills» the usability.
It should be noted, that subdivision at National Institute of Standards and Technology (NIST) of USA researches such U&S problems [19].
Second aspect has relationships with development of user interfaces thus, in order to ensure necessary level of information security. Lets describe an example of such interaction between usability and security. Public Turing test can be maximum simple and represents one checkbox element, which necessary will set up in significance «check» (Fig. 2). From usability position such variant of Public Turing test is more better than his variant on Fig 1. But from security position such variant (Fig. 2) is more worse, because as against previous variant (Fig. 1) such variant is more simply pass (by software bots) during automatic registration without user. In other words, in such a context there is another competition. This is situation, when «simple» usability “kills” security – sUkS).
Thus, U&S characteristics really have interconnection in the form of two aspects and formally differences can be described through «castle» of objective function and limitations.
in first case it is necessary to ensure the required level of usability (Ureq), at that maximize of security (Smax), i.e. S →max, U ≥ Ureq;
in second case it is necessary ensure the required level of security (Sreq), at that maximize of usability (Umax), i.e. . U→ max, S ≥ Sreq.
We pay attention, that U&S characteristics and their sub characteristics described in article as their interpretation in group of standards ISO 25000.
Examined positions can be represented out in detail as:
security – is combination of following subcharacteristics [
S = {Conf, Integr, N-rep, Acc, Aut};
usability – is combination of following subcharacteristics [
U = {AppRec, Learn, Oper, UEP, UIA, Acs}. 2.3
We will consider interaction between U&S subcharacteristics. For that we will
describe more detail formulations their subcharacteristics [
Security
and capabilities to achieve a specified goal in a specified context of use NOTE 1 The range of capabilities includes disabilities associated with age.
NOTE 2 Accessibility for people with disabilities can be specified or measured either as the extent to which a product or system can be used by users with specified disabilities to achieve specified goals with effectiveness, efficiency, freedom from risk and satisfaction in a specified context of use, or by the presence of product properties that support accessibility. degree to which a product or system protects information and data so that persons or other products or systems have the degree of data access appropriate to their types and levels of authorization degree to which a product or system ensures that data are accessible only to those authorized to have access degree to which a system, product or component prevents unauthorized access to, or modification of, computer programs or data degree to which actions or events can be proven to have taken place, so that the events or actions cannot be repudiated later degree to which the actions of an entity can be traced uniquely to the entity degree to which the identity of a subject or resource can be proved to be the one claimed
We have received set of variants of U&S subcharacteristics interaction because of U&S subcharacteristics analysis. Set of variants of U&S subcharacteristics represents table 2.
We will comment received variants. First of all, we will set the numeration as two numbers (from table 2), which includes the first number as usability characteristic and the second number as security characteristic:
1-1. Appropriateness recognizability subcharacteristic has interaction with confidentiality subcharacteristic. It is obvious, because before ensuring `Confidentiality`, user must, for example, see text boxes for input confidential information and inputted such information;
1-2, 1-3, 1-4, 1-5. In authors opinion, such variants of interaction between U&S characteristics are possible, but they require additional research for set up more exact of interaction type; 1 Arepcporgonpirziaabteilnietyss ↑↑/↓↓ ? ? ? 2 Learnability ↑↓ – – – 3 Operability ↑↑/↓↓ ↑↑/↓↓ ↑↑/↓↓ ↑↑/↓↓ 4 Uprsoetreecrtrioonr ↑↑/↓↓ ↑↑/↓↓ ↑↑/↓↓ ↑↑/↓↓ 5 Uaessetrhienttiecrsface ↑↑/↓↓ ? ? ? 6 Accessibility ↑↓ ↑↓ ↑↓ ↑↓ – - interaction is absent; ↑↑ - increase of level of one characteristic incurring to increase of level of other characteristic;
↑↓ - increase of level of one characteristic incurring to decrease of level of other characteristic;
↓↓ - decrease of level of one characteristic incurring to decrease of level of other characteristic;
? - interaction is exist, but type of interaction to set very difficult (exist necessity of additional research) 2-1. Such variant of interaction between subcharacteristics Learnability and Confidentiality exists, because if user receives more information abaut Confidentiality, than the level will be lower. Thus, if level of Learnability will increase, level of Confidentiality will decrease. And vice versa, if level of Learnability will decrease, level of Confidentiality will increase;
2-2, 2-3, 2-4, 2-5. In authors opinion, such variants of interaction between subcharacteristics are absent;
3-1, 3-2, 3-3, 3-4, 3-5. Such variants of interaction between subcharacteristics of Operability and Confidentiality, Integrity, Non-repudiation, Accountability, Authenticity exist, because of increase of Operability level leads to increase in such subcharacteristics, and vice versa, because of decrease of Operability level leads to decrease such subcharacteristics;
4-1, 4-2, 4-3, 4-4, 4-5. Variants of interaction between User error protection and Confidentiality, Integrity, Non-repudiation, Accountability, Authenticity exist, because decrease of count of user errors incurring to increase of level of characteristics Confidentiality, Integrity, Non-repudiation, Accountability and Authenticity, but increase of count of user errors incurring to decrease their level; y t i c i t n e h t u
A 5 ? – ↑↑/↓↓ ↑↑/↓↓ ? ↑↓ 5-1. User`s interface aesthetics subcharacteristic has interaction with Confidentiality subcharacteristic, because, when user works with information systems interface, which has attractive design and well tidy colors, user has esthetical satisfaction, consequently, he can see textboxes for input confidential information and input her;
5-2, 5-3, 5-4, 5-5. In authors opinion, such variants of interaction between U&S subcharacteristics are possible, but require additional research for set up more exact of interaction type;
6-1, 6-2, 6-3, 6-4, 6-5. In this variants if the level of Accessibility characteristic will increase then levels of all subcharacteristics of security characteristic will decrease and vice versa, if level of Accessibility characteristic will decrease then levels of all subcharacteristics of security characteristic will increase. It is obvious, because of ensuring of Accessibility characteristic in information systems for people with disabilities in user`s interfaces it is necessary to do coordinal redesign of user interfaces. As a rule, such redesign of interfaces, on the one hand, lighten of interaction with software for people with disabilities, on the other hand, it is source of level decrease for all subcharacteristics of security characteristic. 2.4
We will analyze of U&S metrics. For that, first of all, we will represent short description of metrics and primitives (table 3).
of user documentation and/or help facility
accessibility
A = number of operations that behave inconsistently B= total number of operations that behave similarly How easily can A = number of messages messages from a that are understood system be easily understood ? B = total number of implemented messages How many A=Number of functions and implemented functions operational which can be customised procedures during operation can a user B=Number of functions customize for his requiring the convenience? customization capability What proportion A = Number of input of input items items checked for valid provide checking data for valid data. B = Number of input items which need checking for valid data How many A = number of functions functions have implemented to incorrect avoid critical or serious operation malfunctions being avoidance caused by incorrect capability. operation
B = total number of incorrect operation patterns A=Number of types of interface elements that can be customised.
B=Total number of types of interface Elements A = number of functions accessible by the disabled person.
B = total number of functions implemented What proportion of user interface elements can be customised in appearance.
What proportion of functions can a user with a physical handicap access How controllable A= Number of detected
controllability
Results of U&S metrics descriptions analysis gave us possibility to set up variants of their interaction (table 4).
If we compare data from table 2 and 4 we can see, that sets of variants of interaction of U&S subcharacteristics and their metrics do not identical, but very similar. Some interactions were changed in the subcharacteristics context. In table 4 such changes were marked be the grey background. Such result is obvious, because U&S metrics interact with subcharacteristics
Security subcharacteristics 2.1 Confidentiality 2.2 Integrity 2.3 Non-repudiation 2.4 Accountability 2.5 Authenticity s d o h t e m n o i t a c i t n e h t u
A ? ? ↑↑/↓↓ ↑↑/↓↓ ↑↑/↓↓ ↑↑/↓↓ ↑↑/↓↓ ? ↑↓ We will represent simple example of U&S interaction. First of all, worth noting, that metrics U&S equal to subsubcharacteristics (i.e. U&S subcharacteristics of second level). In this case, with usage of calculated significances, from U&S metrics, in author’s opinion, it is possible to do quantitative analysis of U&S interaction. We will do such analysis for separate subcharacteristics of U&S characteristics. For example, we will consider interaction of Operability and Confidentiality subcharacteristics on basis of such interaction with metrics. For that see table. 3, which includes the description of metrics and required primitives for calculation. Object of our research will be web-site of Banking University (http://ubs.edu.ua/en/), which is on the stage of the development. We will calculate metrics of significances for web-site before making changes in this web-site (i.e. before testing). Results of calculation represented in table. 5. We have considered two basic aspects of U&S interaction: usable security and secure usability. Differences in such aspects were analyzed by use of practical examples.
This work includes results of analysis of U&S interaction on the level of subcharacteristics and metrics. Results of such research give possibility to define the set of variants of the interaction of U&S subcharacteristics and metrics. Such variants of interaction of subcharacteristics and metrics are not identical, but are very similar.
In future authors are planning to make complete quantitative analysis of interaction of U&S subcharacteristics on the base of calculated metrics values. Authors suppose, that such analysis must confirm that variants of interaction of U&S subcharacteristics assessment will be correct. Also we plan to analyze interaction between U&S characteristics of information systems and another once, for example, safety.
Practical results of such assessment are improving of requirements foundation for U&S and other characteristics and correcting of design decisions. 11. Shamal Faily, John Lyle, Ivan Fléchais, Andrew Simpson. Usability and Security by Design: A Case Study in Research and Development. Proc. of the NDSS Workshop on Usable Security, At San Diego, CA, USA, (http://eprints.bournemouth.ac.uk/22053/1/flfs15.pdf) (2015) 12. Paul DiGioia, Paul Douris. Social Navigation as a Model for Usable Security. In. proc. of Symposium On Usable Privacy and Security (SOUPS), July 6-8, Pittsburgh, PA, USA, pp. 101-108 (2005) 13. William Melicher, Darya Kurilova, Sean M. Segreti, Pranshu Kalvani, Richard Shay, Blase Ur, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, Michelle L. Mazurek. Usability and Security of Text Passwords on Mobile Devices. In. proc. of the CHI Conference on Human Factors in Computing Systems (CHI '16), Santa Clara, California, USA, pp. 527-539 (2016) 14. Catalin Boja, Mihai Doinea. Usability vs. Security in mobile applications. Proc. of the IE 2013 International Conference, pp.138-142 (2013) 15. Ugochi Oluwatosin Nwokedi, Beverly Amunga Onyimbo, Babak Bashari Rad. Usability and Security in User Interface Design: A Systematic Literature Review. International Journal of Information Technology and Computer Science (IJITCS), Vol. 8, pp. 72-80 (2016) 16. Oleksandr Gordieiev, Vyacheslav Kharchenko and Mario Fusani. Evolution of software quality models: usability, security and greenness issues. In proc. of the 19-th International Conference on Computers (part of CSCC 15), July 16-20, Zakynthos Island, Greece, p. 519-523 (2015) 17. ISO/IEC 25023: Systems and software engineering – Systems and software Quality Requirements and Evaluation (SQuaRE) – Measurement of system and software product quality, ISO/IEC JTC1/SC7/WG6 (2011) 18. ISO/IEC 25030: Software engineering – Software product Quality Requirements and
Evaluation (SQuaRE) – Quality requirements, ISO/IEC (2007) 19. Usability of security team at National institute of standards and Technology (http://csrc.nist.gov/security-usability/HTML/about.html). 20. Completely Automated Public Turing test to tell Computers and Humans Apart, CAPCHA (http://www.captcha.net/).