Four overarching challenges facing researchers working in the field of usability, security, and privacy were apparent in the presentations and discussions at the workshop. Although these challenges apply to many emerging research areas, they are particularly relevant to research on usability, security, and privacy.

Participants in the breakout sessions devoted considerable time and attention to terminology and definitions. “Usable security” was the term frequently used to capture the notion of security measures developed with attention to usability considerations. Another commonly used term was “HCI-SEC” (human-computer interaction–security). Whatever the specific term used to describe the intersection of usability, security, and privacy, each participant tended to define the area in relation to his or her own background. Interestingly, usability practitioners tended to stress security issues, and security practitioners tended to stress usability issues.

Adding “privacy” to the mix complicated matters still further, as definitions of privacy were frequently based on personal philosophies and experience, perhaps reflecting the deeply personal way in which many individuals approach privacy issues. Moreover, some workshop participants noted that although some activities, such as the annual Symposium on Usable Privacy and Security mentioned above, explicitly call out both terms, neither “usable security” nor “HCI-SEC” explicitly invokes issues

related to privacy, despite the technical and policy links between the two concerns. Some may immediately associate privacy issues with the term “security,” but this is not universally true. Agreeing to a common definition or term that was inclusive of the concept of privacy proved challenging throughout the workshop.

Several workshop participants cited the need for more and better empirical data and commented on the difficulties that they faced in gaining access to such data. For example, data on industry or government computer system security breaches are generally unavailable—corporations are hesitant to disclose this information owing to the potential threat to reputation, stock price, and ongoing business; and information about breaches to government computer systems is frequently treated as sensitive or classified. Even data on matters less touchy than security breaches cannot be readily obtained. Participants noted, for example, the difficulty in obtaining data on the productivity impacts of security measures. Even when researchers are able to obtain data, nondisclosure agreements may restrict their ability to publish their results. If researchers do gain the ability to work with corporate data, an additional challenge is that of conducting research in a way that enables repeatability.

Many of the workshop participants commented that working in the area of usability, security, and privacy is especially challenging because of the need for researchers who are familiar with both computer security and human-computer interaction. These were, at least until recently, considered distinct disciplines—most security researchers have traditionally ignored usability issues, and vice versa (and likewise for usability and privacy).

One consequence is unfamiliarity with each other’s work. Throughout the workshop, there were frequent instances in which either a computer security or a usability expert would identify a research question outside his or her area of expertise, only to receive immediate feedback from relevant experts that this particular question had already been addressed. “I did not know that that research existed” was a common lament heard at the workshop. Although this immediate feedback was useful to the workshop participants, it also suggests there may be a significant lack of knowledge about usability-related work among security researchers and

about security-related work among usability researchers (with a similar situation existing with respect to usability and privacy). Another consequence pointed out by workshop participants is that valuable resources may be spent re-researching questions that are already well understood.

Still another consequence is that although a few interdisciplinary research collaborations have emerged, there remain few individuals in either area with sufficient expertise to identify their counterparts on the other side—and fewer still with expertise in both areas. Research funding at the intersection would foster the development of such expertise by training graduate students and attracting young faculty.

This page intentionally left blank.