Guidelines for Usable Security Interventions

Security interventions are vital to protect users against evolving cyber-threats. However, their effectiveness is often limited by usability shortcomings. This paper examines six fundamental obstacles that undermine the impact of security interventions: lack of visibility, habituation & warning fatigue, lack of awareness, long explanation, lack of transparency, and UI attacks. Drawing on results from human-computer interaction, behavioral psychology, and usable security studies, we synthesize evidence-based principles to guide developers in designing usable security interventions. We outline as future work both 1) to empirically validate the proposed guidelines and 2) to extend them for special purposes.