A Human Factors Vulnerability Evaluation Method for Computer and Information Security

Abstract

There is a current lack of human factors identification and analysis methods in computer and information security. Previous research has focused on micro-level issues, such as task analyses and usability studies of security methods such as smart cards, passwords, and biometric devices. The purpose of this research is to develop a framework for identifying human factors and organizational issues contributing to computer and information security vulnerabilities and breaches. This framework is applied in conjunction with technical security audits. The purpose of this research is to test, develop, and refine the proposed methodology. This study examines the methodology with known computer and information technical vulnerabilities through semi-structured interviews with network administrators. These interviews yielded results in the form of methodology refinements and developments and two case studies of technical security vulnerabilities, using what is called the Human Factors Vulnerability Analysis, or HFVA.

References

Adams

Sasse

M. A.

(1999). Users are not the enemy. Communications of the ACM, 42(12), 41–46.

Carayon

Kraemer

(2002). Macroergonomics in WWDU: What about computer and information system security? In Cakir

Proceedings of the 6th International Scientific Conference on Work With Display Units — WWDU 2002 — World Wide Work (pp. 87–89. Berlin, Germany: ERGONOMIC Institut fur Arbeits- und Sozialforschung Forschungsgesellschaft mbH.

Carayon

Smith

M. J.

(2000). Work organization and ergonomics. Applied Ergonomics, 31, 649–662.

Computer Science and Telecommunications Board-National Research Council. (2002). Cybersecurity Today and Tomorrow: Pay Now or Pay Later. Washington, DC: National Academy Press.

Howard

J. D.

Longstaff

T. A.

(1998). A Common Language for Computer Security Incidents (Sandia Report: SAND98–8667): Sandia National Laboratories.

Power

(2002). 2002 CSI/FBI computer crime and security survey. Computer Security Issues & Trends, VIII(1).

Proctor

R. W.

Lien

M.-C.

Salvendy

Schultz

E. E.

(2000). A task analysis of usability in third-party authentication. Information Security Bulletin (April), 49–56.

Reason

(1990). Human Error. New York: Cambridge University Press.

Reason

(1997). Managing the Risks of Organizational Accidents. Brookfield: Ashgate.

10.

Smith

M. J.

Carayon-Sainfort

(1989). A balance theory of job design for stress reduction. International Journal of Industrial Ergonomics, 4, 67–79.

11.

Sutcliffe

Rugg

(1998). A taxonomy of error types for failure analysis and risk assessment. International Journal of Human-Computer Interaction, 10(4), 381–405.

12.

Van der Schaaf

T. W.

(1991). Development of a near miss management system at a chemical process plant. In Van der Schaaf

T. W.

Lucas

D. A.

Hale

A. R.

Near Miss Reporting as a Safety Tool (pp. 57–62. Oxford: Butterworth-Heinemann, Ltd.

13.

Whitten

Tygar

J. D.

(1998). Usability of security: A case study (CMU-CS-98–155). Pittsburgh, PA: Carnegie Mellon University, School of Computer Science, Computer Science Department.

14.

Whitten

Tygar

J. D.

(1999, August 1999). Why Johnny can't encrypt: A usability evaluation of PGP 5.0. Paper presented at the Proceedings of the 9th USENIX Security Symposium.