Grant: Discovery Grants Program - Individual

Computer security and privacy problems can arise for a wide variety of reasons that often involve the interaction of people with computer applications. Unfortunately, many computer applications are designed and evaluated as though they are separate from the people who interact with them (e.g., end-users and developers of the application itself ). This lack of incorporating human factors (e.g., human behaviour, mental models, and usability) in the design and evaluation of computer applications can result in security problems in practice. Such security problems motivate the proposed research program. Two directions will be examined in this research: one on human factors related to end-users (i.e., user-centered human factors) and another on human factors related to software developers (i.e., developer-centered human factors). The goal of this research is to improve computer security and privacy by incorporating user- and developer-centered human factors into the design, creation, and evaluation of new security-focused software tools. The user-centered direction is motivated by security problems in user authentication applications that are theoretically secure by mathematical arguments, but not in practice as users tend to choose similar passwords. This research direction aims to improve security for the general population by designing novel methods for stronger passwords. The motivation for considering developer-centered human factors is that many high-impact security problems, such as denial-of service or code injection attacks, are caused by programmatic or design errors in software. It is people - software developers and designers - who create faulty software, which can lead to security vulnerabilities. Thus, this research direction aims to design novel software development tools (i.e., security-comprehension tools) to help developers identify hidden security problems in their code. This research program will train graduate students in human-factors-based analyses of existing user authentication applications and software development tools (to identify areas for improvement), and designing/evaluating new user authentication applications and security-comprehension tools.