Grant: Discovery Grants Program - Individual

The security offered by a system can be dramatically influenced by its user's behaviour. This effect has been observed across many areas of computer security such as password systems in which users choose weak passwords, application security warnings that users have learnt to ignore, and software development environments in which developers might write insecure code. In these and many other applications, the cognitive effort required for users to understand security considerations is non-trivial; thus, it is unlikely that many users will invest the required time and effort. Unfortunately, many security practitioners expect that users are aware of security considerations and if not, that users will invest enough cognitive effort to learn and take action accordingly. These problematic expectations motivate my research program, which aims to help people achieve stronger security by creating software tools that are usable and reduce their cognitive burden (i.e., cognitive aids). The objective of my research program is to create new solutions and cognitive aids for users to achieve stronger security in different environments (e.g., web, mobile, and critical systems such as smart grids). My present foci are the areas of user authentication and secure software development. For user authentication, my focus is novel password systems and creation strategies that aim to reduce the cognitive burden of selecting secure and memorable passwords. Examples include interactive password guidance systems for helping users select secure and memorable text passwords, and novel password systems that aim to empower the natural strengths of human memory (by using rich semantic or visual cues such as stories, videos, and digital maps). To tackle security problems in software, my research aims to take a proactive approach by preventing security weaknesses during software development. The cognitive burden currently placed on developers is high as they are tasked with creating functional, high-performance code in a timely manner; security considerations further increase this burden. My research proposes easy-to-use software tools, which require little training, to help developers easily enhance the security of their code. *