Security products and programs may be functional and work correctly, but are they usable in the sense that it fits into the work patterns of our users?
Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series and Allan Alford (@AllanAlfordinTX). Our guest is Rakesh Patwari (@rakeshpatwari), UX lead, Salesforce and UX instructor at UC Berkeley Extension.
Got feedback? Join the conversation on LinkedIn.
Thanks to this week’s podcast sponsor, Enzoic
On this episode of Defense in Depth, you’ll learn:
- There is the path to security you create and the path that your users take, or the desired path. As a security and UX professional you should plan to make those two the same path. If not, your users will take the simpler route and circumvent your security controls.
- Users will always choose the easier path which is not necessarily the most secure path.
- Security is an “ask.” You’re requesting users do something, but it’s hard to get them to keep doing that “ask” if you don’t give them feedback as to the reason or value of the ask.
- Error messages historically provide little to no information to the user and thus no guidance to solve the problem. We often have to go outside of the environment (a search engine) to find a solution.
- Security professionals need to take on the role of a UX designer which requires defining work processes by interviewing users, not deciding what you want those processes to be.
- Creating a simple process is far more difficult than creating a complex process. Secure processes don’t require users to constantly turn functions on and off or go through additional unnecessary steps to get their job done.
- View your users as customers where you’re trying to sell them on your process rather than dictating which will eventually be avoided.
Creative Commons photo attribution with logo addition to baldiri.