Human-Centered Security

Ever wonder what it’s like to design enterprise cybersecurity software? Tom Keenoy, a design leader for a cybersecurity company, explains why what you learned in design school may not apply when you’re building software for specialized power users (think: security analysts, IT administrators, devops).

• How do you get up-to-speed when designing for complex domains like cybersecurity?
• How do you adapt your design process for enterprise power users (spoiler: stripping away information isn’t always the right answer)?
• How to prioritize when “everyone wants to build all the cool things.”
• Why Tom thinks much of a designer’s job is “de-risking.”
• The most important skills designers need to be successful in building enterprise security software.

Tom Keenoy is a design leader who loves building technical products for power users. At various points in his career he’s been a designer, an educator, an engineer, a product manager, and a startup founder. He’s currently leading a design team at a cybersecurity company and advising growth stage startups to help right-size their UX and product design programs.

Ever encountered a CAPTCHA and thought to yourself, “whoever decided to put this here must really hate people”? It turns out, the people who make the decisions to use CAPTCHAs hate them as much as you do. Jason Puglisi, an application security engineer, describes what teams like his think about when evaluating potential solutions to a security issue. (Spoiler: you’ll be pleased to know these considerations include how security solutions may affect the user experience).

• The surprising similarities between UX and security teams.
• What designers need to know about information security risks, as well as how designers can help security teams understand the UX tradeoffs they may be making.
• What designers can do to more effectively collaborate with their cross-disciplinary teams, including the security engineering team.
• What to consider when designing for users in higher-risk scenarios—users who have privileged access and are operating at scale (for example, if your end users are engineers, IT professionals, or security analysts).

Jason Puglisi is an application security engineer at a financial technology company. He performs ethical hacking to discover vulnerabilities, guide solutions, and inform organization-wide security measures. Human security is a particular passion of his, including security culture, awareness, and various aspects of social engineering.

In this episode, we talk about:

• Questions you should be asking to uncover information security threats early on in the design process.
• How to account for human behavior in a structured way as part of threat modeling (spoiler: this is not so different from what you are doing now).
• How to collaborate with an interdisciplinary team as part of an iterative design process to improve the user experience of security.

Adam Shostack is an expert on threat modeling, having worked at Microsoft and currently running security consultancy Shostack + Associates. He is the author of The New School of Information Security, Threat Modeling: Designing for Security and the forthcoming Threats: What Every Engineer Should Learn From Star Wars. Adam’s YouTube channel has entertaining videos that are also excellent resources for learning about threat modeling.

In this episode we talk about:

• How designing for security is different from (and the same as) designing for other types of experiences.
• How to tackle aspects of the user experience that may be necessary but are perceived as annoying roadblocks.
• How to anticipate where things might go wrong for the user.
• How to effectively collaborate with technical teams.

Bethany Sonefeld is the founder of Create With Conscience, a space dedicated to educating and committing to building healthier technology. Create With Conscience was something Bethany developed out of interest in creating a healthier balance of technology in her own life. Bethany is a design manager at Duo Security and was previously at Cloudflare, RetailMeNot, and IBM.

Blair Shen is a product designer at Duo Security and was previously at Cloudflare and Harry&David. She is also a YouTube content creator, where she mentors and coaches aspiring UX designers.

In this episode, we talk about:

• How do you tackle situations where business goals might be at odds with what’s ethical or what’s best for the human using the product?
• How can designers make a difference even if they don’t have a leadership role at their organization?
• How do you anticipate potentially unhealthy behaviors or unintended consequences? 
• What are some actionable steps you can take today?

Bethany Sonefeld is the founder of Create With Conscience, a space dedicated to educating and committing to building healthier technology. Create With Conscience was something Bethany developed out of interest in creating a healthier balance of technology in her own life. Bethany is a design manager at Duo Security and was previously at Cloudflare, RetailMeNot, and IBM.

How do the UX, product, and technology teams effectively collaborate when it comes to security? How do we, as part of the UX team, take part in the security conversations and what role do we play?

In this episode, we talk about:

• How Michael’s user research for dating apps helped him understand the unintended consequences of digital products on our behaviors.
• Why we need new frameworks for security and privacy in the digital world.
• How users’ perceptions and expectations for security and privacy are highly contextual and changing. 
• How to break down the user experience of security so your team isn’t treading water in the abstract and can take steps to improve security outcomes.

Michael Snell is the UX research team lead at JPMorgan Chase managing research focused on security and authentication. He previously worked at Microsoft and Verizon Connect. He has a PhD in psychology from the University of Georgia.

In this episode, we talk about:

• Where the fields of cognitive psychology, security, and user experience meet.
• Why Jeremiah and his team chose to investigate graphical authentication.
• How they cleverly incorporated testing both usability and security in their two-part study.
• The importance of research around learnability: is it easy for users to learn how to use your new authentication schema?

Read Jeremiah’s research: Usability Comparison of Over-the-Shoulder Attack Resistant Authentication Schemes. 

Jeremiah is the Director of Human Factors, Ph.D. Track and Associate Professor of Psychology and the School of Cybersecurity at Old Dominion University. He runs the Psychology of Design Laboratory, which focuses on human cognition and technology, including usable security.

In this episode, we talk about:

• Why technical users expect a great user experience just like everyone else.
• How to find and incentivize participants who are extremely busy.
• How to support users in making a decision without telling them what to do.
• Deciding what data to show and how to show it.

Tanja Venborg Hansen is a seasoned user researcher who has worked in both the enterprise cybersecurity (Forcepoint) and aviation industries (Finnair). She earned a master of science degree focused on design and innovation from the Technical University of Denmark.

In this episode, we talk about:

• What is responsible innovation and where can companies get started?
• How can companies take guiding principles, establish a framework, and operationalize that framework in a way that “informs decision-making in a meaningful way”?
• How are regulations impacting responsible innovation programs?
• What happens when an organization’s business model conflicts with responsible innovation principles?

Chloe Poynton is the co-founder and principal at Article One Advisors, a management consultancy with expertise in human rights, responsible innovation, and social impact.

In this episode, we talk about:

• Why security UX requires “selective usability” and how that poses unique challenges for designers.
• Thinking about security in terms of safety systems: putting the burden on the system rather than on the user.
• How to work effectively with the security team.

And Jared shares lots of examples.

Jared Spool is the founder of UX consultancy UIE and the co-founder of UX design school Center Centre. Interested in hearing more about what Jared has to say about the security of UX? Watch the talk: Insecure and Unintuitive: Why We Need to Fix the Security of UX.