Transforming the ‘Weakest Link’ — a Human/Computer Interaction Approach to Usable and Effective Security

By M. Sasse, Sacha Brostoff, Dirk Weirich. 2001

821 citations recorded by the source corpus.

Subfields: Information Systems, Human-Computer Interaction, Signal Processing

View Paper: https://www.semanticscholar.org/paper/3bb1268a8cd6442b85505dd6b675c4d7372ac53f

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Human-Computer Interaction

In Signal Processing

Citations in the corpus

Information systems security policy compliance: An empirical study of the effects of socialisation, influence, and cognition (2014, background): “Thus, employees with positive beliefs about their organisation’s ISSP will have favourable tendencies to comply with such rules and guidelines [32,42].”
The domino effect of password reuse (2004, background): “[9] trace many password weaknesses to the way in which passwords systems are implemented and call for greater collaboration between security administrators and users.”
Future directions for behavioral information security research (2013, background): “…focused efforts are important, one area that is a predominant weakness in properly securing information assets is the individual user within an organization (Leach, 2003; Posey et al., 2011b; Sasse et al., 2001; Stanton et al., 2005; Vroom and von Solms, 2004; Warkentin and Willison, 2009).”
Nudges for Privacy and Security (2017, background): “Usability research has attempted to help users by making security and privacy interfaces more usable [Sasse et al. 2001; Cranor and Garﬁnkel 2005; Garﬁnkel and Lipford 2014].”
Authentication using graphical passwords: effects of tolerance and image choice (2005, background): “That is, users who fail to choose and handle passwords securely open holes that attackers can exploit [9, 14, 16, 20, 22, 29].”
The true cost of unusable password policies: password use in the wild (2010, background): “The vision of a holistic approach for security policies is not new; Sasse et al. [16] outlined what such a policy should contain.”
A comparison of perceived and real shoulder-surfing risks between alphanumeric and graphical passwords (2006, background): “It should be noted that dictionary passwords are more common than non-dictionary passwords, [34] and the significant correlations indicate accuracy in the participants’ perception capabilities concerning the vulnerabilities of each configuration.”
Graphical passwords: Learning from the first twelve years (2012, background): “However, text passwords also suffer from both security and usability disadvantages for example, passwords are typically dif.cult to remember and are predictable if user choice is allowed [Morris and Thompson 1979; Klein 1990; Sasse et al. 2001; Yan et al. 2004; Bentley and Mallows 2005].”
Password management strategies for online accounts (2006, background): “They reported that the 144 employees surveyed had an average of 16 passwords, but this was not limited to online activities [21].”
An Enhanced Fear Appeal Rhetorical Framework: Leveraging Threats to the Human Asset Through Sanctioning Rhetoric (2015, background): “…received increasing attention from information security scholars in the effort to persuade insiders to comply with recommended security behaviors, such as those stipulated in information security policies (Herath and Rao 2009; Johnston and Warkentin 2010; Sasse et al. 2001; Weirich and Sasse 2001).”
Guessing human-chosen secrets (2012, background): “An influential series of studies by Adams and Sasse in the 1990s [15, 14, 259] found that many of these policies were causing significant frustration for users and were often circumvented in practice when they got in the way of users’ primary tasks.”