Audience for This Book

In creating the first book to be focused entirely on the subject of usability and security, we had a difficult decision to make. Did we want an academic book, one focusing on the growing amount of research in this burgeoning field, or did we want a book for practitioners, one with a heavy emphasis on practice and many recommendations for specific actions?

In the end, we decided to create a book that has both academic and professional leanings, but that stresses theory and fundamental principles whenever possible. Our reasoning is simple: this is such a young field that we did not think it would be in the interest of our readers for us to spend considerable time or space documenting the "best of the worst" practices, circa 2005. Instead, we chose to present readers with information that they could use to form their own understanding of how to improve the alignment of security and usability.

That's not to say that we have shied away from practical advice: this book is filled with practical proscription on the use and evaluation of such technologies as biometrics and USB authentication tokens. We have provided step-by-step guidance to help in conducting usability studies. We have included specific recommendations for the construction of next-generation applications and operating systems that, we hope, will be both more secure and more usable.

Nevertheless, when faced with a choice, we have decided to include the results of experiments, academic references, and suggestions for future research. Our goal is to make this book useful first for researchers in the field of security and usability, then for students, and finally for professionals.

We have also taken a decidedly security-centric view in presenting this material. We view our audience as primarily security researchers and professionals who now realize the need for increased usability in their systems. We assume familiarity with security terminology, even as we pause to give step-by-step instructions on conducting user studies and the principles of user-centered design. The reason is simple: progress in the alignment of usability and security needs to come from security practitionersthe people who literally hold the keys to today's operating systems. Until they truly believe that the usability of a system is of equal importance to its theoretical security properties, we will not see significant progress in this important field. We believe this book also offers something for members of the human-computer interaction and usability communities, who we hope will be increasingly working side by side with security professionals to develop secure systems that people can use.