Usability as a protection feature

摘要

Psychological acceptability may not sound like a term that'll hold much significance for the future of secure file sharing. But don't sell it short. The term refers to the concept that a system should be as easy to use in a secure state as in an insecure state - or users will default to the insecure state. In this era of cloud services, where users have a plethora of ready-to-use SaaS options, the psychological acceptability principle can be extended to say that secure services must be as easy to use as insecure services or users will gravitate to the insecure alternative. What should IT do about this problem? It can resort to the "big stick" approach of enforcing which tools can and can't be used. But this is becoming less and less effective as teams are increasingly distributed and empowered by SaaS options. Information security leaders are finding that they have more success substituting "carrots" for sticks to guide users to the right solutions by choosing those that are easy for their constituents to use.