Saudi Arabia’s top military official meets Iranian counterpart in Tehran for rare high-level talks, focusing on defence diplomacy and cooperation

The 29th session of the climate change conference of parties (COP29) is being held from November 11-22 in Baku, the capital of Azerbaijan Baku

The German economy, the largest in Europe, has not been performing well and is looking at a second consecutive year of contraction; Germany was the only G-7 country to contract in 2024, with its economy expected to shrink by 0.2%

The villagers fear losing their lands and livelihood and also adverse affects of uranium mining on their lives

With no water in the irrigation canals salinity was causing problems for the crop in the coastal region, farmers’ body leader said

Boca Raton : Chapman & Hall/CRC Press, 2021

Ministers must infuse confidence in the people they serve 

Show DescriptionWe're talking with Michelle Barker about the idea of paying to support bloggers (and podcasters!) via services like Patreon, drumming as a fun side gig from CSS, how big of an issue digital sustainability is, trying to understand the environmental impact of our websites and digital life, wondering why YouTube embeds are still so […]

Fabian Kägy helps us understand the modern WordPress development process, Gutenberg vs Block editor vs full site editing, building with blocks or pages, what's coming in the Twenty Twenty-Five Theme, and whether the theme authoring process has been made too difficult in 2024?

Each housing project has to be site-specific, culturally appropriate and climatically conforming.

At the World Bamboo Congress held in Korea this year, Rebecca Reubens spoke about bamboo’s potential for holistic sustainability through design.

The book tells us quite convincingly that the future is unknown. But it does not offer an alternative

MSPs for bajra, arhar dal, maize offer highest margins above production costs; Cabinet nod for Varanasi airport expansion, new Maharashtra port, wind energy projects in Gujarat and T.N., forensic infrastructure development

The team choosing mandals like Vidapanakallu and Vajrakarur which received excessive rain in June, draws flak from farmers and district officials alike; farmers worry as to how to present their drought woes to the officials who are visiting their fields which are now rain-fed and green

It will cover all farmers, regardless of their landholding size or socioeconomic status: Ministry

Digital Agriculture Mission, which has an outlay of ₹2.817 crore and aims to create a consolidated database on crop data, among initiatives to get nod; schemes to boost nutritional security and livestock production also approved

Leader of the Opposition in the Lok Sabha Rahul Gandhi said Ms. Buch was being protected from giving answers to Parliament, from resigning as SEBI chief and from an investigation into her alleged links with the Adani Group companies. Ms. Buch had skipped the PAC meeting citing personal reasons

Divya Sasidharan calls into question the trade-offs often made between security and usability. Does a secure interface by necessity need to be hard to use? Or is it the choice we make based on years of habit? Snow has fallen, snow on snow.

Security is often synonymous with poor usability. We assume that in order for something to be secure, it needs to by default appear impenetrable to disincentivize potential bad actors. While this premise is true in many instances like in the security of a bank, it relies on a fundamental assumption: that there is no room for choice.

With the option to choose, a user almost inevitably picks a more usable system or adapts how they interact with it regardless of how insecure it may be. In the context of the web, passwords are a prime example of such behavior. Though passwords were implemented as a way to drastically reduce the risk of attack, they proved to be marginally effective. In the name of convenience, complex, more secure passwords were shirked in favor of easy to remember ones, and passwords were liberally reused across accounts. This example clearly illustrates that usability and security are not mutually exclusive. Rather, security depends on usability, and it is imperative to get user buy-in in order to properly secure our applications.

Security and Usability; a tale of broken trust

At its core, security is about fostering trust. In addition to protecting user accounts from malicious attacks, security protocols provide users with the peace of mind that their accounts and personal information is safe. Ironically, that peace of mind is incumbent on users using the security protocols in the first place, which further relies on them accepting that security is needed. With the increased frequency of cyber security threats and data breaches over the last couple of years, users have grown to be less trusting of security experts and their measures. Security experts have equally become less trusting of users, and see them as the “the weakest link in the chain”. This has led to more cumbersome security practices such as mandatory 2FA and constant re-login flows which bottlenecks users from accomplishing essential tasks. Because of this break down in trust, there is a natural inclination to shortcut security altogether.

Build a culture of trust not fear

Building trust among users requires empowering them to believe that their individual actions have a larger impact on the security of the overall organization. If a user understands that their behavior can put critical resources of an organization at risk, they will more likely behave with security in mind. For this to work, nuance is key. Deeming that every resource needs a similarly high number of checks and balances diminishes how users perceive security and adds unnecessary bottlenecks to user workflows.

In order to lay the foundation for good security, it’s worth noting that risk analysis is the bedrock of security design. Instead of blindly implementing standard security measures recommended by the experts, a better approach is to tailor security protocols to meet specific use cases and adapt as much as possible to user workflows. Here are some examples of how to do just that:

Risk based authentication

Risk based authentication is a powerful way to perform a holistic assessment of the threats facing an organization. Risks occur at the intersection of vulnerability and threat. A high risk account is vulnerable and faces the very real threat of a potential breach. Generally, risk based authentication is about calculating a risk score associated with accounts and determining the proper approach to securing it. It takes into account a combination of the likelihood that that risk will materialize and the impact on the organization should the risk come to pass. With this system, an organization can easily adapt access to resources depending on how critical they are to the business; for instance, internal documentation may not warrant 2FA, while accessing business and financial records may.

Dynamically adaptive auth

Similar to risk based auth, dynamically adaptive auth adjusts to the current situation. Security can be strengthened and slackened as warranted, depending on how risky the access point is. A user accessing an account from a trusted device in a known location may be deemed low risk and therefore not in need of extra security layers. Likewise, a user exhibiting predictive patterns of use should be granted quick and easy access to resources. The ability to adapt authentication based on the most recent security profile of a user significantly improves the experience by reducing unnecessary friction.

Conclusion

Historically, security failed to take the user experience into account, putting the onus of securing accounts solely on users. Considering the fate of password security, we can neither rely on users nor stringent security mechanisms to keep our accounts safe. Instead, we should aim for security measures that give users the freedom to bypass them as needed while still protecting our accounts from attack. The fate of secure systems lies in the understanding that security is a process that must constantly adapt to face the shifting landscape of user behavior and potential threats.

About the author

Divya is a web developer who is passionate about open source and the web. She is currently a developer experience engineer at Netlify, and believes that there is a better workflow for building and deploying sites that doesn’t require a server—ask her about the JAMstack. You will most likely find her in the sunniest spot in the room with a cup of tea in hand.

More articles by Divya

Indonesian designer Anniesa Hasibuan made history at the New York Fashion Week on September 12. Find out how.

Hair stylist Jawed Habib talks about his new book ‘Beautiful Hair, Beautiful You’ and says, despite the information overload pertaining to hair care, he observes a general lack of awareness

Deposit to continue growing faster than credit in H2FY25

Montreal : National Film Board of Canada, 2018

With understanding, empathy, and evidence-based interventions, we can create an education system that truly leaves no child behind

Boca Raton, FL : CRC Press, 2022.

Berlin ; New York : Springer, 1998

Basel ; Boston : Birkhäuser, [2007]

New York : Springer, [2005]

New York : Springer, ©2006

Cambridge, United Kingdom ; New York, NY : Cambridge University Press, 2021.

Under the scheme, a student who secures admission in top higher education institutions, both government and private, will be eligible to get collateral-free, guarantor-free loan from banks and financial institutions

With many students looking for courses on sustainability and environmental issues, here is a round up of some popular courses in American universities

The move aligns with the Group’s vision of utilizing cutting-edge technology to improve the home-buying experience and boost operational efficiency in property sales

During the quarter, Godrej Properties sold houses worth ₹5,198 crore, up 3 per cent on year while collections rose 68 per cent to ₹4,005 crore

The player registration officially closed and a total of 1,574 cricketers (1,165 Indian and 409 overseas) have been signed up for the auction

Most skills needed for the workplace are learnt on the job. Should we change our approach to assessing employability?