Usable Security - Guidelines

1. Principle of least privilege: A system should be able to access only the information it needs to perform its functions.

2. A design guideline for creating usable secure systems is to make the most secure way to complete a task the easiest way to complete the task.
3. Users should be aware of what authority they hold, what authority they have granted, and what the implications are for security decisions.
4. The more usable a system is, the more secure it is because usable systems help users make good security decisions and easily choose the most secure actions.
5. Guidelines for creating usable security systems:

• Create interfaces that make it clear what software the user is interacting with and providing information to.
• Make sure users know what authority they hold
• Make sure that users know what authority they have granted and what that means for security decisions

6. If you are warning users about a security problem that has been detected, the best message to show them:

• A message that alerts them to the error and makes the most obvious option the one that stops the user from proceeding. A small link is given to ignore the warning and proceed.

7. What should be considered In a system where a person can grant authority to others to his or her own access resources  

• The interface should help users be aware of what authority they have granted in the past
• The easiest way to do a task should require the most minimal granting of authority
• Users should be able to reduce the authority granted to others

8. Which guideline is violated when an interface does not make capitalization differences unambiguous (e.g. a lower case "L" and capital "i" appear to be the same thing)

•  Make it easy to see the differences between objects and actions that could be confused.