Final Exam of Usable Security

ByAdmin August 8, 2021

Final Exam of Usable Security

Question 1

Company ABC’s password policy has always been that the system generates passwords for its users instead of letting them pick their own. The passwords are random 8-character strings with upper and lower case letters, numbers, and symbols for users (e.g. “^8j4Z.mp”). Every six months, the password is changed to something new. Because password resets are a security danger, users are not allowed to reset their passwords if they forget them. Instead, they need to go to the company’s IT office which looks up their existing password and gives them a printout with the password on it.

(note: this is a true example – I worked at an organization that had exactly this policy)

Answer the questions 1-13 about Company ABC’s policy.

True or false: the passwords that the system generate are very hard to crack?

1 point

True

False

Common Word

Dictionary

Brute force

Employees don’t like them (user preference)

It is too easy to make a typo while entering the password (efficiency)

They take a long time to type in (speed)

They are hard to remember (memorability)

Users will write down their passwords

People will lose work time trying to memorize their new passwords every six months

Users will become friends with people in the IT office because they visit to often to get password reminders

True

False

True

False

True

False

True

False

True

False

True

False

True

False

True

False

True

False

Question 14

Company XYZ is a defense contractor. They need to make sure that only authorized people enter their facilities. They have decided to install a new biometric authentication station outside the gate that protects the parking lot. Employees will need to authenticate in order to be let in. Answer questions 14-20 about Company XYZ.

How should the security system be designed?

1 point

The designer should sit at the gate during the busiest time of morning and evening and watch people come in and out

The designer should rely on her own experience entering the gate to decide which authentication scheme will work best.

The designer should look for which biometric authentication systems are easiest to implement

The designer should choose the biometric authentication mechanism that has the most support in her preferred programming language

2 hours

10 minutes

No Delay

10 seconds

Voice recognition

Face recognition

Free gestures

She should buy the hardware and implement the system, followed up by training for employees who have trouble. Since she is a designer and security expert, she knows that this system is the best way to go.

Her lunch’s pizza box is about the size of the gesture reading hardware. She should paint the box and position it at the gate where the real tool would go, and then ask people to pretend to authenticate as they come in so she can get information about the process. If people don’t like it, she can revise the design

She should make the system work on her computer with hardware she has and test it in her lab. If it works there, she should buy the expensive system and implement it at the gate.

Question 18

The free gesture system is implemented, and all employees have stopped by the IT office to teach the system what their authenticating gesture is by entering it on a touch screen in the office. A couple weeks later, people who drive SUVs start complaining that they sometimes need to enter their gesture 4 or 5 times because it is not recognized (probably because they are making it from an odd angle – their cars are high up above the device where they enter their gesture). What type of usability problem is this?

1 point

SUV drivers should, instead, be required to type in a password on a touch screen at the gate (similar to an ATM touchscreen)

Nothing – the SUV drivers need to learn to work with the system

When they teach the system what their authenticating gesture is, they should do it from their car rather than in the IT office so there is a better match between their “true” gesture and what they enter when they drive in

SUV drivers should be given additional training on how to properly enter a gesture

Question 20

After a while, the IT office complains to the designer that people keep coming in having forgotten their gestures. This is a problem because traffic backs up when a person can’t remember the gesture, it takes a lot of time to reset the gesture, and people are trying to get around the system by closely following the person in front of them through the open gate. The designer decides that from now on, when people create new gestures, it should be the person’s normal signature. Which usability aspect does this improve?

1 point

It lets users rely on existing mental models

It is less taxing on memory

It doesn’t

It is faster

Inhibiting established practice.

Obscuring potential information flow.

Obscuring actual information flow.

Emphasizing configuration over action

Lacking coarse-grained control.

Yes

Question 24

A designer at Company 123 is considering changing their login interface so the password box shows the last character typed for 1 second before changing it to the standard star or dot that prevents over the shoulder attacks. They hope this will help people spot when they have made a typo as they enter their password. How should she determine if this is a good change to make?

1 point

Run a full usability study on the site with new and old version of the login system,

Show both versions to all the designers at Company 123 and have them choose which is the best

Show users both versions and ask them to vote

Run an A/B test and see which version has fewer failed logins

True

False

Usable Security