Testing Law 1 Compliance: Task analysis
My first law of usable security is that the user cannot be secure unless they have the information necessary to perform their tasks securely. How do we achieve this?
The first step is to do some use case analysis that is grounded in real world user tasks.
Many security use cases are of the form 'Alice wants to set confidentiality protections on her X directory to stop anyone but Bob reading them'. That is not a security use case, it is a description of how to meet the use case. This may appear obvious, but I have seen a room full of security experts develop 'security use cases' that are entirely of this form. Such use cases are useful when doing architectural design but they are worse than useless for usability analysis.
A real security use case for assessing usability would be something like 'Alice has a set of documents. The documents are confidential and must not be read by anyone other than Bob. Use case (1) how does Alice store the documents in the office, (2) work on the documents at home, (3) communicate the document drafts to Bob'.
In other words, a security use case is identical to an application use case, it is in fact an application use case. The only thing that changes is that the scenario calls out the fact that the documents are subject to confidentiality requirements.
Next: Task Analysis for WiFi.
