SoylentNews

hubie [soylentnews.org] writes:

Why Computer Security Advice Is More Confusing Than It Should Be [ncsu.edu]:

If you find the computer security guidelines you get at work confusing and not very useful, you're not alone. A new study highlights a key problem with how these guidelines are created, and outlines simple steps that would improve them – and probably make your computer safer.

At issue are the computer security guidelines that organizations like businesses and government agencies provide their employees. These guidelines are generally designed to help employees protect personal and employer data and minimize risks associated with threats such as malware and phishing scams.

[...] "The key takeaway here is that the people writing these guidelines try to give as much information as possible," Reaves says. "That's great, in theory. But the writers don't prioritize the advice that's most important. Or, more specifically, they don't deprioritize the points that are significantly less important. And because there is so much security advice to include, the guidelines can be overwhelming – and the most important points get lost in the shuffle."

The researchers found that one reason security guidelines can be so overwhelming is that guideline writers tend to incorporate every possible item from a wide variety of authoritative sources.

"In other words, the guideline writers are compiling security information, rather than curating security information for their readers," Reaves says.

Drawing on what they learned from the interviews, the researchers developed two recommendations for improving future security guidelines.

First, guideline writers need a clear set of best practices on how to curate information so that security guidelines tell users both what they need to know and how to prioritize that information.

Second, writers – and the computer security community as a whole – need key messages that will make sense to audiences with varying levels of technical competence.

[...] "I also want to stress that when there's a computer security incident, we shouldn't blame an employee because they didn't comply with one of a thousand security rules we expected them to follow. We need to do a better job of creating guidelines that are easy to understand and implement."

The study, "Who Comes Up with this Stuff? Interviewing Authors to Understand How They Produce Security Advice [usenix.org]," was presented at the USENIX Symposium on Usable Privacy and Security [video [youtu.be]].

Original Submission