Productive Security - Improving security compliance and productivity through measurement

There has been a growing body of evidence that security policies and controls are not effective because employees either can't, or won't, comply. A key reason for non-compliance is the workload and complexity of security controls chosen - employees simply cannot cope with an ever-increasing number of ever-longer and more complex passwords. Yet most security-decision-makers do not factor the impact on employees, their tasks, and company's business processes, into their decision about which security controls to put in place. Current attempts to 'edcuate' employees about the need for security are largely ineffective because they simply push more information on people who are already overworked.
And even in organisations with a high security awareness, non-compliance can be observed because security policy cause excessive friction, or are not agile enough to meet the needs of the business.

There exists a strong requirement for a structured, scientifically-grounded decision-making framework into which existing data can be inserted, alongside the key 'missing link' measurements of employee's workload, risk perception, and resulting security behaviours. The project will work with at least two major companies to collect such data, and build a model of that allows security decision-makers to 'calculate' the impact of the security controls on employees and business processes, and balance them against the risk mitigation the security control achieves. A further innovative step in this proposal is that well-chosen security controls could make contributions to the business process beyond security, if the imformation they provide can be used to improve quality of products or services - hence the title of the project.

The proposed project will have relatively immediate benefits for the security and productivity of the companies participating in the project: the PIs, RAs and 2 PhD students will work with them to analyse security compliance issues, and help them to build a set of measurements for making decisions on how to improve them. By the end of the project, the organisations will have 1) a database of their security mechanisms and the employee effort associated with them, 2) a survey tool and set of organization-specific scenarios for measuring their employees' security attitudes and likely behaviour.

Their examples - which we will disseminate through publications and conferences aimed at practitioners - should encourage a wide range of both private and public sector organisations to adopt the measurements and tools developed by the project to improve their security decision-making. Each adopting organisation will be able to strengthen its security by increasing employee compliance and selecting effective security controls, and also improve its competitive position because those security controls improve, rather than reduce, productivity. From a national perspective, wide adoption of the measurements and approach will contribute to the aims of strengthening the digital economy, and making the UK a secure place in which to do business.

The evidence-based approach developed by the project will also have significant impact on both academic and professional security training, moving information security management from a craft-based discipline to a science-based one. The results and framework generated by the project will be used as part of the development of ongoing research agendas in information security, physical security, human-computer interaction (HCI), and security economics. The project seeks to address the underlying human and technological science behind observed security outcomes (both positive and negative). The project explicitly integrates social and technological factors and these are critical for development of each of the individual disciplines, both jointly and in isolation. As such, it will be a focus of intellectual leadership in a challenging interdisciplinary area that is currently badly in need of the introduction of a rigorous and structured framework and methodology.