Heuristics for evaluating IT security management tools

  • Authors:
  • Pooya Jaferian;Kirstie Hawkey;Andreas Sotirakopoulos;Maria Velez-Rojas;Konstantin Beznosov

  • Affiliations:
  • University of British Columbia, Vancouver, Canada;Dalhousie University, Halifax, Canada;University of British Columbia, Vancouver, Canada;CA Technologies, San Jose, California;University of British Columbia, Vancouver, Canada

  • Venue:
  • Proceedings of the Seventh Symposium on Usable Privacy and Security
  • Year:
  • 2011

Quantified Score

Hi-index 0.00

Visualization

Abstract

The usability of IT security management (ITSM) tools is hard to evaluate by regular methods, making heuristic evaluation attractive. However, standard usability heuristics are hard to apply as IT security management occurs within a complex and collaborative context that involves diverse stakeholders. We propose a set of ITSM usability heuristics that are based on activity theory, are supported by prior research, and consider the complex and cooperative nature of security management. In a between-subjects study, we compared the employment of the ITSM and Nielsen's heuristics for evaluation of a commercial identity management system. Participants who used the ITSM set found more problems categorized as severe than those who used Nielsen's. As evaluators identified different types of problems with the two sets of heuristics, we recommend employing both the ITSM and Nielsen's heuristics during evaluation of ITSM tools.