Security usability: more important than your control

At Seattle Bsides 2024, I presented on the concept of security usability. We discussed studies that have been conducted on real-world examples of security usability challenges, such as password policies, and the concept of security exhaustion, which is what happens when people become frustrated with obtuse security controls and become less likely to follow security advice.

Then, we discussed how this applies in the real-world. I posited that by considering the overall success rate of security controls when applied to an organization, and not just how we think they will result if everyone were compliant with them, we can do a better job of providing lasting results for the companies we work for.