Introduction

The Workshop on Usable Security (USEC) serves as an Asian forum for research and discussion in the area of human factors in security and privacy.

It is the aim of USEC to contribute to an increase of the scientific quality of research in human factors in security and privacy. To this end, we encourage replication studies to validate previous research findings. Papers in these categories should be clearly marked as such and will not be judged against regular submissions on novelty. Rather, they will be judged based on scientific quality and value to the community. We also encourage reports of faded experiments, since their publication will serve to highlight the lessons learned and prevent others falling into the same traps.

REGISTRATION: Please sign up for the registration using this form for us to coordinate attendance at the workshop. We will only provide a link to the virtual workshop to only those who have successfully registered.

Sponsors

Keynote

	Alana Maurushat is Professor of Cybersecurity and Behaviour at Western Sydney University and Director of the Cyber Incident Response Centre where she holds a joint position in the School of Computers, Data and Mathematical Sciences, and in the School of Social Sciences. She is currently researching on payment diversion fraud and ransomware, cyber risk management, neuro-morphic approaches to extreme edge computing, tracking money-laundering through bitcoin blenders, distributed extreme edge computing for micro-clustered satellites, and ethical hacking.
Usable Security Lessons from Covid - why Johnny can't secure small business
The rate and effects of the Covid virus were not the only thing to spread in 2020 and 2021; we also witnessed an exponential increase in cybersecurity incidents. During lockdown industry , government and people had to improvise literally overnight, and continue to evolve and, in some instances, re-organise in order to deal with cybersecurity incidents. We accidentally ended up conducting research on cybersecurity and small business during Covid. Our accidental experiment motivated us to expand the work into something more formal. We examined the cybersecurity principles in NIST and the ASD8, mapped them with existing training materials online, and evaluated if a small business could read and watch the training materials, then implement just one recommendation from the NIST and ASD8. Not a single small business could implement or understand any of the materials enough to implement even one recommendation. Following the results, we started to explore in detail the existing literature, videos and other dedicated to cybersecurity training for small business, NIST and ASD8. What did we find? That none of these materials or the principles are usable for small business. Moreover, many of the recommendations found in ASD8 and NIST are not affordable for small business. This presentation explores ways on how we as a community can improve the usability of cybersecurity and privacy for small business.

Program