Insufficient Psychological Acceptability

Opis

The product has a protection mechanism that is too difficult or inconvenient to use, encouraging non-malicious users to disable or bypass the mechanism, whether by accident or on purpose.

Skutki

• Access Control

  Bypass Protection Mechanism

  By bypassing the security mechanism, a user might leave the system in a less secure state than intended by the administrator, making it more susceptible to compromise.

Zapobieganie

• Testing

  Where possible, perform human factors and usability studies to identify where your product's security mechanisms are difficult to use, and why.

• Architecture and Design

  Make the security mechanism as seamless as possible, while also providing the user with sufficient details when a security decision produces unexpected results.

Słabość nadrzędna

• CWE-657 Violation of Secure Design Principles
• CWE-693 Protection Mechanism Failure

Kiedy powstaje

• Architecture and Design

Dotyczy

Not Language-Specific

Uwagi

This weakness covers many security measures causing user inconvenience, requiring effort or causing frustration, that are disproportionate to the risks or value of the protected assets, or that are perceived to be ineffective.

Źródła

1. The Protection of Information in Computer Systems — Jerome H. Saltzer, Michael D. Schroeder, Proceedings of the IEEE 63, 1975
2. Psychological Acceptability — Sean Barnum, Michael Gegick, 2005
3. Usability of Security: A Case Study — J. D. Tygar, Alma Whitten, SCS Technical Report Collection, CMU-CS-98-155, 1998
4. 24 Deadly Sins of Software Security — Michael Howard, David LeBlanc, John Viega, "Sin 14: Poor Usability." Page 217, McGraw-Hill, 2010