Human Factors in Security and Privacy (HumSecPri)5 ECTS
(englische Bezeichnung: Human Factors in Security and Privacy)

Lehrveranstaltungen:

• • Human Factors in Security and Privacy
    (Vorlesung, 2 SWS, Zinaida Benenson, Do, 14:15 - 15:45, K1-119 Brose-Saal)
  • Human Factors in Security and Privacy - Übung
    (Übung, 2 SWS, Zinaida Benenson)

Empfohlene Voraussetzungen:

REQUIRED: basic knowledge in the area of IT security and privacy, such as security goals (CIA), basic protection mechanisms (symmetric and asymmetric cryptography principles), cryptographic hash functions, digital certificates, PKI, basics of SSL/TLS. This knowledge can be acquired through the attendance of the module “Applied IT Security” or similar modules.

Es wird empfohlen, folgende Module zu absolvieren, bevor dieses Modul belegt wird:

Angewandte IT-Sicherheit (WS 2019/2020)

Inhalt:

Das Modul findet online statt, solange die Corona-Maßnahmen bestehen. Termine werden voraussichtlich wie geplant stattfinden: erste Vorlesung am Do 23.4., erste Übung am Mi 29.4.20. Vorlesungen und Übungen werden aufgezeichnet und ins StudOn gestellt. Links zu entsprechenden virtuellen Räumen werden über StudoOn E-Mails kurz vor dem Vorlesungsbeginn mitgeteilt.

People are often said to be “the weakest link” in the chain of IT security measures. This course provides insight into the ways in which IT security is affected by people and why it happens. Special attention will be paid to complex environments such as companies, governmental organizations or hospitals. A number of guest talks from practitioners and researchers highlight some of the issues in greater depth.

The course covers the following topics:

• Terminology of security and privacy, technical and non-technical protection measures

• Development and testing of usable security mechanisms (encryption and authentication tools, security policies, security warnings)

• Risk perception and decision making in security and privacy context (usage of security software, reaction to security warnings, divulging information in social media)

• Economics approach to security and privacy decision making (traditional and behavioral economics)

• Trade-offs between the national security and surveillance (psychology behind the EU data retention directive and NSA programs)

• Psychological principles of cyber fraud (scams, phishing, social engineering)

• Security awareness and user education

• Interplay of safety and security in complex systems

• Research methods in human factors (qualitative vs. quantitative research, usability testing, experimental design, survey design, interviews)

The exercises aim at deepening the understanding of the topics and are highly relevant for oral examinations. We plan to conduct approximately eight exercises per semester; the rest of the exercises is reserved for the guest talks. A typical exercise consist of two parts:
(1) For each topic, the students receive a homework assignment consisting of practical exercises.
(2) For each topic, the students receive 1-3 papers to read for the next exercise. The papers will be discussed in the class with the teaching assistant.

Lernziele und Kompetenzen:

The main goal of this course is for the students to develop a mindset that naturally takes into account typical psychological and physical characteristics of the users. In particular, when developing or evaluating security- and privacy-enhancing technologies or policies, the students are able to:

• critically appraise technological solutions or policies for likely “human factors” weaknesses in design and usage

• choose appropriate techniques for testing and evaluation of the design and usage

• develop and test improvements
  

More precisely, after the successful completion of the course the students are able to:

• discuss the meanings of the terms “security” and “privacy”

• identify main research questions in the area of human factors in security and privacy

• demonstrate specific difficulties in developing and testing of usable security mechanisms

• compare different approaches to the development of usable security features

• apply elements of the mental models approach and of user-centered design to development and evaluation of security- and privacy-enhancing techniques

• contrast the approaches of traditional and behavioral economics to the explanation of security- and privacy-related behavior

• illustrate the influence of the psychological risk perception principles (especially under- and overestimation of risk) on security and privacy decision making

• argue advantages and disadvantages of mass surveillance and other kinds of mass data collection for security and privacy of citizens

• explain main psychological principles behind the cyber fraud

• illustrate specific difficulties in awareness campaigns and user training in the realms of security and privacy

• critically appraise design and results of published user studies

• plan and conduct small user studies

• scan research papers and other materials for important points that clarify and deepen course contents

• prepare and conduct a discussion in the class on a given topic, using research papers and other materials

• develop well-founded personal opinions on the course topics and defend them in the class discussions
  

Literatur:

• L. F. Cranor, S. Garfinkel. Security and usability: designing secure systems that people can use. O'Reilly Media, Inc., 2005.

• Schneier, Bruce. "Beyond fear." Copernicus Book, 2003.

• Anderson, Ross. Security engineering. 2nd edition, John Wiley & Sons, 2008. http://www.cl.cam.ac.uk/~rja14/book.html
  

Organisatorisches:

Die Modulsprache ist Deutsch, Folien sind auf Englisch. Übungen sind auf Deutsch formuliert, und können in Englisch beantwortet werden. Klausuraufgaben werden auf Deutsch gestellt. Klausuraufgaben können sowohl auf Deutsch als auch auf Englisch beantwortet werden.
This module will be held in German, slides are in English. Assignments will be formulated in German, and can be answered in German or English. Written exams will be formulated in German and can be answered in German or English.

Verwendbarkeit des Moduls / Einpassung in den Musterstudienplan:
Das Modul ist im Kontext der folgenden Studienfächer/Vertiefungsrichtungen verwendbar:

1. Informatik (Bachelor of Arts (2 Fächer))
   (Po-Vers. | TechFak | Informatik (Bachelor of Arts (2 Fächer)) | Vertiefung Informatik I und II | Vertiefungsrichtung IT-Sicherheit | Human Factors in Security and Privacy)
2. Informatik (Bachelor of Arts (2 Fächer))
   (Po-Vers. 2013 | TechFak | Informatik (Bachelor of Arts (2 Fächer)) | Vertiefung Informatik I und II | Vertiefungsrichtung IT-Sicherheit | Human Factors in Security and Privacy)
3. Informatik (Bachelor of Science)
   (Po-Vers. 2009s | TechFak | Informatik (Bachelor of Science) | Wahlpflichtbereich (5. und 6. Semester) | Wahlpflichtmodule | Vertiefungsrichtung IT-Sicherheit | Human Factors in Security and Privacy)
4. Informatik (Bachelor of Science)
   (Po-Vers. 2009w | TechFak | Informatik (Bachelor of Science) | Gesamtkonto | Wahlpflichtbereich (5. und 6. Semester) | Wahlpflichtmodule | Vertiefungsrichtung IT-Sicherheit | Human Factors in Security and Privacy)
5. Informatik (Master of Science)
   (Po-Vers. 2010 | TechFak | Informatik (Master of Science) | Gesamtkonto | Wahlpflichtbereich | Säule der systemorientierten Vertiefungsrichtungen | Vertiefungsrichtung IT-Sicherheit | Human Factors in Security and Privacy)
6. International Information Systems (IIS) (Master of Science)
   (Po-Vers. 2014w | ReWiFak | International Information Systems (IIS) (Master of Science) | Informatics | Informatics Electives | Extension Courses | Human Factors in Security and Privacy)
7. International Information Systems (IIS) (Master of Science)
   (Po-Vers. 2017w | ReWiFak | International Information Systems (IIS) (Master of Science) | Gesamtkonto | Informatics | Informatics Electives | Extension Courses | Human Factors in Security and Privacy)
8. International Information Systems (IIS) (Master of Science)
   (Po-Vers. 2018w | ReWiFak | International Information Systems (IIS) (Master of Science) | Gesamtkonto | Informatics | Electives (Informatics) | Digital business (Informatics - Elective) | Human Factors in Security and Privacy)
9. Mechatronik (Master of Science)
   (Po-Vers. 2012 | TechFak | Mechatronik (Master of Science) | Gesamtkonto | M1-M2 Vertiefungsrichtungen | 6 Eingebettete Systeme | 6 Eingebettete Systeme | Human Factors in Security and Privacy)
10. Medizintechnik (Bachelor of Science)
    (Po-Vers. 2018w | TechFak | Medizintechnik (Bachelor of Science) | Gesamtkonto | Pflicht- und Wahlpflichtmodule der Studienrichtung Medizinelektronik, medizinische Bild- und Datenverarbeitung (Modulgruppen B5 und B8) | B8 Wahlpflichtmodule der Studienrichtung Medizinelektronik, medizinische Bild- und Datenverarbeitung | Vertiefungsmodule ET/INF | Human Factors in Security and Privacy)
11. Medizintechnik (Master of Science)
    (Po-Vers. 2013 | TechFak | Medizintechnik (Master of Science) | Studienrichtung Medizinische Bild- und Datenverarbeitung | M5 Medizintechnische Vertiefungsmodule (BDV) | Human Factors in Security and Privacy)
12. Medizintechnik (Master of Science)
    (Po-Vers. 2018w | TechFak | Medizintechnik (Master of Science) | Studienrichtung Medizinische Bild- und Datenverarbeitung | M5 Medizintechnische Vertiefungsmodule (BDV) | Human Factors in Security and Privacy)
13. Medizintechnik (Master of Science)
    (Po-Vers. 2019w | TechFak | Medizintechnik (Master of Science) | Modulgruppen M1, M2, M3, M5, M7 nach Studienrichtungen | Studienrichtung Medizinische Bild- und Datenverarbeitung | M5 Medizintechnische Vertiefungsmodule (BDV) | Human Factors in Security and Privacy)

Studien-/Prüfungsleistungen:

Human Factors in Security and Privacy (Prüfungsnummer: 658644)

(englischer Titel: Human Factors in Security and Privacy)

Prüfungsleistung, Klausur, Dauer (in Minuten): 90, benotet, 5 ECTS

Anteil an der Berechnung der Modulnote: 100.0 %

weitere Erläuterungen:
Gemäß Corona-Satzung wird als alternative Prüfungsform festgelegt: Klausur, Dauer (in Minuten): 90, benotet Klausuraufgaben werden auf Deutsch gestellt Klausuraufgaben können sowohl auf Deutsch als auch auf Englisch beantwortet werden

Prüfungssprache: Deutsch und Englisch

Erstablegung: SS 2020, 1. Wdh.: WS 2020/2021

1. Prüfer:

Zinaida Benenson

Termin: 19.10.2020, 13:00 Uhr, Ort: H 11
Termin: 25.03.2021, 14:00 Uhr, Ort: H 10 TechF
Termin: 04.10.2021, 10:30 Uhr, Ort: H 7 TechF
Termin: 07.04.2022, 11:00 Uhr, Ort: H 8 TechF