The Art of Balancing Security and UX Design

A cybersecurity expert we know once told me that a computer can be truly secure only when it is disconnected from the network and buried 20 feet underground. Users are the main vulnerability in any system, so the pipe dream of security professionals is to hide their clients' systems away from everyone.

UX designers have entirely different dreams. Designers believe that the user's journey through a web application should be smooth and easy, consisting of no more than three mouse clicks. They advocate for user needs and they are the ones who prevent security professionals from burying computers underground.

Do you feel this tension between designers and the security department?

The security department tries to block everything. Interface designers strive to make everything easy to use. It seems that security and usability are two players in a zero-sum game: if you make something secure, it inevitably becomes harder to use; if you make something simple, it inevitably becomes less secure.

However, security and usability can coexist. To debunk the mythical relationship between them, we need to consider three statements:

• People don’t care about security
• Security ≠ blocking everything. 
• Design ≠ simplifying work. 

Let’s start from the beginning.

People Don’t Care About Security

Not exactly. They care, but in the long run. Everyone wants their personal data and property to be safe, so they install expensive door locks and surveillance cameras.

But encountering an unexpected security notification is a different matter, which can be quite annoying. After all, at the moment you open a particular application, you are doing it for a reason, and that reason is not security, but the task you need to accomplish.

And a sudden pop-up saying: "Your connection is probably somewhat insecure" is a small obstacle on the way to your goal. People don’t care about obstacles. They look for ways around them and always find them.

What if the door you frequently use requires a keycard that you don’t have? You’ll likely find a brick and use it to prop the door open.

If your employer forces you to change your passwords every month, you will probably write them on a sticky note so you don’t forget.

On average, a person has passwords for 100 different accounts. 100 is too many to remember, so it’s no wonder that people either use very simple passwords or have a few and use them for all accounts.

When security gets in the way of the process, people find a workaround. If you make something too secure, it becomes less secure.

We can conclude that erecting security barriers in front of people trying to do their jobs doesn’t work, but there are other approaches that do.

Security ≠ Blocking Everything

There is UX security that blocks nothing – it keeps users safe while remaining invisible to them. The evolution of CAPTCHA is a perfect illustration of how this is possible.

Interesting fact: Did you know that CAPTCHA stands for "Completely Automated Public Turing test to tell Computers and Humans Apart"? Those security people just can’t help themselves; they keep making things more complicated. No wonder the first text-based CAPTCHAs were unsolvable for both humans and bots.

The next generation of image-based CAPTCHAs, where you had to select a bicycle, bus, or traffic light, was better but still felt like a waste of your life.

Then Google introduced the "I’m not a robot" checkbox, which allowed us to breathe a sigh of relief. Finally, Google gave us "no CAPTCHA reCAPTCHA", which doesn’t force you to do literally anything to prove you’re human.

Malicious bots don’t necessarily watch cat videos on YouTube before launching their malicious actions. So if Google’s AI considers your previous online behavior to be human-like, it won’t make you lift a finger. Only if Google is still unsure of your true nature will it make you solve a CAPTCHA as an additional security measure.

But not all security measures can be made invisible like CAPTCHA. Often, users need to take some action. When you ask them to create strong passwords or enable two-factor authentication, it obviously creates obstacles in the user journey. However, the feeling these obstacles evoke depends entirely on the design.

Remember the last time an app asked you to create a strong password? It probably made you read a long list of requirements (and question your life choices). That’s if you were lucky. If not, the long list of requirements only appeared after you had come up with a password – to tell you that your password is invalid because it lacks an uppercase letter, a number, a hieroglyph, and a hawk’s feather.

In the latter case, the interface violates a key principle of human-centered design: visibility. The user should know, just by looking at the interface, what options they have and how to access them. If they don’t know the rules of the game, an error notification turns a small password into an annoying barrier in their path. We can definitely do better.

Look at the elegant solution to the password problem from Mailchimp. First, all requirements are stated upfront, so you don’t have to play guessing games. Second, the requirements update as you type. The way the list checks off items as the user types is a great example of a system providing clear and immediate feedback on their actions. Follow simple design principles for security, and you will minimize the negative impact of your security measures.

Design ≠ Simplifying Work

Some things should be easy to use, but they aren’t. Other things are intentionally difficult to use – and should be. You can’t tell the difference unless you understand:

• The specific intentions of the user
• At a specific time
• In a specific place.

Achieving such understanding is difficult. To understand users so deeply, designers need to go through the full spectrum of design thinking:

• Conduct user research
• Then crystallize all findings into user personas and user journeys
• Create prototypes based on the findings
• And conduct user testing to track what users actually do when using your digital products.

If you don’t feel like dealing with real user intentions and want to start designing right away, you might assume that users want everything to be simple. That’s a perfectly logical but sometimes mistaken assumption. Proven by the Citibank example.

A few months ago, Citibank was trying to collect 9 million rubles in interest payments. Instead, it sent 900 million rubles, and this was recognized as one of the biggest blunders in banking history. How could this happen?

It went wrong because the responsible person did not check two extra boxes in the form. Let’s look at the form:

The screen looks like it’s from the early 90s, which is a problem in itself. The interface clearly violates the principles of visibility and feedback. When you look at the form, you have no idea how to make the required payment. When you ask yourself "What happened?" and "What does this mean?", the interface mysteriously remains silent. Everything is set up for a huge error.

But more interesting is how the system reacts to the inevitable error.

When you try to transfer an amount a hundred times larger than usual, that’s atypical behavior. So atypical that Google would suspect you’re a bot and prompt you to solve a CAPTCHA.

If the Citibank interface had suspected that something was wrong, it would have shown a dialog box asking if you really wanted to transfer almost 1 billion rubles. If you didn’t, you would have canceled the action and the day might have been saved. But apparently nothing like that happened, because three people reviewed the parameters of the fateful Citibank payment and approved them without hesitation.

The Citibank system, looking at its interface, is clearly overcomplicated. But it is overly simplified from a security perspective. If you had asked Citibank on that fateful day whether they would have wanted one little UX design friction to prevent blind approval of atypical transactions, they would have unequivocally said "yes".

Thoughtful design should draw users’ attention to critical moments in their workflow.

Summary of Security System Design Principles

• People don’t care about security. Make something too secure, and they will find a way around it.
• Security ≠ blocking everything. If you want people to follow your security measures, ideally make them invisible. If that’s not possible, use UX design so they don’t feel like obstacles in the user’s path.
• Design ≠ simplifying work. If you think you’re making everything fast and easy, you probably need to understand user intentions more deeply. Sometimes you need to slow down the process to highlight its importance.

Security without design irritates people so much that it becomes ineffective, and design without security fails to support people in critical situations. Thus, it turns out that user experience and security are far from always separate. The biggest secret of security and UX design is that they actually cannot survive without each other.