Security Through Design - Making Security Better By Designing for People
summary
Argues that “human error” is a symptom of bad systems and offers concrete fixes: operational checklists like pilots use, design thinking and empathy (example: Facebook’s 2G Tuesdays), running A/B testing on wording and UI, and using smart defaults (organ‑donor opt‑out vs opt‑in, automatic updates in Chrome/iOS). Shows phishing reporting fails end‑to‑end and recommends simpler language, aligned incentives (reward stronger passwords or TFA), prototyping, and removing unnecessary layers rather than piling more controls.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 0:45Why do things work
- 3:18Human stupidity
- 4:25Complex systems
- 5:24Desire trails
- 8:07Checklists
- 9:22Design Thinking
- 10:55Empathy
- 12:00Design
- 13:57Phishing
- 15:07The real problem
- 16:10Phishing emails
- 17:05Microsoft Office
- 17:55AB Testing
- 19:55Power of defaults
- 21:20Popular options
- 21:57Incentives
- 22:48Ecosystem
- 23:58Language
- 24:43Practical Tips
- 25:38Closing
related talks
18mDesigning for Security Outcomes
47mTransforming Security Through Design
29mSecurity by(e) Design?
46m“The System...Is People!” Designing Effective Security UX
43mSecurity By Design
29mThe Importance of Design: maybe the users aren't wrong?
31mThe psychology of security: Why we make mistakes
02mYou got your design team in my security team!