Does higher security always result in better protection? An approach for mitigating the trade-off between usability and security

Security software protects computers against undesired programs, informing users about potential danger. Maximum protection should be achieved with high security levels, which, however, have the disadvantage of generating a high number of unnecessary warnings. A frequent interruption of workflow is perceived as annoying and may even decrease compliance with the security software. The objective of this study was to examine this trade-off between security and usability. While performing a computer game, participants were randomly attacked by a virus. Security software informed them about potential damage. The control group was forced to use a very high security level. The experimental group who was given the opportunity to select a security level chose for medium-high levels. Performance, behavioural and subjective data was collected. The analysis revealed significant differences between the two groups. The experimental group complied more with the system which led to a better performance due to less damage. Furthermore, their acceptance of and trust in the system were higher while their perceived workload was lower. These findings indicate that a reduction of security level might increase overall protection as users are more willing to follow advices given by the security software.