Fahimeh Raja

31 January 2011

Abstract: Even though personal firewalls are an important aspect of security for the users of personal computers, little attention has been given to their usability. An initial series of usability studies on the Windows Vista firewall that we performed revealed that the participants' lack of an accurate mental model about the firewall's system model significantly contributed to their errors when configuring the firewall. The goal of this thesis research was to build upon these findings and improve the usability of personal firewalls. To do so, we redesigned the user interface of the Vista firewall to more accurately reflect its system model. The results of a laboratory study showed that the modified interface design helped participants to develop more effective mental models of the firewall and improve their understanding of the firewall's configuration, resulted in fewer potentially dangerous errors. However, participants' comments about personal firewalls revealed that it was important to better understand the users' knowledge, expectations, perceptions, and misconceptions of personal firewalls in order to successfully manage design tradeoffs. We performed a follow-up study, where we conducted semi-structured interviews with a diverse set of participants. Through a qualitative analysis of the data, we found that most of the participants were unaware of the functionality of firewalls and their role in protecting computers. More interestingly, we found that the interaction of most participants with firewalls was limited to responding to warnings, which ask them to allow or block a connection. Therefore, it is crucial to design firewall warnings that are understandable for users, which should result in fewer errors in allowing unwanted connections. We proposed a novel firewall warning design in which the functionality of a personal firewall is visualized based on a physical security mental model. The results of a laboratory study showed that the new warnings facilitated the comprehension of warning information, better communicated the risk, and increased the likelihood of safe behavior compared to warnings based on those from a popular personal firewall. Moreover, the new warnings provided participants with a better understanding of both the functionality of a personal firewall and the consequences of their actions.


Published in: Fahimeh Raja, "Towards Improving the Usability of Personal Firewalls," MASc thesis, Department of Electrical and Computer Engineering, University of British Columbia, Vancouver, Canada, January 2011.: