Design Principles for Actual Security

Abstract

The importance of designing for actual security, i.e., security in practice, is underlined by previous work. However, clear design principles for actual security are missing. This paper reports early work on establishing such design principles based on heuristic evaluations of security-enhancing applications. Seven experts evaluated the actual security of four applications for secure email communication. Based on a qualitative analysis of the experts’ findings, we formulate six design principles for actual security that apply to secure email, secure communication, and other security-enhancing applications.