A Holistic Approach to Secure Programming and Usable Security Research

In the age of digitalization, we see a persistent gap between the theoretical security of e.g., cryptographic algorithms and real-world vulnerabilities, data breaches, and possible attacks. As a result, secure programming and usable security challenges impact all actors involved in the creation and use of technology, ranging from system designers across administrators and developers to end-users. To successfully prevent involuntary loss of control over data and empower end-users to retain power over their security, we must take all involved actors into account. It is crucial to find the weak points and empowering all actors to strengthen the overall security. For end-users, this means e.g., working with warning messages, security indicators, and authentication mechanisms; for developers, improving APIs, documentation and developer tools; for system administrators, improving configuration languages and tools. In this talk, I demonstrate how a holistic approach to usability and secure programming helps close the gap between theoretical security and real-world deployments.