Published: May 31, 2021
The following paper has been accepted at the The 16th International Conference on Availability, Reliability and Security (ARES 2021) (ETACS 2021):
- Title: Do Security Reports Meet Usability? - Lessons Learned from Using Actionable Mitigations for Patching TLS Misconfigurations
- Author: Salvatore Manfredi, Mariano Ceccato, Giada Sciarretta, Silvio Ranise
- Abstract: Several automated tools have been proposed to detect vulnerabilities. These tools are mainly evaluated in terms of their accuracy in detecting vulnerabilities, but the evaluation of their usability is a commonly neglected topic. Usability of automated security tools is particularly crucial when dealing with problems of cryptographic protocols for which even small—apparently insignificant—changes in their configuration can result in vulnerabilities that, if exploited, pave the way to attacks with dramatic consequences for the confidentiality and integrity of exchanged messages. This becomes even more acute when considering such ubiquitous protocols as the one for Transport Layer Security (TLS for short). In this paper, we present the design and the lessons learned of a user study, meant to compare two different approaches when reporting misconfigurations. Results reveal that including contextualized actionable mitigations in security reports significantly impact the accuracy and the time needed to patch TLS vulnerabilities. Along with the lessons learned, we share the experimental material that can be used during cybersecurity labs to let students configure and patch TLS first-hand.
- DOI: 10.1145/3465481.3469187
- Complementary Material: Link
About the conference
- Name: The 16th International Conference on Availability, Reliability and Security (ARES 2021) (ETACS 2021)
- Date: from August 17, 2021 to August 20, 2021
- Location: Virtual Event
- Website: https://www.ares-conference.eu/workshops/etacs-2021/