Guidelines for designing IT security management tools

TLDR

Usability of security management tools is a key factor affecting the effectiveness of organizational security systems. The paper surveys design guidelines for security management tools. The authors collected guidelines from literature and prior studies, categorized them into high‑level recommendations, linked them to security challenges, and illustrated their relevance with practitioner quotes. The resulting guideline framework aids developers, practitioners, and managers in designing and evaluating security tools.

Abstract

An important factor that impacts the effectiveness of security systems within an organization is the usability of security management tools. In this paper, we present a survey of design guidelines for such tools. We gathered guidelines and recommendations related to IT security management tools from the literature as well as from our own prior studies of IT security management. We categorized and combined these into a set of high level guidelines and identified the relationships between the guidelines and challenges in IT security management. We also illustrated the need for the guidelines, where possible, with quotes from additional interviews with five security practitioners. Our framework of guidelines can be used by those developing IT security tools, as well as by practitioners and managers evaluating tools.