Researching Sensitive HCI Aspects in Information Security: Experiences from Financial Services (position paper)

Information security practitioners are tasked with protecting their organisation’s assets and information – a sensitive area of work, especially in heavily regulated or critical infrastructure industries. Working directly with these individuals to learn more about HCI patterns and behaviours they display can be insightful, but not without challenges due to the perceived risk from sharing information involved. Ultimately, any public information may prove useful to potential attackers and actual risks can be difficult to quantify. This short position paper provides an introduction to the field before informally describing a number of experiences and observations made when working with financial services information security practitioners in a limited number of studies. This is followed by an indication of challenges and opportunities in this area to help enable potential discussions with other researchers and lastly a brief summary.

This short position paper was shared amongst and reviewed by members of the sensitive HCI research community at CHI - given the sensitive nature of several position papers in this area included in the workshop, these have not been made available to the public generally at this point in time.