Peter is an experienced Technical Security Adviser that apart from doing vulnerability assessments, penetration tests and IT forensics also teaches application security on security courses. Right now Peter is writing a chapter about secure programming in a Swedish security book that will be published during the spring of 2009.

Reflections on Peters talk

Peters talk made me realize that we as developers can do a lot to prevent security breaches in the applications we build by just taking these matters in consideration on an early stage in the development process. It also made me realize that there’s a lot to learn about building secure applications that I simply wasn’t aware of.

A false sense of security

Far to often we put our trust in firewalls and other shell protections to do the work for us. But these merely give us an outer protection. Once an intruder is on the inside they don’t do us any good.

We also seldom take “misuse” of our application by ordinary users into account. These are already on the inside and can operate freely if we haven’t made the proper precautions to prevent it.

Application security vs Usability

One thing that I thought about was the trade-off between security and convenience. Take for example many web applications where you can retrieve your password by answering some question like, “What was you mothers maiden name”. That’s something that’s not really hard for someone to find out if they really want to break into your account. At the same time it’s convenient to be able to easily and fast retrieve a lost password. I guess what it all boils down to is to determine how important and confidential the data your protecting is.

One other thing that struck me was the parallel between how security and usability often are thought of in a development project. Often it’s not something that the customer explicitly require and therefor it’s not accounted for in the project plan. Instead it’s something that comes up at the end of a project, right before launch. “Oh, it needs to be secure (usable) as well.”

It’s much harder to implement security at the end of a project and that’s when it becomes really expensive. Peter said that security doesn’t have to be expensive. If you plan for it right from the start it doesn’t have to cost a lot. In my experience it’s the same thing with usability. It’s much cheaper to take it into consideration from the start than to do it at the end. It also gives a much better result.

Download the presentation

Peters presentation in pdf format (Swedish)

Webworkers

Webworkers is a network of people working with the web in one way or the other. Our goal is to get better at what we do by learning from each other. We also invite interesting people, like Peter Bayer, to give talks about various topics.

Example of professions that are involved in the network are developers, project leaders, business developers, designers and researchers. We operate mainly in the Växjö area in Sweden but plan to expand into other regions as well.

If you’re interested in joining the Webworkers network we have a group on LinkedIn that you can join. You can also contact me through the Contact page.

On World Usability Day on 13 of November we gathered a bunch of people to put focus on usability. The event which we called A nice cup of coffee on Usability Day, was held at my former employer, Visma Spcs office in Växjö. Chris Jangelöv was host for the event.

Here’s some pictures taken by from the event along with some comments. The pictures are taken by Ola Karlsson. Thanks a lot Ola!

Chris Jangelöv welcomed everyone and held a short introduction. Later he talked about one of his cars and some usability problems with it. He also talked about ventilation systems and water taps.

About 25 people showed up at the event.

I talked about usability in general but also about some usability issues I’ve encountered in my daily life.

Andreas Nivard from Visma Spcs talked about the design of his and his wifes cars, packaging of different sorts and how to keep warm in the office. A both humorous and interesting talk that was highly appreciated by the audience.

I haven’t got a picture of him but Staffan Gustafsson from Visma Spcs talked about how much he appreciated the possibility to import all settings to one Mac from another. Very handy when you’re buying a new computer. He only wished that it was possible on Windows machines, cause then he wouldn’t have to spend so much time acting computer support for his parents.

After the talks we had interesting discussions about different aspects of usability. All in all it was a really nice get together with lots of good conversations.

More info

For more information on World Usability Day please visit their web site at www.worldusabilityday.org. There’s also a Swedish site at www.wud.se.

If you’re living in the area and wish to participate in future events, contact me through my Contact page.

Here in Växjö, Sweden we’re going to celebrate this with a get together where I’m going to talk a little about usability in general and a few others are going to talk about specific usability problems and solutions. Other than that we’re just going to have a nice cup of coffee, some cookies and a nice chat. The event takes place at Visma Spcs at 15.00 and will last for about one and a half hour.

If you’re in the area and are interested in participating, sign up by leaving a comment or by contacting me through this blog’s contact page. It’s completely free of charge but you have to let us know in advance that you’re coming.