Search

This chapter relates to human factors in computer security, and how surface technology might support security analysis. This specific domain allowed us to investigate surface application design and development in an established context, and thus learn how the real needs of the domain might best be supported. Throughout, we were fortunate to have partners in industry and government working in the domain who were able to give us advice and feedback. A number of projects were conducted over the span of our research program, each one offering findings that informed later projects. In this chapter, we provide an outline of our work, summarizing each of the main projects and their findings. We cover: (1) a literature review. (2) Ethnographic studies of firstly operators and technicians in seven operations centres, and secondly a team of ten professional analysts working in the security domain; (3) ACH Walkthrough, a collaborative web-based decision-making tool; (4) Ra, a tool that supports rollback, playback and other explorative actions when using web applications like ACH Walkthrough; and (5) Strata, a tool that allows for the annotation of web applications, enabling the work of collaborative teams.

Surface computing encourages exploratory interaction, and many applications are designed to work this way. In essence, the fluid interaction causes the user to ask “What if?” We suggest this requires support for recording the history of such explorations and allowing reversion to earlier states. There are currently a variety of related mechanisms, but they are either underpowered for the sort of interaction history management we suggest is needed, or are restricted to very specific domains. We present a prototype implementation of an interaction history manager: Ra is a JavaScript library for supporting this exploration and version tracking in web applications. We illustrate the interface for end users seen in augmenting simple web applications; we describe the underlying technical architecture, which uses ES6 Proxy objects to maintain access to the application’s model; and we present the API, which allows an existing application to include Ra with minimal code change.