Three questions
- Security: does the system protect information and manage relevant risks?
- Usability: can people understand it and use it effectively?
- Functionality: does it provide the capabilities they need?
Thinking beyond a trade-off
A difficult control may encourage workarounds, but security and usability are not always opposing goals. Good design can improve both: a clear authentication flow can be easier to use and harder to misuse.
A fictional example
Removing a useful feature may reduce one risk but disrupt legitimate work. A proportionate response might keep the feature with suitable permissions, clear defaults and monitoring.
Key takeaway
Evaluate controls in context. Ask whether they address the risk and whether people can follow them reliably.
Further reading
NCSC technology assurance: product design and functionality.