Study Guide
Security, Usability & Functionality
Evaluate security, usability, functionality and accessible authentication through a fictional school application and MFA decision.
Lesson 1.4 Cybersecurity Foundations
Every security measure is used by real people doing real work. This lesson is about judging a measure by what actually happens when they use it.
Stage: Think
A door propped open
A fire door with three locks is very secure. If it takes five minutes to open, somebody will prop it open with a chair, and then it protects nothing.
Think it through
The door locks very well, yet it ends up protecting nothing. Apart from how well it locks, what else would you ask about a door before calling it a good one?
- Hint 1: Think about the people who use the door every day.
- Hint 2: Could a door lock perfectly and still be no good for a wheelchair or a delivery?
Show what happens
Most answers fit two more questions besides “does it keep the wrong people out?”: can the right people get through it without a struggle, and does it do the job a door is for? The next step names all three.
Security that people cannot live with tends to get switched off, walked round or shared out.
Stage: Explain
Three questions
Think about the front door of a building. Three different questions can be asked about it.
- Security: does it keep out the people who should not come in?
- Usability: can the people who should come in open it without a struggle?
- Functionality: does it do the job a door is for? A door too narrow for a wheelchair or a delivery trolley fails here, however well it locks.
The same three questions apply to any computer system:
| Consideration | The question | For a system |
|---|---|---|
| Security | Does it give the protection that is needed? | Information and services are protected against the things that could realistically go wrong. |
| Usability | Can the intended people use it reliably? | They can understand it, get through it without repeated mistakes and are not worn down by it. |
| Functionality | Can it do the work it exists for? | It provides every capability the task needs. |
Together they are often shortened to SUF. It is a way of thinking about a design decision, not a formula: there is no score to calculate, and the right balance depends on the information, the people and the task.
Check your understanding
Show the answer
Answer: C. Functionality: it cannot do the work it exists for.
It fails on functionality: it cannot do a task the work depends on, however secure and easy it is.
Where the door comparison stops. A door has one lock for everyone. A computer system can give different people different, equally safe ways in. That matters later in this lesson, when one way of signing in does not work for every member of staff.
Stage: Predict
Thinking beyond a trade-off
Think it through
Show the answer
Answer: B. No: some changes improve security and ease of use at once.
Sometimes the three pull against each other, but often they do not: clear instructions, easy official routes and safe defaults improve security and usability together.
Sometimes the three do pull against each other. A restriction may close off a danger while adding a minute to a task that staff do forty times a day. Removing a feature may stop one kind of misuse and also stop something essential. When that happens, name the effect on each side. Do not assume that the most restrictive option is the best one.
Often, though, they are not in conflict at all, and improving one improves the others:
- Clear sign-in instructions mean fewer mistakes and fewer locked accounts.
- An easy, official way to ask for access means fewer people borrowing a colleague’s password.
- A sensible default means the safe choice is also the one that takes no effort.
Convenience is still not a reason to throw away a safeguard that is needed. When a control causes problems, the useful question is: can a different design give the same protection with less unnecessary difficulty?
Stage: Experiment
A fictional example
A fictional school keeps pupil records in a web application. Teachers and office staff use it every day to look up and update records. The school has to protect those records, and staff have to be able to do their jobs.
Define what success requires
Before judging any control, write down what success looks like under each heading.
Think it through
Try it before reading on: for the school’s records application, what would success look like under security, under usability and under functionality?
- Hint 1: Security: who should get in, and what should each person see?
- Hint 2: Usability: what would make a member of staff fail to sign in every morning?
- Hint 3: Functionality: what must staff be able to do with a record?
Show what happens
Compare your three with the lesson’s, which follow. Notice that each heading asks for something the others cannot supply.
- Security. Only staff can sign in. Each member of staff sees only the records their job needs: signing in successfully does not open every record. (Least Privilege develops that point.) The application keeps a record of who looked at what.
- Usability. Instructions are understandable, signing in takes a clear route, and an error message tells a genuine user what to do next without revealing anything useful to an attacker. A member of staff who fails a confusing sign-in three times every morning has a usability problem, even though every feature is technically present.
- Functionality. Staff can view the records they are allowed to see, make the updates they are allowed to make, and save them. A beautiful screen that cannot save an update is missing functionality. So is a restriction that stops every authorised person from doing an essential task.
The three overlap, but one cannot stand in for another. Checking that the sign-in page loads says nothing about whether the right person can finish the right task safely.
Stage: Predict
Examine a restrictive password policy
The school decides that every password must be changed every 30 days, on the reasoning that more changes must mean more security.
Think it through
Show the answer
Answer: B. Easier: people fall back on patterns and notes to cope.
Follow the rule through: people cope in predictable ways, and the passwords end up easier to guess.
- The rule starts. Mr Hughes, who teaches history, must think of a new password every month, on top of the others he already has.
- He copes in a predictable way.
Autumn2026!becomesWinter2026!, thenWinter2027!. A colleague writes hers on a note under the keyboard. - Judge the result, not the intention. The passwords are now easier to guess than before, because they follow a pattern, and some are written down beside the computer. The rule made security worse while also making the system harder to use.
- Look for a better design. The UK’s National Cyber Security Centre (NCSC) advises against making people change passwords on a schedule, for this reason. A better rule asks for one long password that is changed when there is a reason to think it has been found out.
The lesson is not “never change passwords”. It is that extra inconvenience is not evidence of extra protection: look at what the rule actually causes.
Stage: Predict
Accessibility
Think it through
Show the answer
Answer: A. Give them another approved way in that is just as safe.
The answer is an equally safe alternative: the requirement stays, and the route to meeting it changes.
A system is accessible when the people expected to use it can do so, including people with a disability. Accessibility is part of usability, and it is not a reason to drop a security requirement.
Suppose the school fits fingerprint readers and makes them the only way into the records application. A member of staff whose fingerprints the reader cannot read is now locked out of essential work, although they are fully authorised. Two responses are wrong: leaving them locked out, and letting them use a colleague’s account. The right response is another approved way in that is just as safe, such as a small security key they plug in and touch.
Do not assume one alternative suits everyone, and look at the whole journey: signing in for the first time, signing in every day, and getting back in after a lost device. A sign-in that works for someone is no use if the recovery process does not.
Things to check in a design:
- Keyboard operation: everything can be reached and operated without a mouse.
- Assistive technology: software such as a screen reader, which reads the screen aloud, can make sense of the labels, instructions and messages.
- Clear instructions and errors: they say what to do next without giving away sensitive detail.
- Timing: no unnecessary time pressure, such as a code that expires before a slower typist can enter it.
- Alternative methods: an approved route exists where the main one cannot be used, so nobody is pushed into an unofficial workaround.
- Testing with real users: the people who will use it try it with their actual tasks and devices. One successful test with one person does not show that everyone can get through.
Stage: Predict
Unintended consequences of poorly designed controls
Blocking necessary file access
The school restricts a shared folder of pupils’ exam arrangements to senior staff, for a sound reason: it contains sensitive information. Teaching assistants, who need it to set up exam rooms, can no longer open it, and nobody has told them how to ask.
Think it through
Show the answer
Answer: B. They will find unofficial ways to get the information.
Read on: within a week the list is in more places, and less protected, than before.
Within a week, one assistant has asked a senior colleague to email her a copy, and another keeps the list in her personal online storage. The information is now in more places, and less protected, than before the restriction.
One restriction, followed down two paths. Without a way to ask, blocked work finds unofficial routes and the information spreads. With a named owner and a written way to ask, the work is done and the protection holds. The fix is the route, not removing the restriction.
Starting pointThe exam-arrangements folder is restricted to senior staff, for a sound reason. Teaching assistants still need the list to set up exam rooms.
✗ No way to ask
- The exam rooms still have to be ready, so the work finds a way round the block.
- One assistant has a copy emailed to her; another keeps the list in personal online storage.
OutcomeThe list is in more places, and less protected, than before the restriction.
✓ A named owner and a written way to ask
- The need is confirmed: assistants set up exam rooms.
- A named person decides each request, using a simple written route.
- Assistants get exactly the access the task needs, recorded.
OutcomeThe work is done, and the list stays inside the school’s controls.
The answer is not to reopen the folder to everybody. It is to confirm who needs what, name the person who decides, and give assistants a simple, written way to ask for access. They then get exactly the access the task needs. Security Documentation shows how such approvals are recorded.
Generating excessive low-value alerts
The school’s network sends the IT technician an alert every time anything unusual happens: about 400 a day. Three of them matter.
Think it through
Predict: what happens to those three important alerts after a fortnight?
- Hint 1: How long would it take to read 400 alerts properly every day?
- Hint 2: What do people do with messages that are almost always unimportant?
Show what happens
After a fortnight she has stopped reading them, and the one that warned of a real problem is unread with the rest.
Check your understanding
Show the answer
Answer: C. Keep fewer, ranked alerts, each with a named owner.
Improve the alerts rather than silencing them: decide which events matter, rank them and say who acts on each kind.
More alerts did not mean better detection. Fewer, better alerts mean less work and a better chance that a real problem is seen.
Stage: Explain
Worked decision: introducing MFA
Passwords get guessed and stolen, so the school decides to add multi-factor authentication (MFA) to the records application: signing in with two different kinds of proof, such as a password (something you know) and a device (something you have). Someone who steals the password alone can no longer get in.
There are three common ways to provide the second proof.
- A text-message code. The service texts a six-digit code to the person’s mobile phone.
- An authenticator app. An app on the person’s smartphone shows a six-digit code that changes every 30 seconds.
- A security key. A small device, like a USB stick, that the person plugs in and touches.
Three members of staff show why one answer will not suit everyone.
- Mrs Adeyemi, a teacher, has no school phone and does not want school codes on her own.
- Mr Clarke, in the office, uses a screen reader. By the time a 30-second code has been read out and he has typed it, it has often expired.
- Ms Rahman administers the application: her account can change anyone’s access, so it matters more than most if it is taken over.
Think it through
Show the answer
Answer: B. A security key: there is no code to read or type.
Check your choice against the accessibility column of the table.
The table tests each method against the three questions and against accessibility.
Decision table: scroll horizontally on narrow screens.
| Method | Security | Usability | Functionality | Accessibility |
|---|---|---|---|---|
| Text-message code | Weakest of the three. Texts can be redirected to another phone, and a person can be tricked into typing the code into a fake website. | Familiar. Fails where there is no mobile signal. | Works with the application. | Needs a mobile phone, so not Mrs Adeyemi. A code to read and type against the clock, so difficult for Mr Clarke. |
| Authenticator app | Better. Nothing travels by text. The code can still be typed into a fake website. | One set-up, then quick. | Works with the application. Needs a smartphone. | Needs a smartphone, so not Mrs Adeyemi. The 30-second code is difficult for Mr Clarke. |
| Security key | Strongest. The key checks the website’s address itself and will not respond to a fake one. | Plug in and touch. Can be lost or left at home. | Works with the application. Costs about £25 each. | No phone and no code to read: works for Mrs Adeyemi and for Mr Clarke. |
Stage: Explain
Follow the decision through
Think it through
Suppose the new sign-in is working well. What single event is most likely to tempt someone into sharing an account?
- Hint 1: Think about what each method depends on.
- Hint 2: What happens on the morning someone arrives without it?
Show what happens
A lost or forgotten phone or key. The sixth step of the decision plans for exactly that day.
- Say what must be protected. Pupil records, and above all the administrator account. The stronger the account, the stronger the proof it should need.
- Rule out what does not meet the need. The text-message code is the weakest method and helps neither Mrs Adeyemi nor Mr Clarke. It is not offered.
- Choose a standard method. Most staff have a smartphone and are content to use it, so the authenticator app becomes the usual method. It costs nothing per person.
- Give an equally safe alternative to those who need one. Mrs Adeyemi and Mr Clarke are each given a security key. This is not a weaker exception: the key is the strongest of the three.
- Require the strongest method where the stakes are highest. Ms Rahman must use a security key for the administrator account.
- Plan for the bad day. A lost phone or key is the moment people are tempted to share an account. The school writes down one route: the member of staff goes to the IT office in person, is recognised, and is given a temporary code that lasts one day. Each use is recorded.
- Decide who owns it. The headteacher approves the approach. The IT manager runs it and reviews, each half term, how many people were locked out and whether anyone has been sharing an account.
The result. Every member of staff has a second proof they can actually use, the most powerful account has the strongest one, and nobody needs an unofficial workaround. The decision came from asking the three questions about three real situations, not from picking the “most secure” product.
Change one fact. Suppose the records application could not work with security keys at all. That is a functionality limit, and the fourth step fails: the school would need a different safe route for Mrs Adeyemi and Mr Clarke, such as a school-owned device kept in the office, or a different application. The right answer moved because one fact changed, which is why no method is “the best” everywhere.
Go deeper Passwordless sign-in and “phishing-resistant” methods
Phishing is tricking someone into giving away a secret, typically by sending them to a fake website that looks like the real one. A sign-in method is called phishing-resistant when there is nothing the person could type into a fake site: the security key in the decision is the usual example, because the key itself checks which site is asking.
Passwordless sign-in removes the password altogether: the person proves who they are with a device and, usually, a fingerprint, face or PIN on that device. It can be both easier and safer than a password. The label alone proves little, though. Whether a particular passwordless method resists phishing, and whether everyone can use it, depends on how it works and on what happens when the device is lost.
When people work around a control, for example by sharing an account or copying files somewhere unofficial, treat it as evidence about the design as well as about behaviour. Ask what legitimate task the control is blocking and whether an authorised route exists. Address the workaround and the design together.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
- Hint 1: Two responses are always wrong: leaving people locked out, and lowering the protection. What is left?
Show the answer
Answer: B. Offer another check of equal strength that works without sight.
The right answer keeps the protection and adds an approved route that blind residents can use. Removing the check and excluding people are both wrong.
- Hint 1: Ask what legitimate work the two-minute rule is getting in the way of.
Show the answer
Answer: A. The control blocks real work, so its design needs fixing too.
Treat the shared sign-in as evidence about the design: ask what legitimate work the control is blocking, and address the workaround and the design together.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: Assess accessible alternatives with appropriate protection, enrolment, recovery and support.
The required protection should remain while legitimate users have usable, accessible routes. Recovery and fallback need assessment rather than becoming an unexamined bypass.
Revision sources: Security, Usability & Functionality (Supplementary Study Guide explanation)
Show answer
Answer: False
Clear instructions, suitable defaults and accessible workflows can reduce mistakes and unsafe workarounds while improving protection and task completion. Trade-offs depend on the design.
Revision sources: Security, Usability & Functionality (Supplementary Study Guide explanation)
Show answer
Answer: Whether an authorised, usable sharing workflow can meet the security requirements and required tasks.
Evaluate the operational result, risk, accessibility and required functionality. A difficult control may encourage workarounds; revise the design without simply abandoning necessary protection.
Revision sources: Security, Usability & Functionality (Supplementary Study Guide explanation)
Practise selected concepts through the topic overview, quiz and flashcards. This revision is learning-only and is reached through the All topics track; it is not mapped to an examination.
Stage: Consolidate
Key takeaway
Ask together: Does the control address the risk? Can intended users operate it reliably and accessibly? Does the system still support its authorised tasks? Who owns the decision and checks the result?
Security, usability and functionality can involve trade-offs, but thoughtful design can also reinforce them together. People, Processes and Technology explains why the interface, support arrangements and operational responsibilities all contribute.
Later lessons take two parts of the MFA decision further: who is accountable for such a decision (Governance, Risk and Compliance) and how to weigh what could still go wrong (Risk).
What to remember
- Judge a control by three questions at once: does it protect, can people use it, and can the work still be done?
- Extra inconvenience is not extra protection: follow what a rule actually makes people do.
- The three often reinforce each other through clear instructions, easy official routes and safe defaults.
- Accessibility means an equally safe route, never a weaker one or a shared account.
- A workaround is evidence about the design, as well as about behaviour.
Key terms
- SUF (Security, Usability and Functionality)
A classroom framework for weighing whether a design provides required protection, can be used effectively by its intended users and performs its required tasks.
- Usability
How effectively, efficiently and satisfactorily intended users can use a system to complete their tasks.
- Functionality
Whether a system provides the capabilities required for its intended tasks.
- Accessibility
Designing systems so that people with different needs, devices and assistive technologies can use them. It is part of usable security, not a reason to remove required protection.
- Multi-factor authentication (MFA)
Authentication that requires two or more different types of factor, such as something you know and something you have.
Common misunderstandings
Extra steps can prompt unsafe workarounds, as the 30-day password rule did. Judge a control by the protection it actually provides, not by how inconvenient it is.
Some choices involve trade-offs, but clear instructions, good defaults and understandable processes can improve both at once.
Accessibility means providing an approved route that works for each authorised user while still meeting the security requirement. In the MFA decision, the alternative given to two members of staff was the strongest method. Sharing an account or skipping the sign-in is never an equivalent alternative.
A text-message code, an authenticator app and a security key all count as MFA, and they resist different attacks. The method matters, and so does what happens when a device is lost.
Further reading
- NCSC technology assurance: product design and functionality.
- NCSC: Password policy, updating your approach, which explains why regular password expiry is no longer advised.
Lesson sources and acknowledgements
Sources and scope
The approved Session 2 Learning Log records the SUF discussion, the need to balance these considerations and the importance of accessibility. Session 1 also recorded balancing protection with legitimate work. The school-application and MFA examples in this lesson develop the supplied Session 2C educational reference. They are supplementary fictional scenarios, not exact tutor examples, completed assessments or workplace implementations. The approved Session 2 log establishes tutor-led scope, while the supplied Session 2C reference provides the supplementary examples.
Everything about the school is invented: its staff, the 30-day password rule and what followed, the exam-arrangements folder, the alert numbers, and the MFA decision with its three methods, price and recovery route. No real school’s data, authentication system, monitoring system or trial is described, nothing was measured, and no system was tested or certified accessible. The door comparison, the comparison of the three MFA methods, the “Go deeper” note, the diagram of the restriction with its two routes and the misunderstandings are supplementary explanations. The statement about scheduled password changes follows the NCSC guidance in Further reading.
Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the opening question about the door, every question asked in the lesson with its feedback and hints, the theatre, council and hospital examples and the summary under “What to remember” are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
Designing systems so that people with different needs, devices and assistive technologies can use them. It is part of usable security, not a reason to remove required protection.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
Whether a system provides the capabilities required for its intended tasks.
Authentication that requires two or more different types of factor, such as something you know and something you have.
Uncertainty and potential harm to an organisation’s objectives, considering what could happen, how likely it is, the consequences and the organisation’s context.
A classroom framework for weighing whether a design provides required protection, can be used effectively by its intended users and performs its required tasks.
How effectively, efficiently and satisfactorily intended users can use a system to complete their tasks.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.