Towards a virtual bank for evaluating security aspects with focus on user behavior

Security and usability improvements in online banking are often made in academic proposals. Testing of these proposals could provide vital information for designing new systems and for proposing further improvements. A modular evaluation framework, presented as a virtual bank, could provide a common ground for testing and reduces the overhead of setting up experiments. We propose such a framework for testing secure usability in online banking, since it does not exist to our knowledge. To validate that the envisioned framework would provide useful information, we created a first proof of concept to measure secure usability user behavior with two different authentication methods in an experiment. The results confirm that online bank users pay more attention to security actions after they noticed an attack. We were also able to conclude that of two tested authentication methods, one is significantly faster in use compared to the other. These results validate that the envisioned framework will be able to provide useful information. What we learned from the proof of concept will be used in the development of a modular evaluation framework, which we will release in the near future as open source for others to experiment with.