{"id":5128,"date":"2024-08-02T09:32:37","date_gmt":"2024-08-02T09:32:37","guid":{"rendered":"https:\/\/blogs.gov.scot\/digital\/?p=5128"},"modified":"2024-08-02T09:34:23","modified_gmt":"2024-08-02T09:34:23","slug":"scotaccount-usability-by-design-and-default","status":"publish","type":"post","link":"https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/","title":{"rendered":"ScotAccount \u2013 Usability by design and default"},"content":{"rendered":"

Laurie Brown, Digital Information Security Officer, provides strategic information security direction, assurance, and governance across a number of Scottish Government digital public services including the work to introduce ScotAccount. <\/span><\/b><\/p>\n

ScotAccount is the secure and simple way to access public services online. <\/span><\/p>\n

It makes accessing services easier because you can use one account to sign in to a variety of services. You can also verify your identity, if necessary, and choose to save your verified personal information in your ScotAccount, so you can use it again when applying for other public services.\u00a0<\/span>\u00a0<\/span><\/p>\n

Our approach towards security<\/span><\/b>
\nIn my original blog<\/span><\/a>, I introduced you to the three principles I use to embed security in service design. Following on from my second blog \u2018<\/span>Privacy by design and default<\/span><\/a>\u2019 and third blog \u2018<\/span>Security by design and default\u2019<\/span><\/a>, I now share more detail on the final of <\/span>those three principles – \u2018Usability by design and default\u2019.<\/span>\u00a0<\/span><\/p>\n

In my<\/span> previous blog on <\/span>security by design and default<\/span><\/a>, I mentioned that through effective risk management, security governance and assurance, we\u2019re well placed to <\/span>ensure<\/span> there exists a good balance of making ScotAccount secure and efficient, without breaking it or making it unusable. This helps provide stakeholder confidence that the security programme is visibly and verifiably operating to the stated security objectives and meets the principles of an <\/span>ethical digital nation<\/span><\/a>.<\/span>\u00a0<\/span><\/p>\n

I want to focus this final blog on how we keep the needs of our users uppermost, to ensure the service is as accessible and easy to use as possible, thus providing an excellent user experience.<\/span>\u202f<\/span>\u00a0<\/span><\/p>\n

This sounds easier than it is, but to achieve the <\/span>most valuable design<\/span><\/a>, requires a delicate balance at times to ensure the security programme does not hinder the usability of a service.<\/span>\u00a0<\/span><\/p>\n

As an example, under the Web Content Accessibility Guidelines (WCAG), it<\/span> is<\/span> recommend<\/span>ed<\/span> that after a period of 20 hours where there is no user action with an online web page, it is reasonable to timeout that session, logging the user out with possible loss of data. At the other end of the scale, the Open Worldwide Application Security Project (OWASP) <\/span>recommends a timeout<\/span><\/a> of 15-30 minutes, reducing to 2-5 minutes for high-value services. Clearly, there needs to be a balance agreed here to ensure the service is usable, accessible, and digitally inclusive, but which also ensures the service is <\/span>secure and efficient.<\/span>\u00a0<\/span><\/p>\n

In addition to balancing specific technical aspects such as timeouts, more fundamental product features also require careful planning around privacy, security and usability by design and default. It\u2019s not helpful to talk about trade-offs between usability and security, but <\/span>to<\/span> consider <\/span>if <\/span>a product needs to be used in a particular way for it to be secure, therefore at times it is arguable that security depends on usability.\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>\u00a0<\/span><\/p>\n

An example<\/span> of this<\/span> would be authentication, <\/span>where a username and password are commonly used to log into a service such as ScotAccount.<\/span>\u00a0\u00a0<\/span>\u00a0<\/span><\/p>\n

ScotAccount supports the use of <\/span>long and unusual passwords<\/span><\/a>. This helps mitigate the risk of password compromise from attacks such as password spraying. This is where a criminal will use <\/span>a list of commonly used passwords<\/span><\/a> to acquire login credentials or credential stuffing where they will use credentials obtained from other attacks in the likely event someone has used the same password across several online services. <\/span>Incidentally, services such as \u201c<\/span>have I been pwned<\/span><\/a>\u201d<\/span> can help you determine if your email address and password have been stolen in known data breaches from around the world. I would recommend checking your email address against this site and changing passwords and\/or email address if you feature on the list.<\/span>\u00a0<\/span><\/p>\n

However, if passwords are forced to be long, complex and hard-to-guess, people will likely write them down or reuse passwords from other services. Security has therefore affected usability and almost certainly made the user\u2019s account less secure. Whilst I think ScotAccount has found a good balance regarding passwords, perhaps <\/span>not having passwords at all<\/span><\/a> would be even better. This is something ScotAccount will be exploring as part of our continuous improvement of the service.<\/span>\u00a0<\/span><\/p>\n

For now though, there are <\/span>several other methods available to help protect authentication<\/span><\/a>, and ScotAccount currently offers multi-factor authentication, also called <\/span>2-step verification<\/span><\/a> as one example of this.\u00a0\u00a0<\/span>\u00a0<\/span><\/p>\n

Multi-factor authentication is an excellent example of where the <\/span>ScotAccount <\/span>security programme chose not to trade-off usability and security.\u00a0\u00a0<\/span>\u00a0<\/span><\/p>\n

Online statistics<\/span><\/a> suggest that 13% of adults do NOT own a smartphone, increasing to 31% of people over 65 years of age. Therefore, it was felt from a product roadmap perspective that offering multi-factor authentication over text message to mobile phone and over voice message to landline phone would reach a wider audience than an authenticator app on a smartphone despite text message in particular being <\/span>less secure<\/span><\/a>, when ScotAccount first launched<\/span>.\u00a0 As part of continuous improvement, ScotAccount will further extend multi-factor authentication support to include the option of an authenticator app.<\/span>\u00a0<\/span><\/p>\n

Digital inclusion<\/span><\/b>\u00a0<\/span><\/p>\n

Even within this usability by design and default principle, there is always room for improvement. As highlighted by Shahid Khan in his <\/span>blog on digital mindsets<\/span><\/a>, 19% of people in Scotland do not have confident digital skills. There will be other barriers to using ScotAccount including lack of access to technology, lack of confidence and lack of trust. Exciting initiatives like our <\/span>CivTech challenge to explore vouching<\/span><\/a> as a way to strengthening identity verification will definitely help break down some of those barriers.<\/span>\u00a0<\/span><\/p>\n

Tackling those barriers, ensuring we remain clear, open, and honest about how ScotAccount is operating is vital. Continuing to meet the principles of an\u202f<\/span>ethical digital nation<\/span><\/a>, and supporting the work of the Scottish Government <\/span>Digital Citizen Unit<\/span><\/a> to ensure no one is left behind will be <\/span>crucial <\/span>in maintaining the levels of trust and confidence required for us all to <\/span>thrive in a digital world<\/span><\/a>.<\/span>\u00a0<\/span><\/p>\n

Closing remarks<\/span><\/b>\u00a0<\/span><\/p>\n

I hope this series of blogs has offered a little insight into how the principles of privacy, security and usability by design and default are each being approached, and how the integration of these can support the <\/span>most valuable design<\/span><\/a>. Hopefully, they also go some way to demonstrating how ScotAccount is striving to <\/span>meet people\u2019s expectations of how they want to interact with government, securely and in a manner which protects their privacy.<\/span>\u00a0<\/span><\/p>\n

There is a strong <\/span>sociotechnical<\/span><\/a> aspect underpinning these principles. The National Cyber Security Centre is funding the <\/span>Research Institute for Sociotechnical Cyber Security<\/span><\/a> and I follow its research work across the various themes with interest in order to challenge my privacy, security and usability by design and default principles, to help ensure ScotAccount and all the other digital public services I support are benefitting from them.<\/span>\u00a0<\/span><\/p>\n

How to contact the team<\/span><\/b>\u202f<\/span>\u00a0<\/span><\/p>\n

You can subscribe to the \u202f<\/span>Scottish Government Digital Scotland newsletter<\/span><\/a>\u202f for regular updates on ScotAccount and other digital projects.\u202f<\/span>\u00a0<\/span><\/p>\n

If you work for a public service organisation and are interested in finding out more about ScotAccount, or to access our test environment, you can get in touch with the team by emailing:<\/span>\u202fscotaccount@gov.scot<\/span><\/a>\u202f<\/span>\u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Laurie Brown, Digital Information Security Officer, provides strategic information security direction, assurance, and governance across a number of Scottish Government digital public services including the work to introduce ScotAccount. ScotAccount is the secure and simple way to access public services online. It makes accessing services easier because you can use one account to sign in…<\/p>\n","protected":false},"author":317,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[157,6,400],"tags":[91,146,224,387],"class_list":["post-5128","post","type-post","status-publish","format-standard","hentry","category-digital-identity","category-digital-scotland","category-scotaccount","tag-civtech","tag-digital-scotland","tag-ethical-digital-nation","tag-scotaccount"],"yoast_head":"\nScotAccount \u2013 Usability by design and default - Digital<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ScotAccount \u2013 Usability by design and default - Digital\" \/>\n<meta property=\"og:description\" content=\"Laurie Brown, Digital Information Security Officer, provides strategic information security direction, assurance, and governance across a number of Scottish Government digital public services including the work to introduce ScotAccount. ScotAccount is the secure and simple way to access public services online. It makes accessing services easier because you can use one account to sign in...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/\" \/>\n<meta property=\"og:site_name\" content=\"Digital\" \/>\n<meta property=\"article:published_time\" content=\"2024-08-02T09:32:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-08-02T09:34:23+00:00\" \/>\n<meta name=\"author\" content=\"Stewart Hamilton\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Stewart Hamilton\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/\"},\"author\":{\"name\":\"Stewart Hamilton\",\"@id\":\"https:\/\/blogs.gov.scot\/digital\/#\/schema\/person\/fd47935c780321ad6c4ecbb2f10da552\"},\"headline\":\"ScotAccount \u2013 Usability by design and default\",\"datePublished\":\"2024-08-02T09:32:37+00:00\",\"dateModified\":\"2024-08-02T09:34:23+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/\"},\"wordCount\":1174,\"commentCount\":0,\"keywords\":[\"CivTech\",\"Digital Scotland\",\"Ethical Digital Nation\",\"ScotAccount\"],\"articleSection\":[\"Digital Identity\",\"Digital Scotland\",\"ScotAccount\"],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/\",\"url\":\"https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/\",\"name\":\"ScotAccount \u2013 Usability by design and default - Digital\",\"isPartOf\":{\"@id\":\"https:\/\/blogs.gov.scot\/digital\/#website\"},\"datePublished\":\"2024-08-02T09:32:37+00:00\",\"dateModified\":\"2024-08-02T09:34:23+00:00\",\"author\":{\"@id\":\"https:\/\/blogs.gov.scot\/digital\/#\/schema\/person\/fd47935c780321ad6c4ecbb2f10da552\"},\"breadcrumb\":{\"@id\":\"https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blogs.gov.scot\/digital\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"ScotAccount \u2013 Usability by design and default\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blogs.gov.scot\/digital\/#website\",\"url\":\"https:\/\/blogs.gov.scot\/digital\/\",\"name\":\"Digital\",\"description\":\"Updates from the Scottish Government's Digital Directorate\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blogs.gov.scot\/digital\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blogs.gov.scot\/digital\/#\/schema\/person\/fd47935c780321ad6c4ecbb2f10da552\",\"name\":\"Stewart Hamilton\",\"description\":\"Communications and Engagement Officer\",\"url\":\"https:\/\/blogs.gov.scot\/digital\/author\/stewarthamilton\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"ScotAccount \u2013 Usability by design and default - Digital","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/","og_locale":"en_GB","og_type":"article","og_title":"ScotAccount \u2013 Usability by design and default - Digital","og_description":"Laurie Brown, Digital Information Security Officer, provides strategic information security direction, assurance, and governance across a number of Scottish Government digital public services including the work to introduce ScotAccount. ScotAccount is the secure and simple way to access public services online. It makes accessing services easier because you can use one account to sign in...","og_url":"https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/","og_site_name":"Digital","article_published_time":"2024-08-02T09:32:37+00:00","article_modified_time":"2024-08-02T09:34:23+00:00","author":"Stewart Hamilton","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Stewart Hamilton","Estimated reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/#article","isPartOf":{"@id":"https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/"},"author":{"name":"Stewart Hamilton","@id":"https:\/\/blogs.gov.scot\/digital\/#\/schema\/person\/fd47935c780321ad6c4ecbb2f10da552"},"headline":"ScotAccount \u2013 Usability by design and default","datePublished":"2024-08-02T09:32:37+00:00","dateModified":"2024-08-02T09:34:23+00:00","mainEntityOfPage":{"@id":"https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/"},"wordCount":1174,"commentCount":0,"keywords":["CivTech","Digital Scotland","Ethical Digital Nation","ScotAccount"],"articleSection":["Digital Identity","Digital Scotland","ScotAccount"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/","url":"https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/","name":"ScotAccount \u2013 Usability by design and default - Digital","isPartOf":{"@id":"https:\/\/blogs.gov.scot\/digital\/#website"},"datePublished":"2024-08-02T09:32:37+00:00","dateModified":"2024-08-02T09:34:23+00:00","author":{"@id":"https:\/\/blogs.gov.scot\/digital\/#\/schema\/person\/fd47935c780321ad6c4ecbb2f10da552"},"breadcrumb":{"@id":"https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/blogs.gov.scot\/digital\/2024\/08\/02\/scotaccount-usability-by-design-and-default\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blogs.gov.scot\/digital\/"},{"@type":"ListItem","position":2,"name":"ScotAccount \u2013 Usability by design and default"}]},{"@type":"WebSite","@id":"https:\/\/blogs.gov.scot\/digital\/#website","url":"https:\/\/blogs.gov.scot\/digital\/","name":"Digital","description":"Updates from the Scottish Government's Digital Directorate","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blogs.gov.scot\/digital\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Person","@id":"https:\/\/blogs.gov.scot\/digital\/#\/schema\/person\/fd47935c780321ad6c4ecbb2f10da552","name":"Stewart Hamilton","description":"Communications and Engagement Officer","url":"https:\/\/blogs.gov.scot\/digital\/author\/stewarthamilton\/"}]}},"_links":{"self":[{"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/posts\/5128","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/users\/317"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/comments?post=5128"}],"version-history":[{"count":0,"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/posts\/5128\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/media?parent=5128"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/categories?post=5128"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/tags?post=5128"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}