M. Angela Sasse

Background and education

Martina Angela Sasse is a German psychologist and computer scientist working at the intersection of human-computer interaction and information security. She took her undergraduate degree in psychology at the University of Wuppertal, followed by a master's degree in occupational psychology at the University of Sheffield and a doctorate at the University of Birmingham. This training in applied and occupational psychology, rather than in cryptography or systems engineering, shaped the empirical, workplace-oriented approach that characterises her later security research.

In 1990 she joined University College London as a lecturer. She was appointed Professor of Human-Centred Technology at UCL in 2003, and continues to hold that chair on a part-time basis.

Usable security and the password problem

Sasse's best-known contribution grew out of empirical studies of how people actually cope with organisational password policies. With Anne Adams and Peter Lunt she published "Making Passwords Secure and Usable" at the British Computer Society's HCI conference in 1997. The line of work culminated in "Users Are Not The Enemy", written with Anne Adams and published in Communications of the ACM in December 1999 (volume 42, issue 12, pages 40 to 46).

The paper's central claim was that security failures widely blamed on careless users were better explained as failures of design and policy. Password rules that demanded frequently changed, hard-to-remember strings, applied across many systems and without explanation of their purpose, exceeded what users could reasonably manage. Users therefore wrote passwords down, reused them, or chose predictable variations. Adams and Sasse argued that treating users as an adversary to be constrained was self-defeating, and that security mechanisms should be designed around realistic models of human memory, workload, and motivation.

The paper is among the most cited works in the usable security literature and, together with contemporaneous work such as Alma Whitten and J. D. Tygar's study of encryption software usability, is generally treated as marking the emergence of usable security as a research field in its own right.

Security behaviour in organisations

Sasse subsequently extended the argument from individual mechanisms to organisational security as a whole. With Adam Beautement and Mike Wonham she introduced the notion of a "compliance budget" in a paper presented at the New Security Paradigms Workshop in 2008. The model holds that employees have a finite tolerance for the effort and disruption that security controls impose; once that budget is exhausted, further controls produce non-compliance rather than additional protection. The framing gave security managers a way to reason about the cumulative cost of controls rather than assessing each in isolation.

This body of work positioned security as a sociotechnical problem, in which technology, people, and organisational processes have to be analysed together rather than as separate concerns.

RISCS and institution building

In 2012 Sasse founded the Research Institute in Science of Cyber Security, later renamed the Research Institute for Sociotechnical Cyber Security and known as RISCS. Funded by the UK's National Cyber Security Centre, it was the first academic research institute in the United Kingdom focused on the overall security of organisations including their constituent technology, people, and processes. Sasse served as its founding director; Madeline Carr directed the institute from 2018 to 2022, followed by Tristan Caulfield and then, from January 2023, Genevieve Liveley at the University of Bristol.

Later career and recognition

In 2018 Sasse moved to Ruhr University Bochum as Horst Görtz Endowed Professor of Human-Centred Security, while retaining a part-time professorship at UCL. Bochum is one of the principal European centres for IT security research, and the appointment placed human-centred security alongside its established cryptography and systems security groups.

She was elected a Fellow of the Royal Academy of Engineering in 2015, with a citation recognising her "for demonstrating the impact of human security behaviour, and developing a socio-technical approach for modelling and managing that behaviour effectively". In 2023 she was elected to the German National Academy of Sciences Leopoldina.

Legacy

The argument Sasse advanced in the late 1990s, that security which ignores human limits will be circumvented, moved over two decades from a contrarian position to a mainstream one. Password guidance issued by national security agencies and standards bodies in the 2010s and 2020s moved away from mandatory periodic expiry and complex composition rules toward approaches that reduce user burden, reflecting the empirical case that her research helped establish. Her work also contributed to the growth of usable security as a recognised research community with dedicated venues and to the wider adoption of sociotechnical framing in cyber security policy.

Timeline

• 1990Joins University College London as a lecturer.
• 1997Publishes "Making Passwords Secure and Usable" with Anne Adams and Peter Lunt at the BCS HCI conference.
• 1999-12Publishes "Users Are Not The Enemy" with Anne Adams in Communications of the ACM, volume 42, issue 12, pages 40-46.
• 2003Appointed Professor of Human-Centred Technology at University College London.
• 2008Introduces the compliance budget model with Adam Beautement and Mike Wonham at the New Security Paradigms Workshop.
• 2012Founds the Research Institute in Science of Cyber Security (RISCS), the UK's first academic institute focused on sociotechnical cyber security.
• 2015Elected a Fellow of the Royal Academy of Engineering.
• 2018Moves to Ruhr University Bochum as Horst Görtz Endowed Professor of Human-Centred Security.
• 2023Elected to the German National Academy of Sciences Leopoldina.