Hostname: page-component-745bb68f8f-l4dxg Total loading time: 0 Render date: 2025-02-05T03:03:57.075Z Has data issue: false hasContentIssue false
  • English
  • Français

From Innocent Irene to Parental Patrick: Framing User Characteristics and Personas to Design for Cybersecurity

Part of: Human Behaviour in Design and Design Cognition

Published online by Cambridge University Press:  26 July 2019

Euiyoung Kim ,
JungKyoon Yoon ,
Jieun Kwon ,
Tiffany Liaw  and
Alice M. Agogino
Euiyoung Kim*
Affiliation:
Jacobs Institute for Design Innovation, University of California at Berkeley;
JungKyoon Yoon
Affiliation:
Department of Design and Environmental Analysis, Cornell University;
Jieun Kwon
Affiliation:
Human Factor and Ergonomics, University of Minnesota;
Tiffany Liaw
Affiliation:
Bioengineering, University of California at Berkeley;
Alice M. Agogino
Affiliation:
Mechanical Engineering, University of California at Berkeley
*
Contact: Kim, Euiyoung, University of California, Berkeley / Delft University of Technology, Mechanical Engineering / Industrial Design Engineering, United States of America, euiyoungkim@berkeley.edu

Abstract

Core share and HTML view are not available for this content. However, as you have access to this content, a full PDF is available via the ‘Save PDF’ action button.

With the surging number of digital devices penetrating our daily routines, the risks inherent to cybersecurity—the protection of data on digital products connected to the Internet—have also increased since these devices (e.g., connected home devices, personal monitoring) collect, process, analyze and store users’ sensitive personal information. Thus, there is a pressing need to assist users in being aware of and dealing with potential cybersecurity threats. With the proposition that fulfilling the need starts with developing an in-depth understanding of the user behaviors in the context of cybersecurity, an exploratory study was conducted that employed three mixed qualitative and quantitative research methods—a trend analysis, an interview study, and an online survey study. The paper reports the user characteristics on (1) awareness levels of cybersecurity issues, (2) uses of digital devices, and (3) means of dealing with the privacy issues in product use. The results of the studies were translated into eight personas that systematically reflect distinct characteristics of users, which can help designers empathize with their potential users vulnerable to cybersecurity risks.

Keywords

Human behaviour in designUser centred designEthicsEarly design phases
Type
Article
Information
Proceedings of the Design Society: International Conference on Engineering Design , Volume 1 , Issue 1 , July 2019 , pp. 1773 - 1782
Creative Commons
Creative Common License - CCCreative Common License - BYCreative Common License - NCCreative Common License - ND
This is an Open Access article, distributed under the terms of the Creative Commons Attribution-NonCommercial-NoDerivatives licence (http://creativecommons.org/licenses/by-nc-nd/4.0/), which permits non-commercial re-use, distribution, and reproduction in any medium, provided the original work is unaltered and is properly cited. The written permission of Cambridge University Press must be obtained for commercial re-use or in order to create a derivative work.
Copyright
© The Author(s) 2019

References

Abawajy, J. (2014), “User preference of cyber security awareness delivery methods”, Behaviour & Information Technology, Vol. 33 No. 3, pp. 237–248. https://doi.org/10.1080/0144929x.2012.708787.Google Scholar
Adlin, T. and Pruitt, J. (2010), “The essential persona lifecycle: Your guide to building and using personas”, Morgan Kaufmann.Google Scholar
Armerding, T. (2018), The 17 biggest data breaches of the 21st century. [online] Available at: https://www.csoonline.com/article/2130877/data-breach/the-biggest-data-breaches-of-the-21st-century.html (accessed date November 25, 2018)Google Scholar
Atzori, L., Iera, A. and Morabito, G. (2010), The internet of things: A survey. Computer networks, Vol. 54 No. 15, pp. 2787–2805.Google Scholar
Bada, M. and Sasse, A. (2014), “Cyber security awareness campaigns: Why do they fail to change behaviour?”, Global Cyber Security Capacity Centre.Google Scholar
Bernd, J., Gordo, B., Choi, J., Morgan, B., Henderson, N., Egelman, S., Garcia, D.D. and Friedland, G. (2015), “Teaching privacy: Multimedia making a difference”, IEEE MultiMedia, No. 1, pp. 12–19.10.1109/MMUL.2015.16Google Scholar
Blomquist, Å. and Arvola, M. (2002), “Personas in action: ethnography in an interaction design team”, In Proceedings of the second Nordic conference on Human-computer interaction, ACM, pp. 197–200.10.1145/572020.572044Google Scholar
Bruijn, H. and Janssen, M. (2017), “Building cybersecurity awareness: The need for evidence-based framing strategies”, Government Information Quarterly, Vol. 34, pp. 1–7. https://doi.org/10.1016/j.giq.2017.02.007.Google Scholar
Chang, Y. N., Lim, Y. K. and Stolterman, E. (2008), “Personas: from theory to practices”, In Proceedings of the 5th Nordic conference on Human-computer interaction: building bridges, ACM, pp. 439–442.10.1145/1463160.1463214Google Scholar
Cooper, A. (1999), “The Inmates are Running the Asylum”, In: Arend, U., Eberleh, E., Pitschke, K. (eds) Software-Ergonomie ’99. Berichte des German Chapter of the ACM, Vol. 53. Vieweg+Teubner Verlag, Wiesbaden. https://doi.org/10.1007/978-3-322-99786-9_1Google Scholar
Faily, S. and Flechais, I. (2011), “Persona cases: a technique for grounding personas”, In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, pp. 2267–2270. ACM. https://doi.org/10.1145/1978942.1979274Google Scholar
Friess, E. (2012), “Personas and decision making in the design process: an ethnographic case study”, In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, pp. 1209–1218.10.1145/2207676.2208572Google Scholar
Gubbi, J., Buyya, R., Marusic, S. and Palaniswami, M. (2013), “Internet of Things (IoT): A vision, architectural elements, and future directions”, Future generation computer systems, Vol. 29 No. 7, pp. 1645–1660. https://doi.org/10.1016/j.future.2013.01.010.Google Scholar
Harknett, R.J. and Stever, J.A. (2011), “The new policy world of cybersecurity”, Public Administration Review, Vol. 71 No. 3, pp. 455–460.10.1111/j.1540-6210.2011.02366.xGoogle Scholar
Johnston, J., Rodney, A. and Chong, P. (2014), “Making change in the kitchen? A study of celebrity cookbooks, culinary personas, and inequality”, Poetics, Vol. 47, pp. 1–22.10.1016/j.poetic.2014.10.001Google Scholar
Kim, E., Jensen, M.B., Poreh, D. and Agogino, A.M. (2018), “Novice designer's lack of awareness to cybersecurity and data vulnerability in new concept development of mobile sensing devices”, In DS92: Proceedings of the DESIGN 2018 15th International Design Conference, Dubrovnik, Croatia, pp. 2035–2044. https://doi.org/10.21278/idc.2018.0461Google Scholar
Kim, E., Kocsik, V.S., Basnage, C.E. and Agogino, A.M. (2013), “Human-centric study of digital-paper transitions: framing design opportunity spaces”, International Conference on Engineering Design (ICED13), The Design Society, Seoul, Korea, 19-22.08. 2013.Google Scholar
Marble, J., Lawless, W., Mittu, R., Coyne, J., Abramson, M. and Sibley, C. (2014), “The Human Factor in Cybersecurity: Robust & Intelligent Defense”, Cyber Warfare, Vol. 56, pp. 173–206. https://doi.org/10.1007/978-3-319-14039-1_9.Google Scholar
Massanari, A. (2010), “Designing for imaginary friends: information architecture, personas, and the politics of user-centered design”, New Media & Society, Vol. 12 No. 3, pp. 401–416. https://doi.org/10.1057/palgrave.ivs.9500066.Google Scholar
Miaskiewicz, T. and Kozar, K.A. (2011), “Personas and user-centered design: How can personas benefit product design processes?”, Design Studies, Vol. 32 No. 5, pp. 417–430. https://doi.org/10.1016/j.destud.2011.03.003.Google Scholar
McCormac, A., Zwaans, T., Parsons, K., Calic, D., Butavicius, M. and Pattinson, M. (2017), “Individual differences and information security awareness”, Computers in Human Behavior, Vol. 69, pp. 151–156.10.1016/j.chb.2016.11.065Google Scholar
McGinn, J.J. and Kotamraju, N. (2008), “Data-driven persona development”, Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, pp. 1521–1524. ACM. https://doi.org/10.1145/1357054.1357292Google Scholar
McKenna, S., Staheli, D. and Meyer, M. (2015), “Unlocking user-centered design methods for building cyber security visualizations”, Visualization for Cyber Security (VizSec), 2015 IEEE Symposium on, pp. 1–8. IEEE. https://doi.org/10.1109/vizsec.2015.7312771.Google Scholar
National Institute of Standard and Technology, NICE https://www.nist.gov/itl/applied-cybersecurity/nice/about/strategic-planGoogle Scholar
Newhouse, W., Keith, S., Scribner, B. and Witte, G. (2017), “National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework”, NIST Special Publication, Vol. 800, p. 181.Google Scholar
Newman, L. H. (2018), The Worst Cybersecurity Breaches of 2018 So Far. [online] Available at: https://www.wired.com/story/2018-worst-hacks-so-far/ (accessed date November 25, 2018)Google Scholar
Pillemer, K.A. (2012), “30 lessons for living: tried and true advice from the wisest Americans”, Penguin.Google Scholar
Piyare, R. (2013), “Internet of Things: Ubiquitous home control and monitoring system using Android based smart phone”, International Journal of Internet of Things, Vol. 2 No. 1, pp. 5–11.Google Scholar
Pruitt, J. and Adlin, T. (2010), “The persona lifecycle: keeping people in mind throughout product design”, Elsevier.Google Scholar
Rosner, G. and Kenneally, E. (2018), Privacy and the Internet of Things: Emerging frameworks for policy and design, The Center for Long-term Cybersecurity (CLTC), Berkeley, CA, https://cltc.berkeley.edu/wp-content/uploads/2018/06/CLTC_Privacy_of_the_IoT-1.pdf.Google Scholar
Rosner, G. and Kenneally, E. (2017), Privacy and the Internet of Things, Center for Long-Term Cybersecurity, Berkeley, CA.Google Scholar
Siddall, E., Baibarac, C., Byrne, A., Byrne, N., Deasy, A., Flood, N., … and Wang, , Y. (2011), “Personas as a user-centred design tool for the built environment”, Proceedings of the Institution of Civil Engineers-Engineering Sustainability, Vol. 164 No. 1, March 2011, pp. 59–69, https://doi.org/10.1680/ensu.1000015Google Scholar
Singer, P.W. and Friedman, A. (2014), Cybersecurity: What everyone needs to know, Oxford University Press. https://doi.org/10.5860/choice.188472Google Scholar
Stoll, J., McColgin, D., Gregory, M., Crow, V. and Edwards, W.K. (2008), “Adapting personas for use in security visualization design. In VizSEC 2007 (pp. 39-52). Springer, Berlin, Heidelberg.Google Scholar
Ten, C.W., Liu, C.C. and Manimaran, G. (2008), “Vulnerability Assessment of Cybersecurity for SCADA Systems”, IEEE Transactions on Power Systems, Vol. 23 No. 4, pp. 1836–1846. https://doi.org/10.1109/tpwrs.2008.2002298.Google Scholar
Ten, C.W., Manimaran, G. and Liu, C.C. (2010), “Cybersecurity for critical infrastructures: Attack and defense modeling”, IEEE Transactions on Systems, Man, and Cybernetics-Part A: Systems and Humans, Vol. 40 No. 4, pp. 853–865. https://doi.org/10.1109/tsmca.2010.2048028.Google Scholar