Security, privacy and usability are vital quality attributes of IT systems and services. Users and legal authorities demand that systems are secure and preserve privacy. At the same time, security and privacy mechanisms should not complicate workflows and must be transparent for the user. In order to master this challenge, a close involvement of the users is necessary - both at development and at run-time. In this paper, we present a user-centered model for usable security and privacy that is aligned with user-centered design guidelines [34] and the Human-Centered Design process [28]. Based on this model, we present an initial method for the design of usable security systems. Through active involvement of the user, the model and the method are meant to help developers to identify and solve shortcomings of their security and privacy mechanisms. We motivate our work and present our results based on an Internet of Things/smart home scenario. Due to the amount of private data and strong data protection laws, both usability and privacy are of major importance in this domain. However, our model and method are not limited to the smart home domain, but can be applied whenever usable security and privacy are of particular interest for a system under development

No abstract

The digital transformation supports many cities on the way to becoming smarter cities, enabling them to enhance digital processes, care about climate-friendly goals, or improve the quality of life of their citizens. However, such changes usually take place step by step and not in a big-bang approach. In order for the direction of the digital transformation to be defined, it is necessary to know and understand the needs and requirements of all relevant stakeholders who will be affected or are intended to use the new digital solutions. As our environment, a smart city district, is currently under construction, we do not know most of the future stakeholders yet. Therefore, we had to find new ways of eliciting the needs and requirements for digital solutions without knowing, e.g., the citizens who will live in the future district. We show a framework of the procedures we followed, classified into (a) vision and concepts, (b) smart city district digital ecosystem, and (c) dissemination and events. We substantiate the processes with example results and provide a discussion on how we evaluate our solutions with respect to future applicability. Because evaluations are only very limited in our setting right now, we focus on four lead questions to argue why the procedures and results are adequate and share the lessons we learned on this path towards a digital smart city district.

No abstract

Security mechanisms are nowadays part of almost every software. At the same time, they are typically sociotechnical and require involvement of end users to be effective. The usability of security measures is thus an essential factor. Despite this importance, this aspect often does not receive the necessary attention, for example due to short resources like time, budget, or usability experts. In the worst-case, users reject or circumvent even strong security measures and technically secure systems become insecure. To tackle the problem of unusable security measures, we developed a heuristics-based usability evaluation and optimization approach for security measures. In order to make heuristics applicable also for non-usability experts, we enrich them with information from a joint model for usability and security. In particular, this approach allows developers and administrators to perform usability evaluations and thus enables an early tailoring to the user, complementary to expert or user reviews. In this paper, we present our approach, including an initial set of heuristics, a joint model for usability and security and a set of mapping rules that combine heuristics and model. We evaluated the applicability of our approach, which we present in this paper. CCS CONCEPTS • Security and Privacy → Usability in security and privacy; • Human-centered computing → HCI theory, concepts and models; Heuristic evaluations.