Human-centric security design: U3 concept

The U3 (user, usage, and usability) concept is an academic, research-based approach to security design.

Human-centric cyber security is an intangible concept that is difficult to define because of the inherent connection between humans, technology, and security systems. It also focuses on studies that specifically illustrate the shift in paradigm from functional and usage-centred cyber security to user-centred cyber security by considering the human/psychological aspects of users.

Grobler, Gaire and Nepal (2021) propose redefining human-centric cyber security based on their research of studies that illustrate the shift to user-centred cyber security. They propose the concept of 3 U’s (user, usage, and usability) as three essential components for cyber security consideration. These components are not exhaustive representations of human-centric cyber security but are regarded as particularly important since they represent the multi-dimensionality of the cyber security context.

	Users: User components consider humans interacting with the cyber systems for legitimate purposes. Examples: Demography & Culture, Situational Awareness, Psychology & Behaviour, Cognitive Factors
	Usage: Usage components are mainly concerned with the functional aspects of technological and non-technological measures that are put in place to protect users against known security threats. Examples: Functional Measures, Technical Measures, Legislation, Regulation & Policies
	Usability: Usability components consider how well the actual user can use the system. Examples: Experience factors, Interaction factors

The U3-based conceptual model takes the application-centric principles discussed earlier to a whole new level by getting security designers to consider a user-centric approach to strengthen security by design further and to make it more realistic and meaningful.

Grobler, Gaire and Nepal (2021) consider this approach to be a paradigm shift from the traditional view of human-centric cyber security, helping to overcome the barriers between user, usage, and usability to better meet security needs. The diagram below further illustrates how the concept can be applied to achieve this objective.

Traditional view of human-centric cyber security – one-size-fits-all systems

Paradigm shift in human-centric cyber security – customisable and tailored systems

(Source: Grobler, Gaire and Nepal, 2021)

The following outcomes can be achieved through the application of the U3 concept:

• The real-time nature of cyber threats requires that humans not become bottlenecks. Therefore, security departments need to communicate more with users to fully adopt a user-centred security design approach.
• Cyber security awareness should not be targeted at general end-users (in the traditional sense, referring to the system end-user or general end-user) alone. Instead, it should be regarded as a multi-way communication among general end-users, security experts and system developers.
• The cyber system (through the system designer) needs to be aware of user factors to accommodate user needs in delivering usable cyber security systems, i.e. the system developer needs to ask themselves: Have I considered all types of users who may interact with this system?
• It is important to understand specific user traits that would help identify user-related vulnerabilities. Such multi-way communication is the only way to achieve system-centric or user-centric and proper human-centric cyber security design.

Read

Read the following article for detailed information on U3 human-centric cyber security:

• Grobler M, Gaire R & Nepal S 2021, User, Usage and Usability: Redefining Human Centric Cyber Security, Frontiers in Big Data, Vol. 4, DOI: 10.3389/fdata.2021.583723.