# On using the Task Models for Validation and Evolution of Usable Security Design Patterns

Célia Martinie, Bilal Naqvi

► To cite this version:

Célia Martinie, Bilal Naqvi. On using the Task Models for Validation and Evolution of Usable Security Design Patterns. 17th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2023, Kent, United Kingdom. pp.405-417, 10.1007/978-3-031-38530-8_32 hal-04305909

HAL Id: hal-04305909

https://ut3-toulouseinp.hal.science/hal-04305909v1

Submitted on 16 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# On using the Task Models for Validation and Evolution of Usable Security Design Patterns

Célia Martinie<fnref n="1" /> ID and Bilal Naqvi<fnref n="2" />(✉) ID

**Abstract.** Security and usability are two interrelated characteristics. Management of the instances where security and usability are in conflict is often a tough task, which is reliant on the skills of the developers and designers. The paper attempts to support the developers and designers in the management of the conflicts by proposing a task model-based approach that enables them to make informed choices concerning the management of the conflicts in the products they develop, thereby enabling them (1) to validate the efficacy of the design patterns before applying them, and (2) to identify limitations in the existing design patterns and propose its evolution. The paper also presents the findings from a case study where an existing usable security pattern was subjected to the proposed task model-based approach.

**Keywords:** patterns · security · task models · usability · usable security

## 1 Introduction

Security and usability are two highly interrelated characteristics of interactive systems that are in conflict often [13]. For instance, enforcement of complex password regimes on the users features a conflict between authentication (a security characteristic) and memorability (which impacts usability). However, security and usability can also have a supportive relationship, for instance in the case of authentication, most login screens today come with a 'toggle password visibility' button that disables the password masking thereby providing feedback (a usability element) to the user during authentication (a security mechanism). The feedback thus helps the user in checking the password they have entered and correct just the mistake rather than re-typing the entire password.

Having discussed the complexity of this relationship between security and usability, management of instances where security and usability are in conflict is one big challenge confronted by the industry and academic research community [14, 16]. Management of the conflicts often includes identification of the conflicts, modeling mutual interdependencies, and identifying suitable trade-offs [14]. One aspect that complicates the management of conflicts is that security and usability have evolved independently

<footnote n="1">¹ ICS-IRIT, Université Toulouse III Paul Sabatier, Toulouse, France</footnote>

<footnote n="2">² Software Engineering, LENS, LUT University, 53850 Lappeenranta, Finland
syed.naqvi@lut.fi</footnote>
as two separate domains, therefore, expertise in both domains is hard to find in one person. Moreover, in the industry, security and usability are handled by different teams having a specific focus, and when it comes to the management of conflicts, the current practices identify that it is based on the skill of developers [14]. To deal with this challenge, several solutions including the use of design patterns have been proposed [15]. Design patterns provide benefits like means of common vocabulary, shared documentation, and improved communication among the team members and are often helpful in multi-disciplinary domains like usable security. The design patterns provide a generic “core” solution, their use can vary from one implementation to another. A usable security pattern encapsulates information such as name, classification, prologue, problem statement, the context of use, solution, and discussion on the right use of the pattern [15].

Having presented the role of design patterns in supporting the developers during the management of security and usability conflicts, it is critical that the right design patterns are applied in the right contexts. If the design patterns are not applied in the right context, their application may turn out to be ineffective and counterproductive in solving the problem just like an anti-pattern. Furthermore, the design patterns evolve with time, therefore it is worthwhile checking if the design patterns provide an up-to-date solution or need to evolve. Considering these aspects, we formulated the research question considered in this paper which is *how to ensure that the right and up-to-date design patterns are applied in the right contexts?* The paper proposes a task model-based approach (i.e., a stepwise method that includes the use of task models) to support the systems developers and designers allowing them to: (1) validate the efficacy of the design patterns before applying them, and (2) identify limitations in the solutions proposed by the patterns and prepare a proposal for the evolution of the existing patterns in line with the pattern’s ability. To instantiate this approach, a case study is presented where an existing usable security pattern was subjected to the proposed approach for refinement.

The remainder of the paper is organized as follows. Section 2 presents the background. Section 3 presents the proposed task model-based approach for validation and evolution of usable security design patterns. Section 4 presents the instantiation case study. Section 5 presents the related work, and Sect. 6 concludes the paper.

# 2 Background

## 2.1 Task Models in User-centred Design

User-centred Design (UCD) approaches [6] aim to produce usable interactive systems and promote the inclusion of real users in various design phases from early needs identification and design until evaluation and deployment. UCD is based on the following principles. The focus has to be set (early) on the user ([4, 5]) and the characteristics, tasks, and context drive the design. An iterative design process is applied [4, 5, 9]. The design process alternates the production of multiple design solutions as well as their evaluation in order to accommodate requirements changes and integrate new parts of the system. Ensuring that an interactive system allows users to perform their tasks and reach their goals is the main target of UCD and is essential for the overall usability of the interactive system. The effectiveness factor of usability [6] directly refers to this capability.
The interactive application shall implement all needed functionalities and these func-
tionalities shall be accessible when needed. Ensuring the effectiveness of an interactive
application thus requires an explicit description of users' goals and tasks. Task analy-
sis is a cornerstone of UCD approaches [3], aiming to collect information from users
about the work they are doing and the way they perform it. In case of users performing
real-life work, task analysis can be a cumbersome process gathering a huge amount of
unorganized information stored in different formats [8] such as paper documentation,
text, and video, transcripts from scenarios. The means for representing the outcomes
of task analysis have important implications for the value and insight gained from the
process, not least because any omissions cannot be discussed (among the stakeholders)
or taken into consideration in later design phases.

Task models are an accurate mean to represent the outcomes of task analysis and they consist of a graphical representation of the work the users perform with an interactive application or system. Task models consist of an abstract description of user activities structured in terms of goals, sub-goals, and actions [12]. Task models enable ensuring the effectiveness of an interactive system, i.e., to guarantee that users can perform their work and can reach their goals. Complete and unambiguous description of the users' tasks is a cornerstone of user-centred design approaches as they provide a unique way of describing precisely and entirely users' actions that have to be performed for them to reach their goals. Many instances of task analysis and modelling techniques exist to provide support for the design, development, and evaluation of interactive systems and of user performance while interacting with a system [12].

## 2.2 Task Model-based Analysis of Usability

Task identification and description are part of the UCD process. Standard ISO 9241-210 on "Human-centred design for interactive systems" [6] indicates that the specification of the context of use requires to identify user goals, user tasks, and sub-tasks, but also that the production of design solutions requires to allocate tasks and sub-tasks to the user and to the system. Moreover, it indicates that the evaluation of the design requires verifying the accuracy and completeness with which the user achieved their tasks. This is why almost all UCD techniques require identifying and describing user tasks. Thus, task models have been proven useful to make a predictive assessment of user performance when interacting with the system [7], and in particular for assessing task complexity and workload (motor, cognitive, perceptive) [18]. Task models have also been proven to increase the coverage of usability issues when performing the heuristic evaluation of the usability of interactive applications [2].

## 2.3 HAMSTERS Tool Supported Task Modelling Notation

We selected the HAMSTERS notation [12] because it is the most expressive task mod-
elling notation. It is tool-supported and embeds the common ground elements required
to model user tasks. It enables the modelling of refined user task types, as well as data,
devices, and objects required to perform the tasks. Moreover, it supports the customiza-
tion of task types and data types to refine task descriptions according to the domain
applications and evolving technologies [12]. Its expressive power goes beyond the con- cur task trees (CTT) notation as presented in [12], and the models produced enable a more precise task analysis [12].

The HAMSTERS notation enables the representation of tasks in a hierarchical tem- porally ordered way. A task model looks like a tree diagram with nodes being either a task or a temporal ordering operator. User has specific goals when interacting with the system. Analysing user tasks requires identifying the user’s main goal. The element of the notation “Main goal” (depicted in Fig. 1) describes the main goal of the user.

<figure><img src="image_3.png" /><figcaption>Fig. 1. Element of HAMSTERS notation for a main goal</figcaption></figure>

A task may be an abstract task (to represent the fact that the user may have to reach several intermediate sub-goals to be able to reach the main goal), a user task, an interactive task, or a system task (depicted in Fig. 2). Refined types of user tasks include motor, perceptive, and cognitive (depicted in “User” row in Fig. 2). Cognitive tasks can also be refined into cognitive analysis tasks and/or cognitive decision tasks.

<table><caption>Fig. 2. Elements of HAMSTERS notation grouped per family of task types</caption><thead><tr><th>Family of task type</th><th colspan="4">Task types</th></tr></thead><tbody><tr><td>Abstract</td><td>abstract task<br>user task</td><td>abstract task<br>interactive task</td><td>abstract task<br>system task</td><td></td></tr><tr><td>User</td><td>user task<br>perceptive task</td><td>user task<br>cognitive task</td><td>user task<br>motor task</td><td></td></tr><tr><td>Interactive</td><td>Interactive task<br>input task</td><td>Interactive task<br>output task</td><td>Interactive task<br>input/output task</td><td></td></tr><tr><td>System</td><td>system task</td><td>system input task</td><td>system output task</td><td></td></tr></tbody></table>

Temporal ordering operators describe temporal relationships between tasks. Table 1 presents these operators.

HAMSTERS also enables a description of data (e.g., information, knowledge, and objects), devices (e.g., input device, output device), and systems required to perform the tasks. Information, knowledge, and objects (which can be physical objects or software
<table><caption>**Table 1.** Types of operators in HAMSTERS task models</caption><thead><tr><th>Operator type</th><th>Symbol</th><th>Operator type</th><th>Symbol</th></tr></thead><tbody><tr><td>Enable (sequence)</td><td>&gt;&gt;</td><td>Disable (deactivation)</td><td>[&gt;</td></tr><tr><td>Concurrent</td><td>||||</td><td>Suspend-resume</td><td>|&gt;</td></tr><tr><td>Choice</td><td>[]</td><td>Order Independent</td><td>|=|</td></tr></tbody></table>

objects) are depicted using labels preceded by the abbreviation of the type of data. A specific value for data can be a pre-condition to the execution of a task. Section 4 presents task models built with the HAMSTERS notation, along with their textual description to facilitate the reader's understanding. The interested reader can find further information about the benefits of using task models, as well as instructions on how to read and generate task models in the Handbook of Human-Computer Interaction [11].

## 3 Task Model-Based Approach for the Validation and Evolution of Usable Security Patterns

Applying the right design patterns in the right contexts is a critical task in the management of security and usability conflicts. Therefore, to facilitate the designers and developers in validating the design patterns before use, we proposed a task model-based approach for modelling the user tasks in line with the solution proposed by the design pattern. Based on the analysis of the task models thus generated, if a design pattern needs to be evolved, a proposal for modification is prepared for updating the design pattern accordingly.

The approach is presented in Fig. 3. And has four steps:

- The *first step* involves generating the task model of the user tasks while interacting with the security mechanism according to the user requirements. This step would identify the usability issues arising with the security mechanism as it stands based on the requirement specifications. It is important to note that the first step involves modelling the users' tasks before applying the design pattern.

- The *second step* involves modelling user tasks with a usable security pattern that matches the security requirements. Once the user tasks from requirement specification are known, the relevant design pattern is applied to generate new task models and to analyse how effectively it enables the usability of the security mechanisms. This step will produce task models of the user tasks after applying the usable security design pattern.

- The *third step* involves analysing the predicted effectiveness and efficiency criteria of usability from the task models. For the analysis purpose, the outcomes from both the first and second steps is compared to evaluate the effectiveness of the design patterns in the context under consideration. From this analysis, if the usable security design pattern is up to date, it is implemented in the product being developed, otherwise, it is subjected to evolution.

- The *fourth step* involves the evolution of usable security design patterns which would require modification based on the outcomes of the third step. The developers and
designers involved in generating the task models formulate a list of modifications for the usable security design patterns requiring updates. The updates are then verified by the usable security patterns library manager and the pattern is refined. Finally, the refined version of the design pattern is added to the catalogue.

<figure><img src="image_4.png" /><figcaption>**Fig. 3.** Four-step task model-based approach for the validation and evolution of usable security design patterns</figcaption></figure>

The approach would allow assist the system designers and developers in the management of the conflicts allowing them to make reasonably accurate choices when it comes to using certain design patterns and specifically enabling them to:

1. *validate* the efficacy of the design patterns before applying them.

2. *identify* limitations in the solution proposed in the (existing version of) usable security design patterns and prepare a proposal for *evolution*.

# 4 Illustrative case study of the Approach: The Adaptable Authentication Design Pattern

Authentication, especially for using personal devices such as smartphones, is a task that many people perform several times a day, for all days in a year. The impact of the authentication mechanism is thus very important on the user time consumed for the authentication user task. The outcome of the application of the proposed approach includes several task models.

## 4.1 Model user tasks with the Authentication Mechanism

An extract of the task model describing user authentication is presented in Fig. 4. The main user goal is to authenticate (top-level task labelled “Authenticate”). The tasks below the main goal are performed using a smartphone (system element labelled “Sys: Smartphone” connected to the main goal in Fig. 4). The main goal decomposes in a choice (temporal ordering operator “[]”) between several sub-goals. These choices are: to authenticate with fingerprint (abstract task labelled “Authenticate with fingerprint”), to
authenticate with password (abstract task "Authenticate with password"), and to authenticate with voice (abstract task labelled "Authenticate with voice"). Depending on the configured authentication mechanism, the sub-goals are available or not for the task to be performed. If the configured authentication mechanism in the smartphone is a fingerprint, then the user will authenticate using fingerprint (represented with a test arc from the software object labelled "Configured authentication mechanism" to the task "Authenticate with fingerprint", on this test arc value it is indicated that the software object should have the value "fingerprint"). In the same way, if the configured authentication mechanism in the smartphone is a password (resp. Voice), then the user will authenticate using the password (resp. Voice). The user achieves the sub-goal "Authenticate with fingerprint" using the tactile screen of the smartphone (represented using a line from the input/output device labelled "i/o D: Tactile screen) and through a sequence of the following tasks. First, the user pushes the power-up button (represented with the interactive input task labelled "Push power up button" connected with a line to the input device labelled "in D: Power up button"). Then, the tactile screen displays the screen saver (represented with the interactive output task labelled "Display screen saver") and concurrently (represented with the temporal ordering operator concurrency "|||") displays the fingerprint place holder (represented with the interactive output task labelled "Display fingerprint place holder"). Then the user places the finger on the place holder (represented with the interactive input task labelled "Place finger on place holder"). Then, the smartphone checks the fingerprint (represented by the system task labelled "Check fingerprint"), and the tactile screen displays the home screen (represented by the interactive output task labelled "Display home screen").

Once all tasks are performed, the user reached the sub-goal "Authenticate with fingerprint", as well as the main goal "Authenticate". Sub-goals "Authenticate with password" and "Authenticate with voice" appear as pruned in the task model (represented with a '+' symbol at the bottom right of the abstract task). They also decompose in sub-tasks, but in this article, we present in detail only sub-goal "Authenticate with fingerprint" to instantiate the proposed approach.

From this task model, we can infer that, at any time for the user, there is only one way of authenticating. Meaning that once the authentication mechanism is configured, the user has no choice, even in case of a change of context (extreme lighting conditions, hands not available due to disability or with gloves on, noisy environment). A usable security pattern matching this context is the Adaptable authentication pattern [14] (page 17, Fig. 9 [14]).

## 4.2 Model user tasks with the Usable Security Pattern for Adaptable Authentication

An extract of the task model of the user tasks with the adaptable authentication pattern is presented in Fig. 5. The main user goal is to authenticate (top-level task labelled "Authenticate"), and all the tasks needed to reach this goal require the use of a smartphone (represented by the line connecting the main goal with the system labelled "Sys: Smartphone"). This main goal decomposes in a sequence of tasks. First, the user pushes up the power-up button (interactive input task labelled "Push power-up button"). This task is performed using the power-up button (represented by the line connecting the
<figure><img src="image_5.png" /><figcaption>Fig. 4. Extract of the task model describing the user authentication with a mobile tactile device</figcaption></figure>

interactive input task with the input device labelled “in D: Power-up button”). Then, the system infers the context (system task labelled “Infer context”) using the sensed information (represented by an arc from the software object labelled “SW Obj: sensed information”) and producing an inferred context (represented by an arc from the system task to the software object labelled “inferred context”). Then, the system selects the appropriate authentication mechanism using the inferred context (represented by an arc from the software object labelled “inferred context” to the system task labelled “Select appropriate authentication mechanism”) and producing the software object “authentication mechanism”. Then, depending on the authentication mechanism, the user is guided towards one of the authentication types (represented by the temporal ordering operator choice “[]” associated with the precondition test arcs from the software object labelled “Authentication mechanisms” to the abstract tasks “Authenticate with fingerprint”, “Authenticate with password” and “Authenticate with voice”). For example, if the value of the software object labelled “Authentication mechanism” is “fingerprint”, then the user will be guided toward the abstract task to “Authenticate with fingerprint”. Sub-goals “Authenticate with fingerprint”, “Authenticate with password” and “Authenticate with voice” appear as pruned in the task model (represented with a ‘+’ symbol at the bottom right of the abstract task). They also decompose in sub-tasks, and the abstract task “Authenticate with fingerprint” is described in Fig. 4.

Adaptable authentication pattern aims to provide a balance between security and usability by proposing to the user the most suitable authentication method according to the current usage context [14]. From the model in Fig. 5, we analyse that once the
<figure><img src="image_6.png" /><figcaption>Fig. 5. Extract of the task model describing the user tasks with the adaptable authentication</figcaption></figure>

user pushed the power-up button, the smartphone infers the user context from the sensed information and infers the user context. From the inferred user context, it selects the appropriate authentication mechanism, which will in turn condition the authentication method (fingerprint, password, or voice).

## 4.3 Analysis of the Usable Security Pattern for Adaptable Authentication

From the task model presented in Fig. 5, we can infer the following issues:

- The smartphone decides the appropriate way for the user to log in.

- If several authentication mechanisms are adapted to the context, only one mechanism is proposed.

In that way, the user does not decide on the way to log in, however, several mechanisms may be adapted to the user context.

## 4.4 Refine the Usable Security Pattern

In order to increase usability, a new version of the adaptable authentication pattern is proposed along with the model of the corresponding user tasks (an extract of the model is presented in Fig. 6). Compared to the task model presented in Fig. 5, two new sub-trees have been added between the system task "Selected appropriate authentication mechanism" and choose temporal ordering operator "[+]". The first refinement is that the system displays concurrently (represented with the temporal ordering operator "|||") the selected authentication mechanism (interactive output task labelled "Display selected authentication mechanism") and informs the user about the possibility to fall back to the user preferred authentication mechanism (interactive output task labelled "Inform user about the possibility to fall back to you preferred authentication mechanism"). The interactive input task "Display selected authentication mechanism" produces information for the user (represented by an arc from the interactive input task to the information labelled "Inf: Selected authentication mechanism").
<figure><img src="image_7.png" /><figcaption>Fig. 6. Extract of the task model of the refined adaptable authentication pattern</figcaption></figure>

The second refinement is fallback to the user-preferred configuration mechanism (abstract task labelled “Fall back to configured authentication mechanism”). This abstract task is optional (optional symbol on the top right of the abstract task) and decomposes in a sequence of the following tasks: the user decides to fall back to the preferred authentication mechanism” (cognitive decision task labelled “Decide to fall back to preferred authentication mechanism”), the user confirms the request to fall back to the preferred authentication mechanism (interactive input task labelled “Fall back to preferred authentication mechanism”), the system sets the authentication mechanism (abstract task labelled “Set authentication mechanism”). The cognitive decision task requires information: the selected authentication mechanism and the preferred authentication mechanism (represented by the arcs from the information “Selected authentication mechanism” and from the information “Preferred authentication mechanism”).

The analysis of the task model confirms that the new possible user tasks solve the issues that were raised during the previous step:

- The user is informed about the selected authentication mechanism according to the context (represented with the interactive output task labelled “Display selected authentication mechanism” which produces the information “Selected authentication mechanism”, information is data in the head of the user).

- The user is proposed the possibility to fall back to the preferred authentication mechanism (represented with the interactive input task labelled “Inform user about the possibility to…”).

- The user may decide to fall back to the preferred authentication mechanism, represented with the sub-goal “Fall back to configured authentication mechanism” (this
sub-goal is optional as indicated by blue arrows symbols on the top right of the sub-goal).

These new actions that are possible for the user should increase the effectiveness dimension of usability because the user has now additional possibilities to reach the goal “Authenticate”.

# 5 Related Work

The use of task models for taking into account the usability of security mechanisms during the design phase has been proposed recently. The first contribution [1] focuses on user tasks and potential threats to these user tasks. Task models can be used along with attack trees to ensure that every potential threat on user tasks has been identified [1]. Task models have also been used to increase the number of potential cybersecurity threats detected with risk assessment methods [10]. In particular, the authors [10] target the cybersecurity of the maritime supply chain and integrated task modelling to the MIT-IGATE risk assessment method adding the capability to identify threats on user tasks, whether they root in malicious attacks or human errors. Task models have also been proven useful during the design phase to analyse the complexity of attacker tasks. The identification of possible attacks is not enough to analyse the security of an authentication mechanism because the complexity of an attacker's tasks cannot be systematically foreseen from the high-level description of possible attacks [17]. Such an approach enables one to build pieces of evidence to argue for design choices. For example, if a security mechanism decreases usability but does not make the attacker's tasks more complex, it cannot be an acceptable design choice. These contributions highlight the benefits of using task models for the design of usable security mechanisms. Other types of model-based approaches can also help in analysing security property. For example, process modelling supports the identification of potential errors and vulnerabilities in coordination activities [19]. This type of model-based approach is complementary to the proposed task model-based approach, which focuses on the interactions between the users and the interactive systems.

# 6 Conclusion

There is a collective consensus among the industry and the academic research community that usable security issues must be considered in the development of systems and services. In this regard, design patterns can prove a handful in enabling the designers and developers to evaluate the usability consequences of their security options and vice versa. Therefore, to facilitate the designers and developers in applying right design patterns in the right contexts, the paper proposed a four-step methodology based on generating task models concerning, (1) the users’ security interaction and tasks in line with the specified requirements, (2) the users’ security interaction and tasks in line after applying the usable security design patterns. The designers and developers can then evaluate the task models generated to see if the design pattern contributes effectively towards enabling the usability of security or not. If it does, the design pattern is implemented, otherwise,
the limitations thus identified are used for updating the solution proposed by the pattern. This approach is in line with the patterns' ability to evolve with time and the fundamental engineering principle of not re-inventing the wheel as the concept of reuse is integral in the case of design patterns.

## References

1. Broders, N., Martinie, C., Palanque, P., Winckler, M., Halunen, K.: A generic multimodels-based approach for the analysis of usability and security of authentication mechanisms. In: Bernhaupt, R., Ardito, C., Sauer, S. (eds.) HCSE 2020. LNCS, vol. 12481, pp. 61–83. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-64266-2_4

2. Cockton, G., Woolrych, A.: Understanding inspection methods: Lessons from an assessment of heuristic evaluation. In: Blandford, A., Vanderdonckt, J., Gray, P. (eds.) People and Computers XV—Interaction without Frontiers, pp. 171–191. Springer, London (2001). https://doi.org/10.1007/978-1-4471-0353-0_11

3. Diaper, D.: Understanding task analysis for human-computer interaction. In: The Handbook of Task Analysis for Human-Computer Interaction. Lawrence Erlbaum Associates (2004)

4. Gould, I.D., Lewis, C.: Designing for usability: key principles and what designers think. Commun. ACM 28(3), 300–311 (1985)

5. Göransson, B., Gulliksen, J., Boivie, I.: The usability design process – integrating user-centered systems design in the software development process. Softw. Process Improv. Pract. 8(2), 111–131 (2003)

6. ISO 9241-210:2019(en), Ergonomics of human-system interaction—Part 210: Human-centred design for interactive systems. International Standard Organization (2019)

7. John, B. Kieras, D.E.: The GOMS family of user interface analysis techniques: comparison and contrast. ACM Trans. Comput.-Hum. Interact. 3(4), 320–351 (1996)

8. Johnson, P.: Human-Computer Interaction: Psychology, Task Analysis and Software Engineering. McGraw Hill, Maidenhead (1992)

9. Maguire, M.: Methods to support human-centred design. Int. J. Hum Comput Stud. 55(4), 587–634 (2001)

10. Martinie, C., Grigoriadis, C., Kalogeraki, E.M., Kotzanikolaou, P.: Modelling human tasks to enhance threat identification in critical maritime systems. In: PCI, pp. 375–380. ACM (2021)

11. Martinie, C., Palanque, P., Barboni, E.: Principles of task analysis and modeling: understanding activity, modeling tasks, and analyzing models. In: Vanderdonckt, J., Palanque, P., Winckler, M. (eds.) Handbook of Human Computer Interaction. Springer, Cham (2022)

12. Martinie, C., Palanque, P., Bouzekri, E., Cockburn, A., Canny, A., Barboni, E.: Analysing and demonstrating tool-supported customizable task notations. PACM Hum. Comput. Interact. 3(EICS), 1–26 (2019). Article ID 12

13. Naqvi, B., Seffah, A., Abran, A.: Framework for examination of software quality characteristics in conflict: a security and usability exemplar. Cogent Eng. 7(1), 1788308 (2020)

14. Naqvi, B.: Towards aligning security and usability during the system development lifecycle. LUT University, Finland (2020). https://urn.fi/URN:ISBN:978-952-335-586-6

15. Naqvi, Bilal: Dissecting the Security and Usability Alignment in the Industry. In: Bernhaupt, Regina, Ardito, Carmelo, Sauer, Stefan (eds.) Human-Centered Software Engineering: 9th IFIP WG 13.2 International Working Conference, HCSE 2022, Eindhoven, The Netherlands, August 24–26, 2022, Proceedings, pp. 57–69. Springer, Cham (2022). https://doi.org/10.1007/978-3-031-14785-2_4
16. Naqvi, B., Seffah, A.: Interdependencies, conflicts and trade-offs between security and usability: why and how should we engineer them? In: Moallem, A. (ed.) HCI for Cybersecurity, Privacy and Trust: First International Conference, HCI-CPT 2019, Held as Part of the 21st HCI International Conference, HCII 2019, Orlando, FL, USA, July 26–31, 2019, Proceedings, pp. 314–324. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-22351-9_21

17. Nikula, S., Martinie, C., Palanque, P., Hekkala, J., Latvala, O., Halunen, K.: Models-based analysis of both user and attacker tasks: application to EEVEHAC. In: Bernhaupt, R., Ardito, C., Sauer, S. (eds.) Human-Centered Software Engineering: 9th IFIP WG 13.2 International Working Conference, HCSE 2022, Eindhoven, The Netherlands, August 24–26, 2022, Proceedings, pp. 70–89. Springer, Cham (2022). https://doi.org/10.1007/978-3-031-14785-2_5

18. O'Donnell, R.D., Eggemeier, F.T.: Workload assessment methodology. In: Handbook of Perception and Human Performance, vol. II Cognitive Processes and Performance, pp. 42–41–42–49. Wiley (1986)

19. Osterweil, L.J., et al.: Iterative analysis to improve key properties of critical human-intensive processes: an election security example. ACM Trans. Priv. Secur. 20(2), Article 5 (2017)