# What Parts of Usable Security Are Most Important to Users?

Joakim Kävrestad, Steven Furnell, Marcus Nohlberg

## ► To cite this version:

Joakim Kävrestad, Steven Furnell, Marcus Nohlberg. What Parts of Usable Security Are Most Important to Users?. 14th IFIP World Conference on Information Security Education (WISE), Jun 2021, Virtual, United States. pp.126-139, 10.1007/978-3-030-80865-5_9. hal-03739158

HAL Id: hal-03739158

https://inria.hal.science/hal-03739158v1

Submitted on 27 Jul 2022

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
# What parts of Usable Security are most important to users?

Joakim Kävrestad¹[0000-0003-2084-9119], Steven Furnell²[0000-0003-0984-7542], and Marcus Nohlberg³[0000-0001-5962-9995]

¹ University of Skövde, Sweden joakim.kavrestad@his.se

² University of Nottingham, United Kingdom steven.furnell@nottingham.ac.uk

³ University of Skövde, Sweden marcus.nohlberg@his.se

**Abstract.** The importance of the human aspects of cybersecurity can-
not be overstated in light of the many cybersecurity incidents stemming
from insecure user behavior. Users are supposed to engage in secure be-
havior by use of security features or procedures but those struggle to get
widespread use and one hindering factor is usability. While several previ-
ous papers studied various usability factors in the cybersecurity domain,
a common understanding of usable security is missing. Further, usability
covers a large range of aspects and understanding what aspects users pri-
oritize is integral for development of truly usable security features. This
paper builds on previous work and investigates what usability factors
users prioritize and what demographic factors that affects the percep-
tion of usability factors. This is done through a survey answered by 1452
respondents from Sweden, Italy and UK. The results show that users
prefer security functions to minimize resource consumption in terms of
cost, device performance and time. The study further demonstrate that
users want security functions to require as little effort as possible and
just work. Further, the study determines that nation of residence and
IT-competence greatly impacts the perception of usability for security
functions while gender and age does so to a much lesser extent.

**Keywords:** usability · usable security · cyber security · human · user · perception.

# 1 Introduction

Cybersecurity is a property that is undeniably integral to modern individuals, organisations, and even nations [1, 2]. Much like [3], we consider cybersecurity to be a socio-technical property and a high level of security can only be achieved if social as well as technical factors are considered [4]. The importance of the social, or human, side of security is widely acknowledged by researchers as well as practitioners [5, 6]. Several recent industry reports even suggest that the human element is a part of most cybersecurity incidents, further emphasizing its importance [7, 8]. On this note, a preferable scenario is that users increase their security level through use of security functions such as e-mail encryption or multi-factor
authentication, and security practices such as good password creation and management strategies [9–12]. However, while such practices has been on the market for several decades, they are not in widespread use. As demonstrated in several previous papers, the (perhaps perceived) lack of usability seems to be a big part of the answer to why [13–15].

While the primary task of a security function is to provide security, functions designed to be used by end-users cannot do so unless they are adopted by users, and correctly used. Incorrect use can lead to a false sense of security or even be harmful [9]. For instance, password managers are considered a good way to use unique passwords for various accounts while only having to remember one master password. However, if that password is compromised, all accounts related to it are also compromised [16]. The consequence of security functions or practices not being adopted is obvious, the security they intend to provide is not provided. This is what often happens to so called secure password guidelines which prompt users to use long and complex passwords. Many users are unwilling to follow this guideline and select insecure passwords instead [17]. There are several theories that can be used to explain how users choose to adopt security functions and procedures. Three theories commonly used in cybersecurity can be briefly described as follows:

- Protection Motivation Theory (PMT) where [18] describe that peoples decision to protect themselves against a supposed threat are influenced by how severe and likely the person perceives the threat, how effective a preventative measure is, and the persons perceived ability to engage in that measure.

- Theory of Planned Behaviour (TPB) which highlights that actual behaviour is influenced by a persons perception of how easy or difficult a certain behaviour is [19].

- Technology Acceptance Model (TAM) which in its original form describe that a users decision to adopt a technology is based on how useful she perceives the technology to be, and how easy she perceives it to be to use the technology [20, 21].

Applied to the cybersecurity domain, PMT, TPB, and TAM demonstrate that usability is precursor to user adoption of security functions and practices. User adoption, in turn, is an obvious precursor to whatever security a function or practice is intended to add. As such, usability is a crucial aspect to research in relation to end-user security. While there has been a fair bit of research conducted on usability of security functions, a fundamental issue seems to be that there is no common understanding of what usability means to the cybersecurity community. This is demonstrated how various previous papers consider usability of security functions in vastly different ways. To exemplify, [22] evaluates a subset of usability criteria in the context of phishing, and [23] discusses usability in the context of IoT access control without further describing what usability in that context entails. Further, the System Usability Scale (SUS), presented by [24] as been adopted in the cybersecurity domain by, for instance, [25]. While SUS measures important aspects of usability it does not factor in all aspects that are
considered important in the cybersecurity domain, for instance risk associated with incorrect use [9].

A recent literature review [26] summarizes how usable security has been discussed in 70 scientific publication from 2015 to 2020. [26] presents 31 aspects of how usability has been studied in the cybersecurity domain, and groups those into 14 themes. Our study seeks to expand on the work conducted by [26] by exploring which of those aspects that are considered the most important by users. The study was performed as a survey reaching more than 1400 respondents and provides insight into what usability features that users perceive as most important. It also investigates how the perception of usability features is impacted by various demographic variables. As such, it provides insight that can support practitioners towards development of usable security functions and procedures. the study further provides the research community with a better understanding of what users considers to be the most important usability aspects, and how demographic aspects impact the perception of usable security.

The rest of this paper is structured as follows; Section 2 describes the methodological approach, section 3 presents and analyses the results which are further discussed in section 4 before the paper is concluded, and directions for future work are presented in section 5.

## 2 Methodology

With the purpose of collecting quantitative data from a large sample of respondents, a web-based survey was used. The survey panel company Webropol was hired for the distribution of the survey and while this approach restricted the range of possible participants to the members of Webropols panel, it is a practically feasible method to achieve a sample of high quality [27]. It also minimizes demographic bias, and accidental sampling bias common when distributing web based surveys using, for instance, social media [28]. A stratified sampling approach was used to generate a probability sample [29]. The panel members were split into strata based on gender, age, and geographical region. Equal proportions from each strata were then recruited using simple random sampling [30]. The primary target of the survey was Swedish users, and the target sample size for Swedes was set to 800 respondents. With the goal of comparing the results to users from other European nations, samples with a target size of 300 respondents were drawn from UK and Italy. UK and Italy was chosen since they, according to [31], belong to different culture groups than Sweden.

The survey was part of a larger survey and, for the purpose of this paper, contained demographic questions describing the respondents perceived gender, IT-competence and age. The participants were then asked to pick the five most and least important usability aspects from a list of 21 aspects derived from [26]. The original list by [26] included 31 aspects. However, the surveys development and testing phase revealed that several of those were too similar, or could be perceived in different ways by the respondents. They were therefore combined and/or reworded to ensure that that the list of options was easy for the re-
spondents to understand. For instance, [26] describe compatibility with systems and services, and compatibility with other security solutions as two separate usability aspects. In this study, they were combined into one answer option stating *It should work with all sites and services I use so that I only need one tool of each type*. Further, [26] describes several types of interference to the users workflow and those were combined to one statement expressed as *It should not interfere with the way I work*. The complete list of aspects is presented along with the results to save space, and appeared to the participants in randomized order to minimize responder bias. Both questions were followed by a free-text field where the respondents could add additional comments. Before the survey was distributed, it was taken through a pilot procedure in three steps:

1. A small sample was recruited using social media, and those respondents were specifically asked to provide feedback on the structure and readability of the survey.

2. Two respondents were asked to fill out the survey under personal supervision from a researcher, they were also asked to continuously express their thoughts while filling it out.

3. The survey was distributed to a sample of peers who were asked to assess it in relation to the research aim.

For data analysis, the percentage of respondents picking each aspects was first reported and a maximum 95% confidence interval computed as suggested by [32]. Next, the impact of various demographic factors was investigated by testing how the distribution of answers was impacted when the results of the full sample was divided based on nation, gender, IT-proficiency and age, respectively.

The statistical analysis was performed using chi-square because of the non-parametric nature of the collected data [33], and formally measured if the distribution of data points within a demographic group differed from an expected distribution with statistical significance. The conventional significance level of 95% was adopted in this study. Note that, while data is presented as percentages throughout this study, frequencies in absolute numbers was used for the chi-square tests.

## 3 Results and Analysis

Webropol distributed the survey to a sample of 10 times the target sample size and the survey was open for one week. A total of 1452 respondents completed the survey, and were distributed over the national answer groups as follows:

- Sweden: 834 participants

- Italy: 314 participants

- UK: 304 participants

The respondents were rather evenly divided based on gender and spread through various age groups as shown in Table 1. However, reported level of IT-competence differed between the groups, with Italian respondents reporting to be more IT-competent, on average.
<table><caption>**Table 1.** Demographic overview (in percent)</caption><thead><tr><th></th><th>Sweden</th><th>UK</th><th>Italy</th></tr></thead><tbody><tr><td><strong>Gender</strong></td><td></td><td></td><td></td></tr><tr><td>Female</td><td>45.6</td><td>53.3</td><td>43.9</td></tr><tr><td>Male</td><td>54.2</td><td>46.7</td><td>55.7</td></tr><tr><td>Other/prefer not to say</td><td>0.3</td><td>0</td><td>0.2</td></tr><tr><td><strong>Age</strong></td><td></td><td></td><td></td></tr><tr><td>18-25</td><td>8.3</td><td>1.0</td><td>4.1</td></tr><tr><td>26-35</td><td>20.3</td><td>18.1</td><td>21.3</td></tr><tr><td>36-45</td><td>18.8</td><td>25.7</td><td>31.2</td></tr><tr><td>46-55</td><td>23.9</td><td>18.1</td><td>20.7</td></tr><tr><td>56-65</td><td>15.3</td><td>21.4</td><td>15.3</td></tr><tr><td>66-75</td><td>13.3</td><td>15.5</td><td>7.3</td></tr><tr><td>Above 76</td><td>0.1</td><td>0.3</td><td>0</td></tr><tr><td><strong>IT-Competence</strong></td><td></td><td></td><td></td></tr><tr><td>Professional - working in, Hold a degree in or study IT</td><td>9.4</td><td>9.9</td><td>22.3</td></tr><tr><td>Expert user - Interested user that know my way around IT. Usually asked to help people with home routers, printer installations etc</td><td>22.3</td><td>19.4</td><td>27.7</td></tr><tr><td>Average user - I use IT with no major problems but need help occasionally</td><td>65.1</td><td>64.1</td><td>38.5</td></tr><tr><td>Below Average - I have a hard time using IT and feel like I need help with tasks that others do with ease</td><td>3.2</td><td>6.6</td><td>11.5</td></tr></tbody></table>

The respondents were then provided with the following information before they were asked to rate what five usability aspects they perceived as most and least important.

This part of the survey concerns what properties a security tool or functions should possess for you to use it. We want you to select the five most and the five least important properties from a list of 21 properties.

A security tool or function includes anything designed to improve your level of IT-security and that you can choose to use. Some examples are:

- Password creation guidelines (suggestion for password length, complexity, etc)

- Encryption software, for instance, e-mail encryption tools used to encrypt e-mails or data encryption tools used to encrypt your computer

- Browsing filters that warn you if you are visiting a web site that can be fraudulent

- Malware (eg Viruses and Ransomware) protection software

We want to know which of the following properties you consider to be the most important and the least important. The first question will ask you to check the five most important properties and the second will ask you to check the five properties you think is least important.

All questions are followed by a text-box where you can input additional comments.
The available options and the percentage of respondents choosing each options is displayed in Table 2, sorted in order of preference according to the complete data-set. As seen in the Table 2, a general tendency is that the respondents

<table><caption>**Table 2.** Percentage of participants picking the respective options as the *most* important.</caption><thead><tr><th>Option</th><th>Sweden</th><th>UK</th><th>Italy</th><th>All</th></tr></thead><tbody><tr><td>It should not be costly</td><td>41.5</td><td>50.3</td><td>44.0</td><td>43.7</td></tr><tr><td>It should be easy to understand and navigate the interface</td><td>42.6</td><td>42.8</td><td>32.8</td><td>40.5</td></tr><tr><td>It should not impact the performance of my device</td><td>42.5</td><td>46.7</td><td>30.3</td><td>40.2</td></tr><tr><td>It should not take a lot of time to use</td><td>41.0</td><td>32.6</td><td>35.4</td><td>38.0</td></tr><tr><td>Information about how to use it should be easy to find and understand</td><td>36.3</td><td>32.2</td><td>32.2</td><td>34.6</td></tr><tr><td>It should work with all sites and services I use so that I only need one tool of each type</td><td>37.4</td><td>31.0</td><td>20.4</td><td>32.3</td></tr><tr><td>It should not interfere with the way I work</td><td>31.5</td><td>30.9</td><td>24.2</td><td>29.9</td></tr><tr><td>It should require as little interaction from me as possible</td><td>33.3</td><td>27.6</td><td>21.0</td><td>29.5</td></tr><tr><td>I should not need to learn how to configure or manage it, and default configuration should be safe to use</td><td>30.7</td><td>24.3</td><td>22.3</td><td>27.6</td></tr><tr><td>It should not take a lot of time to install</td><td>25.2</td><td>28.6</td><td>27.4</td><td>26.4</td></tr><tr><td>When I need to make a decision, the tool should provide information about the different options</td><td>20.0</td><td>20.7</td><td>27.7</td><td>21.8</td></tr><tr><td>It should not put me under time pressure</td><td>20.4</td><td>19.1</td><td>20.4</td><td>21.1</td></tr><tr><td>It should be developed by, or recommended by someone I trust</td><td>20.0</td><td>19.4</td><td>19.1</td><td>19.7</td></tr><tr><td>Benefits and effects of using different security options should be clearly presented</td><td>14.0</td><td>15.8</td><td>29.9</td><td>17.8</td></tr><tr><td>The tool should provide feedback such as progress updates, system status etc</td><td>15.4</td><td>16.5</td><td>16.2</td><td>15.8</td></tr><tr><td>It should allow me to customize the configuration to my liking and adapt it to my skill level</td><td>13.2</td><td>14.1</td><td>21.7</td><td>15.2</td></tr><tr><td>I should be able to adjust the interface to my preference</td><td>11.3</td><td>14.5</td><td>25.16</td><td>14.9</td></tr><tr><td>It should be predictable; similar tasks should work in the same way and it should be easy to recognize requirements and conditions during setup</td><td>14.2</td><td>13.5</td><td>16.9</td><td>14.6</td></tr><tr><td>It should be possible to handle accounts for different users</td><td>8.2</td><td>14.5</td><td>20.7</td><td>12.2</td></tr><tr><td>It should be perceived as cool by others</td><td>2.6</td><td>4.9</td><td>12.4</td><td>5.2</td></tr><tr><td>Maximum 95% CI</td><td>3.3</td><td>5.6</td><td>5.4</td><td>2.6</td></tr></tbody></table>

favour aspects that minimize cost and resource consumption as well as ease of use. The preferred ease of use properties can be summarized as properties where interaction and time consumed using the security function is minimized. On the other hand, properties speaking to customizability are less favoured. National differences can be observed for several properties, and those will be further explored below.
The results for the second question, asking the respondents to pick the five properties they perceived as least important, are presented in Table 3. It is sorted in order of preference according to the complete data set.

<table><caption>**Table 3.** Percentage of participants picking the respective options as the least important.</caption><thead><tr><th>Option</th><th>Sweden</th><th>UK</th><th>Italy</th><th>All</th></tr></thead><tbody><tr><td>It should be perceived as cool by others</td><td>79.6</td><td>66.8</td><td>39.8</td><td>68.3</td></tr><tr><td>It should be possible to handle accounts for different users</td><td>48.8</td><td>38.8</td><td>25.5</td><td>41.7</td></tr><tr><td>I should be able to adjust the interface to my preference</td><td>36.1</td><td>29.9</td><td>28.0</td><td>33.6</td></tr><tr><td>It should allow me to customize the configuration to my liking and adapt it to my skill level</td><td>36.9</td><td>30.6</td><td>22.6</td><td>32.5</td></tr><tr><td>It should be developed by, or recommended by someone I trust</td><td>31.4</td><td>29.0</td><td>32.8</td><td>31.2</td></tr><tr><td>The tool should provide feedback such as progress updates, system status etc</td><td>33.6</td><td>28.0</td><td>26.1</td><td>30.8</td></tr><tr><td>It should not take a lot of time to install</td><td>31.1</td><td>22.0</td><td>27.4</td><td>28.4</td></tr><tr><td>It should not put me under time pressure</td><td>24.2</td><td>29.3</td><td>31.5</td><td>26.9</td></tr><tr><td>When I need to make a decision, the tool should provide information about the different options</td><td>19.8</td><td>30.3</td><td>27.7</td><td>23.7</td></tr><tr><td>Benefits and effects of using different security options should be clearly presented</td><td>23.7</td><td>19.1</td><td>22.3</td><td>22.5</td></tr><tr><td>It should be predictable; similar tasks should work in the same way and it should be easy to recognize requirements and conditions during setup</td><td>21.1</td><td>24.0</td><td>23.9</td><td>22.3</td></tr><tr><td>It should require as little interaction from me as possible</td><td>16.2</td><td>22.0</td><td>28.7</td><td>20.1</td></tr><tr><td>It should not be costly</td><td>17.2</td><td>18.8</td><td>28.0</td><td>19.8</td></tr><tr><td>I should not need to learn how to configure or manage it, and default configuration should be safe to use</td><td>17.4</td><td>22.7</td><td>20.4</td><td>19.2</td></tr><tr><td>It should work with all sites and services I use so that I only need one tool of each type</td><td>13.9</td><td>20.1</td><td>16.6</td><td>15.8</td></tr><tr><td>It should not interfere with the way I work</td><td>13.1</td><td>15.1</td><td>20.7</td><td>15.2</td></tr><tr><td>It should not take a lot of time to use</td><td>10.0</td><td>17.1</td><td>21.0</td><td>13.8</td></tr><tr><td>It should not impact the performance of my device</td><td>10.8</td><td>14.8</td><td>19.1</td><td>13.4</td></tr><tr><td>Information about how to use it should be easy to find and understand</td><td>8.2</td><td>11.8</td><td>19.4</td><td>11.4</td></tr><tr><td>It should be easy to understand and navigate the interface</td><td>7.1</td><td>9.9</td><td>18.5</td><td>10.1</td></tr><tr><td>Maximum 95% CI</td><td>2.7</td><td>5.3</td><td>5.4</td><td>2.4</td></tr></tbody></table>

As seen in Table 3, the least preferred options follow the same line as the most preferred option. Customizability options are in this case selected over options speaking to ease of use and limited need for interaction. Further, Tables 2 and 3 suggest that the participants do not care about how cool the functions are perceived by others and are not interested in spending time and money on security features and functions.
The next part of the analysis investigated how the results are impacted by the examined demographics aspects; nation, perceived gender, perceived IT-competence and age. Chi-square was used to measure if the distribution of data points within a demographic group differed from an expected distribution, given the complete data set. The analysis first measured the effect of each individual demographic on each data point. The analysis then measured the effect of gender, age and IT-competence within each national answer group. As such, 168 tests were performed and, given the permitted space, not presented in detail. To exemplify, the first test measured the impact of *nation* on the option *It should not be costly* for the question *most*. Key statistics are presented in Table 4

<table><caption>**Table 4.** Example of statistical analysis using chi-square and the option *It should not be costly* for the question *most*</caption><thead><tr><th>Answer</th><th>Sweden</th><th>UK</th><th>Italy</th><th>chi-square</th><th>Sig.</th></tr></thead><tbody><tr><td>Yes - Observed</td><td>344</td><td>153</td><td>138</td><td rowspan="4">7.475</td><td rowspan="4">0.024</td></tr><tr><td>Yes - Expected</td><td>364.7</td><td>132.9</td><td>137.3</td></tr><tr><td>No - Observed</td><td>490</td><td>151</td><td>176</td></tr><tr><td>No - Expected</td><td>469.3</td><td>171.1</td><td>176.7</td></tr></tbody></table>

The hypothesis tested in this example is that *Nation impacts the number of respondents who perceive "It should not be costly" as one of the most important usability aspects for security features*. The hypothesis is supported given that the p-value is below 0.05, which is true in this case. Table 5 provides an overview of the demographic aspects that were shown to have a significant impact on what usability aspects respondents rank as most important. Significant tests are marked with an asterisk (*).

As shown by Table 5, demographics do impact what usability aspects respondents perceive as most important and nation of residence and perceived IT-competence are the most prominent demographic aspects while age and gender impacts far fewer of the usability aspects. It could, however, be noted that nation and IT-competence impact the same aspects in nine cases and the sample from Italy is distributed differently than the other sampling groups on the demographic of IT-competence (as seen in Table 1). Thus, it is hard to say if the perception of those aspects is impacted by IT-competence, nation, or both. Table 6 provides an overview of the demographic aspects that were shown to have a significant impact on what usability aspects respondents rank as least important, significant tests are marked with an asterisk (*). While there is some variation between Tables 5 and 6, nation and IT-competence are the demographic factors influencing the perception of most usability aspects. Gender and age, on the other hand, influence below 25% of the aspects.
<table><caption>**Table 5.** Overview of what demographics that had a significant impact on what usability aspects that were perceived as *most* important, in the complete data set (n=1452). It is ordered with most frequently picked option in the complete sample on top.</caption><thead><tr><th>Option</th><th>Nation</th><th>Age</th><th>IT-comp.</th><th>Gender</th></tr></thead><tbody><tr><td>It should not be costly</td><td>*</td><td>*</td><td>*</td><td>*</td></tr><tr><td>It should be easy to understand and navigate the interface</td><td>*</td><td></td><td>*</td><td>*</td></tr><tr><td>It should not impact the performance of my device</td><td>*</td><td></td><td>*</td><td></td></tr><tr><td>It should not take a lot of time to use</td><td>*</td><td></td><td></td><td></td></tr><tr><td>Information about how to use it should be easy to find and understand</td><td></td><td>*</td><td></td><td>*</td></tr><tr><td>It should work with all sites and services I use so that I only need one tool of each type</td><td>*</td><td></td><td>*</td><td></td></tr><tr><td>It should not interfere with the way I work</td><td>*</td><td>*</td><td></td><td></td></tr><tr><td>It should require as little interaction from me as possible</td><td>*</td><td></td><td></td><td></td></tr><tr><td>I should not need to learn how to configure or manage it, and default configuration should be safe to use</td><td>*</td><td></td><td></td><td></td></tr><tr><td>It should not take a lot of time to install</td><td></td><td>*</td><td>*</td><td></td></tr><tr><td>When I need to make a decision, the tool should provide information about the different options</td><td>*</td><td></td><td></td><td></td></tr><tr><td>It should not put me under time pressure</td><td></td><td></td><td>*</td><td></td></tr><tr><td>It should be developed by, or recommended by someone I trust</td><td></td><td></td><td></td><td></td></tr><tr><td>Benefits and effects of using different security options should be clearly presented</td><td>*</td><td></td><td>*</td><td></td></tr><tr><td>The tool should provide feedback such as progress updates, system status etc</td><td></td><td></td><td>*</td><td></td></tr><tr><td>It should allow me to customize the configuration to my liking and adapt it to my skill level</td><td>*</td><td></td><td>*</td><td>*</td></tr><tr><td>I should be able to adjust the interface to my preference</td><td>*</td><td></td><td>*</td><td>*</td></tr><tr><td>It should be predictable; similar tasks should work in the same way and it should be easy to recognize requirements and conditions during setup</td><td></td><td></td><td></td><td></td></tr><tr><td>It should be possible to handle accounts for different users</td><td>*</td><td></td><td>*</td><td></td></tr><tr><td>It should be perceived as cool by others</td><td>*</td><td>*</td><td>*</td><td></td></tr></tbody></table>

## 4 Discussion

The aim of this study was twofold; the first aim was to analyze what usability aspects that users consider most important for security functions, and the second was to identify demographic aspects which affect how those usability aspects are perceived. The study continued on the work by [26] and derived 21 usability aspects from the list of 31 usability aspects presented there. The study was
<table><caption>**Table 6.** Overview of what demographics that had a significant impact on what usability aspects that were perceived as least important, in the complete data set (n=1452). It is ordered with most frequently picked option in the complete sample on top.</caption><thead><tr><th>Option</th><th>Nation</th><th>Age</th><th>IT-comp.</th><th>Gender</th></tr></thead><tbody><tr><td>It should be perceived as cool by others</td><td>*</td><td>*</td><td>*</td><td></td></tr><tr><td>It should be possible to handle accounts for different users</td><td>*</td><td>*</td><td>*</td><td></td></tr><tr><td>I should be able to adjust the interface to my preference</td><td>*</td><td></td><td>*</td><td></td></tr><tr><td>It should allow me to customize the configuration to my liking and adapt it to my skill level</td><td>*</td><td></td><td>*</td><td></td></tr><tr><td>It should be developed by, or recommended by someone I trust</td><td></td><td></td><td></td><td></td></tr><tr><td>The tool should provide feedback such as progress updates, system status etc</td><td>*</td><td></td><td>*</td><td>*</td></tr><tr><td>It should not take a lot of time to install</td><td>*</td><td>*</td><td>*</td><td>*</td></tr><tr><td>It should not put me under time pressure</td><td>*</td><td></td><td></td><td>*</td></tr><tr><td>When I need to make a decision, the tool should provide information about the different options</td><td>*</td><td></td><td></td><td></td></tr><tr><td>Benefits and effects of using different security options should be clearly presented</td><td></td><td></td><td></td><td></td></tr><tr><td>It should be predictable; similar tasks should work in the same way and it should be easy to recognize requirements and conditions during setup</td><td></td><td></td><td></td><td></td></tr><tr><td>It should require as little interaction from me as possible</td><td>*</td><td></td><td></td><td></td></tr><tr><td>It should not be costly</td><td>*</td><td></td><td></td><td></td></tr><tr><td>I should not need to learn how to configure or manage it, and default configuration should be safe to use</td><td></td><td></td><td></td><td></td></tr><tr><td>It should work with all sites and services I use so that I only need one tool of each type</td><td>*</td><td></td><td></td><td></td></tr><tr><td>It should not interfere with the way I work</td><td>*</td><td>*</td><td>*</td><td></td></tr><tr><td>It should not take a lot of time to use</td><td>*</td><td></td><td>*</td><td></td></tr><tr><td>It should not impact the performance of my device</td><td>*</td><td>*</td><td>*</td><td></td></tr><tr><td>Information about how to use it should be easy to find and understand</td><td>*</td><td></td><td>*</td><td>*</td></tr><tr><td>It should be easy to understand and navigate the interface</td><td>*</td><td></td><td>*</td><td></td></tr></tbody></table>

conducted using a web based survey in order to generate a large sample of respondents, and resulted in a data set with survey data from 1452 individual respondents from Sweden, Italy and UK. The survey was carefully developed by the research team and evaluated in a three-step pilot procedure to ensure that it was appropriate for the study aim and easy to understand for respondents.
The first aim was met by two questions where the respondents were asked to rate the five usability aspects they perceived as most and least important. The intent was to let the two question combined serve as a form of triangulation around the question of what aspects the respondents considered to be most important [34]. The results show that the usability aspects perceived as most important are those reflecting resource minimization and ease of use. The aspects perceived as least important reflect customizability interfaces and behaviour. One respondents commented as follows; "*Needs to be free. Runs in the background with no input from me. Should run without impacting on my use of technology*". That quote is a good summary of the study's results in regards to the first aim. This notion aligns well with previous research suggesting that users just want cybersecurity to work.

The second aim was met by dividing the dataset based on nation, gender, age and reported IT-competence and analyzing if any of those factors significantly impacted the respondents perception of the usability aspects. Repeated chi-square tests revealed that nation and IT-competence both affected the perception of up to 75% of the included usability factors while age and gender both only impacted about 25%. It should be noted that the distribution of answers to the demographic question about IT-competence is uneven between the national sample groups, and that can impact the results in this case. Still, the results do suggest that nation of residence does impact how users perceive the importance of usability aspects. This notion aligns well with previous research suggesting that both culture and IT-competence are important factors in human aspects of cybersecurity [35]. However, the study also suggest that age and gender does not affect how users prioritize usability aspects of security functions to any large extent, and this is surprising due to previous research suggesting age and gender to be important factors in cybersecurity in general [36-39].

By extending the work by [26], this study contributes to the academic community with increased understanding about what the concept of usable security entails. It does so by providing an analysis of what usability aspects that users consider to be most important and is, to the best of our knowledge, the first publication of that sort. This paper also demonstrate the complex nature of the human aspects of cybersecurity and emphasizes the need for continued research in pursuit of generalizable results that can help the community move towards better cybersecurity behaviour with cost-effective means.

As a contribution to practitioners, the results of this survey insight depicting what security aspects to focus on when implementing security features. Since the results of this survey shed light on what usability features that are prioritized by the most users, it also shows which of those aspects a feature appealing to as many users as possible should include. Perhaps at least as important, it uncovers which aspects that are perhaps not worthwhile to put efforts into.
# 5 Conclusions and future work

The first part of this study asked the respondents to rank the five most and five least important usability aspects of security functions. The available aspects are presented in Table 2. As a summary, the results suggest that respondents prioritize resource effective security functions. The functions should not be costly, impact device performance, or require a lot of time to use. This notion is emphasized by several free-text comments stating that "it should just be there and work". The results also show that the respondents want security functions to be easy to use and to understand. As a general rule, usability aspects speaking to more advanced use are found at the bottom of the list of preferred aspects. Those aspects include customizability, ability to handle multiple accounts and existence of feedback from the security features.

The second part of the analysis evaluated if nation, gender, age or IT-competence had an impact on what usability aspects that are most or least preferred. This analysis showed that nation and IT-competence had the most widespread impact with nation impacting the perception of about 75% of the aspects, and IT-competence impacting about 55%. It should here be noted that the answers to the demographic question about IT-competence are unevenly distributed between the national sample groups, and that can impact the results in this case. Finally, age and gender both impacted the perception of less than 25% of the included usability aspects, suggesting that those demographics are not as important when it comes to the perception of usability in relation to security functions.

This paper shows that several demographic aspects can impact the usability aspects that users prioritize for security functions. Given the limitations of space, it was not possible to dwell into the nature of this effect and further analysis of the demographic effect in this, or other, data sets is a natural continuation of this work. Further areas for future work could be to expand on this study by including more demographic aspects such as disabilities or more different nation groups.

# References

1. Huskaj, G., Wilson, R.L.: An Anticipatory Ethical Analysis of Offensive Cyberspace Operations. In: Cruz, T., Simoes, P. (eds.) In: Proceedings of the 15th International Conference on Cyber Warfare and Security. Academic Conferences and Publishing International Ltd. (2020)

2. Vroom, C., Von Solms, R.: Towards information security behavioural compliance. Computers & security 23(3), 191–198 (2004)

3. Al Sabbagh, B., Kowalski, S.: St cs 2 featuring socio-technical cyber security warning systems. In: Proceedings Title: 2012 International Conference on Cyber Security, Cyber Warfare and Digital Forensic (CyberSec). pp. 312–316 (2012)

4. Paja, E., Dalpiaz, F., Giorgini, P.: Managing security requirements conflicts in socio-technical systems. In: Ng, W., Storey, V.C., Trujillo, J.C. (eds.) Conceptual Modeling. pp. 270–283. Springer Berlin Heidelberg, Berlin, Heidelberg (2013)
5. Furnell, S., Esmael, R., Yang, W., Li, N.: Enhancing security behaviour by supporting the user. Computers Security 75, 1–9 (2018)

6. Cybint: 15 alarming cyber security facts and stats. (2020), https://www.cybintsolutions.com/cyber-security-facts-stats/

7. EC-Council: (2019), https://blog.eccouncil.org/the-top-types-of-cybersecurity-attacks-of-2019-till-date/

8. Soare, B.: Vectors of attack (2020), https://heimdalsecurity.com/blog/vectors-of-attack/

9. Whitten, A., Tygar, J.D.: Why johnny can't encrypt: A usability evaluation of pgp 5.0. In: USENIX Security Symposium. vol. 348, pp. 169–184 (1999)

10. Aljahdali, H.M., Poet, R., Ieee: The affect of familiarity on the Usability of Recognition-based graphical Password Cross cultural Study Between Saudi Arabia and the United Kingdom, pp. 1528–1534. IEEE International Conference on Trust Security and Privacy in Computing and Communications

11. Alsaiari, H., Papadaki, M., Dowland, P., Furnell, S.: Graphical one-time password (gotpass): A usability evaluation. Information Security Journal 25(1-3), 94–108

12. Das, S., Dingman, A., Camp, L.J.: Why johnny doesn't use two factor a two-phase usability study of the fido u2f security key. In: Proceedings of the International Conference on Financial Cryptography and Data Security

13. Florencio, D., Herley, C.: A large-scale study of web password habits. In: Proceedings of the 16th international conference on World Wide Web. pp. 657–666. ACM

14. Benenson, Z., Lenzini, G., Oliveira, D., Parkin, S., Uebelacker, S.: Maybe poor johnny really cannot encrypt: The case for a complexity theory for usable security. In: NSPW 15p. pp. 85–99 (2015)

15. Lerner, A., Zeng, E., Roesner, F.: Confidante: Usable encrypted email: A case study with lawyers and journalists. 2017 IEEE European Symposium on Security and Privacy (EuroSP) pp. 385–400 (2017)

16. Chaudhary, S., Schafeitel-Tähtinen, T., Helenius, M., Berki, E.: Usability, security and trust in password managers: A quest for user-centric properties and features. Computer Science Review 33, 69–90 (2019)

17. Haga, W.J., Zviran, M.: Question-and-answer passwords - an empirical-evaluation. Information Systems 16(3), 335–343

18. Rogers, R.W.: A protection motivation theory of fear appeals and attitude change1. The journal of psychology 91(1), 93–114 (1975)

19. Ajzen, I.: From intentions to actions: A theory of planned behavior. In: Action control, pp. 11–39. Springer (1985)

20. Davis, F.D.: Perceived usefulness, perceived ease of use, and user acceptance of information technology. MIS quarterly pp. 319–340 (1989)

21. Davis, F.D.: A technology acceptance model for empirically testing new end-user information systems: Theory and results. Ph.D. thesis, Massachusetts Institute of Technology (1985)

22. Marchal, S., Armano, G., Gröndahl, T., Saari, K., Singh, N., Asokan, N.: Off-the-hook: An efficient and usable client-side phishing prevention application. IEEE Transactions on Computers 66(10), 1717–1733 (2017)

23. He, W., Golla, M., Padhi, R., Ofek, J., Dürmuth, M., Fernandes, E., Ur, B.: Re-thinking access control and authentication for the home internet of things (iot). In: 27th USENIX Security Symposium (USENIX Security 18). pp. 255–272

24. Brooke, J.: Sus-a quick and dirty usability scale. Usability evaluation in industry 189(194), 4–7 (1996)
25. Khan, H., Hengartner, U., Vogel, D.: Usability and security perceptions of implicit authentication: Convenient, secure, sometimes annoying. In: Eleventh Symposium On Usable Privacy and Security (SOUPS 2015). pp. 225–239

26. Lennartsson, M., Kävrestad, J., Nohlberg, M.: Exploring the meaning of “usable security”. In: International Symposium on Human Aspects of Information Security and Assurance. pp. 247–258. Springer (2020)

27. Rivers, D.: Sampling for web surveys. In: Joint Statistical Meetings. p. 4 (2007)

28. Culotta, A.: Reducing sampling bias in social media data for county health inference. In: Joint Statistical Meetings Proceedings. pp. 1–12. Citeseer (2014)

29. Henry, G.T.: Practical sampling, vol. 21. Sage (1990)

30. Scheaffer, R.L., Mendenhall III, W., Ott, R.L., Gerow, K.G.: Elementary survey sampling. Cengage Learning (2011)

31. Inglehart, R., Welzel, C.: The wvs cultural map of the world. World Values Survey (2010)

32. Wheelan, C.: Naked statistics: Stripping the dread from the data. WW Norton & Company (2013)

33. Fowler Jr, F.J.: Survey research methods. Sage publications (2013)

34. Lincoln, Y.S., Guba, E.G.: Naturalistic inquiry (1985)

35. Joinson, A., van Steen, T.: Human aspects of cyber security: Behaviour or culture change? Cyber Security: A Peer-Reviewed Journal 1(4), 351–360 (2018)

36. Bansal, G., Hodorff, K., Marshall, K.: Moral beliefs and organizational information security policy compliance: The role of gender. Proceedings of the Eleventh Midwest United States Association for Information Systems pp. 1–6 (2016)

37. Anwar, M., He, W., Ash, I., Yuan, X., Li, L., Xu, L.: Gender difference and employees’ cybersecurity behaviors. Computers in Human Behavior 69, 437–443 (2017)

38. McGill, T., Thompson, N.: Gender differences in information security perceptions and behaviour. In: 29th Australasian Conference on Information Systems (2018)

39. Fatokun, F., Hamid, S., Norman, A., Fatokun, J.: The impact of age, gender, and educational level on the cybersecurity behaviors of tertiary institution students: An empirical investigation on malaysian universities. In: Journal of Physics: Conference Series. vol. 1339, p. 012098. IOP Publishing (2019)