# Adding Measures to Task Models for Usability Inspection of the Cloud Access Control Services

Bilal Naqvi, Ahmed Seffah, Christina Braz

► To cite this version:

Bilal Naqvi, Ahmed Seffah, Christina Braz. Adding Measures to Task Models for Usability Inspection of the Cloud Access Control Services. 7th International Conference on Human-Centred Software Engineering (HCSE), Sep 2018, Sophia Antipolis, France. pp.133-145, 10.1007/978-3-030-05909-5_8 . hal-02270718

HAL Id: hal-02270718

https://inria.hal.science/hal-02270718

Submitted on 26 Aug 2019

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
# Adding Measures to Task Models for Usability Inspection of the Cloud Access Control Services

Bilal Naqvi¹, Ahmed Seffah¹, Christina Braz²

¹ Lappeenranta University of Technology, LUT, Lappeenranta, Finland

² Scotia Bank, Canada

Syed.naqvi@student.lut.fi

**Abstract.** Access control services in the cloud require defining which users, applications, or functions can have access to which data to perform what kinds of operations. There are thus three dimensions: (1) which users can (2) perform which operations (3) on which data. We speak of: (1) principals (i.e., users or roles), (2) privileges, and (3) objects, corresponding to these three dimensions, respectively. The act of accessing gives rights and privileges such as using or releasing data, modifying the access rights or accomplishing certain tasks. Permission to access also requires identity management. Research studies identify the existence of dependency between usability and security, and that there exists a conflict between the two, for which trade-offs are difficult to evaluate and engineer. This paper proposes a novel methodology for assessing the usability of access control services while ensuring that security requirements are met. The proposed methodology assists in integrating the experience of both security and usability experts by using different Human Computer Interaction methods as a way to identify the usability and security problems in access control security services in the cloud, and capture solutions to resolve such problems.

**Keywords:** Usable security; usability in cloud access control and identity management; usability of security services, security and usability conflict.

## 1 Introduction

In recent years, there has been a significant growth in the adoption and popularity of the cloud-computing segment. However, such growth poses numerous challenges regarding security, usability, environmental sustainability etc. [13]. A wide range of users using different access devices, procedures, and technologies use cloud systems and security services. In cloud computing, authentication is a core requirement and serious concern as access control services protect not only critical IT infrastructures, but also related physical spaces including surveillance rooms, data centers, etc. Access control services in the cloud require defining which users, applications, or functions can have access to which data to perform which kinds of operations. The security challenge concerning user authentication and identity management services includes: (1) authentication, the process of verifying that an individual truly is who s/he claims to be and (2) authorization, the process of assigning permissions to users [17]. There are thus three
dimensions: (1) which users can (2) perform which operations (3) on which data. Cor-
responding to these three dimensions, we speak of: (1) principals (i.e., users or roles),
(2) privileges, and (3) objects, respectively.

According to Cranor et al. [5], Jøsang et al. [11] and Nielsen [15], security and usability are considered as two opposed quality characteristics related to the user interface and functionality of the security system. One observable belief is that usability advocates support making it easy to use a system, preferably requiring no special access procedures at all, whereas security experts’ support making it hard to access a system, at least for unauthorized users. However, there are several cases in which security and usability should be enhanced by modeling their mutual relationships, as an example of such cases, online payment, and e-banking, supervision of critical industrial infrastructures, crisis management and rescue systems. Therefore, more attention should be paid to the front-end of these secure solutions, i.e., how security information is communicated directly and indirectly to users. Usability cannot be treated separately from the security engineering of a system.

This research is a part of a long term project, where the main goal is to propose a
framework for assessing the security and usability conflicts in access control services
in the cloud while incorporating software measures into HCI task modeling techniques.

## 2 Measures of Usability in HCI and Security in Software Engineering

Security and usability have been widely recognized as two opposed characteristics [11]. Such opposed relation can be attributed for different reasons. The failure of security experts to measure usability is that usability problems with security systems and services are not just about the UIs usability. Existing literature highlighted that using conventional methods for usability evaluation only assess the usability impact on security effectiveness [12]. Usability and security conflicts and measures should be looked at from different levels. The ISO 27000 series of standards [10] identifies measurable attributes of information security as preservation of confidentiality, authenticity, accountability, non-repudiation, reliability, integrity and availability of information. Such attributes play an important role in measuring that the identified security requirements have been met.

Several researchers have introduced different methods to facilitate the development
of usable secure systems. Kainda et al. [12] introduced a security usability threat model.
They identified different usability and security factors based on previous studies and
categorized them into six different groups of security topics. Authentication is one of
these groups. However, the authors have not provided an example to clarify how the
proposed model can be applied to measure the usability of security systems. Hausawi
and Allen [7] proposed a summative usable security evaluation matrix that aims to help
in determining the levels of usability and security quality attributes during the software
development lifecycle; their matrix includes three usability factors (efficiency, effec-
tiveness, and satisfaction) and three security factors (confidentiality, integrity, and
availability). Zhao and Yue [20] introduced a Cloud-based Storage to manage browser-
based passwords, their approach aimed to achieve a high level of security and usability with the desired confidentiality, integrity, and availability properties.

Hayashi et al. [9] introduced a usable security framework, called context-aware scalable authentication, which aims to use multiple implicit factors, such as a user's location, in order to select an appropriate active authentication form to authenticate the user. Nayak et al. [14] sought to enhance the security of the cloud services by introducing mutual authentication scheme using symmetric keys. During the authentication process, the proposed scheme requires the users to login into two accounts, indeed, that may make users feel uncomfortable. Beckerle and Martucci [2] introduced six guidelines for designing usable access control rule sets; they clarified that implementing those guidelines will help in understanding and managing access policies. Hausawi et al. [8] proposed an authentication system, called Choice-Based Authentication Approach (CBAA) which aims to provide better usability by allowing end users to select their authentication method based on their preferences. The authors pointed out that their approach improves security by increasing the difficulty for adversaries by displaying all of the possible authentication methods during the login process. Similar to the CBAA approach, Forget et al. [6] proposed an authentication architecture, called Choose Your Own Authentication (CYOA) which allows users to select a scheme amongst several available options. CYOA enables users to select whichever scheme best suits their preferences, abilities, and usage context.

Faily and Flechais [21], suggest using scenarios to describe how design decisions can lead to an unintentional security compromise caused by the end-user. They further present that these misusability cases can be used to impact design decisions of the developers and to bridge gaps between usability and security.

In the literature, various definitions concerning different attributes (facets, aspects, factors) of usability have been proposed. While security has been interpreted as a purely technical aspect in software development methodologies, some authors think it is more than that, taking instead a strategic dimension, resulting in one of the most important criteria in the governance of Information Communication Technology (ICT). For example, the executive management in companies still think that security technology is all that is required, and therefore ‘delegates or downgrades’ the issue to the technical departments, and conveniently neglects about the human and organizational concerns [19].

## 3 Proposal for Usable Security Measurement

The usability security measurement methodology (see Figure 1) proposed in this paper was developed based on the original concept presented in Braz et al. [3], it aims to achieve this goal specifically while: (1) defining the possible conflicts between usability and security in terms of measures and (2) incorporating these measures into task models and a task-based inspection method. Task models are used to identify and model qualitatively the problematic aspects of the conflicts between usability and security. In comparison with Braz et al. work [5], we have used the ISO 25000 standard series and
different measures as a way to quantify, assess and estimate quantitatively how security and usability are connected and how much severe the problem.

<figure><img src="image_2.png" /><figcaption>Fig. 1. The proposed usable security measurement methodology</figcaption></figure>

The proposed usable security inspection method was developed using the design science research framework [16]. Following are the three steps of usable security measurement methodology that we propose.

* Step 1 describes how the task models and scenarios can be used by the usability specialists and security experts to analyze the users' interaction with the security services and then identifying and describing both the usability and security problems.

* Step 2 measures the usability and security interdependencies for each task model and the related security and usability problems using a set of measurable usability factors and criteria, correlated with security.

* Step 3 describes how the usable security inspection method is used to assist both the usability and security evaluators in identifying and evaluating the usability of security services. As detailed later, the method will help in the identification of the security and usability users' problems and their severity rate, with respect to the usability criteria and security measures defined in Step 2.

Figure 2 portrays a subset of these measures. For example, the authenticity factor can be measured using the authentication protocols.

$$UAP = X/Y$$
Where UAP stands for utilization of authentication protocols, X is the number of pro- vided authentication protocols, and Y is the number of required authentication proto- cols that are stated in the requirement specifications. In the same way, usability can be assessed using the satisfaction factor that can be measured using the number of user complaints

$NUC = A/B$

Where NUC stands for number of user complaints, A is the number of users' complaints and B is the total number of users. These two ratios help in determining to which extent the usability and security separately can be quantified [1]. Figure 2 shows a possible conflict between authenticity and satisfaction measures. Based on the first step of the proposed methodology, the users' interaction should be analyzed to identify the secu- rity and usability problems qualitatively.

<figure><img src="image_3.png" /><figcaption>Fig. 2. A possible conflict between authenticity and satisfaction measures</figcaption></figure>

For example, a multipurpose contactless smart card token-based authentication (i.e., PIN) is selected to authenticate a user to access to a Multifunction Teller Machine. This protocol may affect the users' satisfaction negatively. Security and usability experts can use the task models and scenarios techniques to identify both security and usability problems that lead to the user non-satisfaction for example, consider the task and sce- nario below.

**Task:** Authenticate user to a Multifunction Teller Machine (MTM)

**Scenario:** User must authenticate her/himself through a multipurpose contactless smart card token-based authentication (i.e., PIN) in order to have access to different systems.
<table><caption>**Table 1.** Related problems from both the usability and security perspectives for the considered task</caption><thead><tr><th>Usability</th><th>Security</th></tr></thead><tbody><tr><td><strong>Problem:</strong><br>Minimal Action (User Convenience: dealing with multipurpose VS. single purpose smart cards).<br><br><strong>Perspective:</strong><br>- The card improves user convenience since the user doesn't need to carry several cards and memorizing different PIN codes. However, it raises the risk that if the card is lost or gets stolen.<br>- Using a one purpose card is more secure, but this means the user will need to carry one card for each application which is not as convenient.</td><td><strong>Problem:</strong><br>Storage of Information.<br><br><strong>Perspective:</strong><br>- A multipurpose contactless smart card puts more sensitive information on the card<br>- The risk involved when the wrong person gets access to the card, is much higher.<br>- Contactless smart cards open the door to attacks that exploit over-the-air communication channels in an unsolicited way such as eavesdropping, interruption of operations, covert transactions, and denial of service.</td></tr></tbody></table>

## Step 1: Identifying the Task Modeling and Scenarios

We used scenarios and tasks models, two well-known HCI techniques for analyzing users and usability problems as well as for understanding and modeling users' characteristics and the context in which the security and usability conflicts occurs.

We introduced a novel definition for a security and usability scenario as follows: a security scenario can be tangible or intangible. A Tangible Security Scenario (TSS) includes physical infrastructure such as control of user's access to buildings and facilities using: for example, biometrics, sending a silent alarm in response to a threat at a Multi-function Teller Machine (MTM), a type of an advanced ATM which provides additional services alongside cash withdrawal, such as video surveillance. An Intangible Security Scenario (ISS) includes data or other digital information: for example, a user who enters sensitive information at registration in order to purchase a concert ticket at an MTM. Both security and usability scenarios aim to detect the security and usability problems that may result when performing a task in a specific context.

To model the tasks and related scenarios, the GOMS (Goals, Operators, Methods, and Selection rules), a family of HCI techniques [4] has been used. GOMS helps the HCI analyst and security designer in making design decisions regarding the required tradeoff between usability and security when they come into conflict. For example, instead of determining and describing the recall password process within an existing Risk-based authentication method, the analyst-designer describes and decides how this user will use such process. Our choice of GOMS was mainly due to our knowledge and previous practical experience of using GOMS method for modelling task and scenarios.

## Step 2: Connecting the tasks' scenarios with the related usability criteria and factors

Here, we model security as a usability sub-characteristic: both usability and security are defined in terms of sub-factors that are measures. Seffah et al. [18] introduced a
Quality in Use Integrated Measurement (QUIM) model as a consolidated model for measuring usability. As part of our proposed methodology, we selected nine usability sub-factors from the QUIM model, where the selected factors are related with security. The selected usability factors namely efficiency, satisfaction, productivity etc. are presented in Figure 3.

<figure><img src="image_4.png" /><figcaption>**Fig. 3.** Connecting the tasks’ scenarios and their security problems with the corresponding usability criteria and factors</figcaption></figure>

Each of these factors is broken down into one of the following measurable criteria:

- *Minimal Action* (capability of the application to help users achieve their tasks in a minimum number of steps);

- *Minimal Memory Load* (whether a user is required to keep minimal amount of information in mind in order to achieve a specified task);

- *Operability* (amount of effort necessary to operate and control an application);

- *Privacy* (whether users’ personal information is appropriately protected);

- *Security* (capability of the application to protect information and data so that unauthorized persons or systems cannot read or modify them and authorized persons or systems are not denied access);

- *Load Time* (time required for the application to load (i.e., how fast it responds to the user));

- *Resource Safety* (whether resources including people are handled properly without any hazard).

Therefore, after identifying the tasks’ scenarios, security experts should analyze them and identify the security problems or threats that may result from each scenario. Thereafter, both usability and security experts should analyze these problems, in order to identify the corresponding usability criteria. Finally, the usability criteria should be mapped to one or more measurable usability factors. In fact, the relation between usability criteria, factors, and security problems can be used to guide a design decision or to assess a design that has already been created.
* **Step 3: Applying Usability Security Inspection Method**

In HCI, inspection is a set of techniques which consist of evaluators to examine, for example, computer security software without involving end users. The method can be used in conjunction with task modeling and with modeling of security as usability sub-factor. Inspection can be conducted during the early phases, mainly requirements analysis and preliminary design phases that help security designers to identify possible problems as early as possible.

As part of our methodology, we developed a heuristic-based method, called usable security inspection. It involves having a group of evaluators, mainly security and HCI designers, to systematically examine the user interface of a security protocol (e.g. authentication) and judge its compliance with security and usability principles. The interface is regarded, in this paper, as both software (e.g. user logs into a Website) and hardware components (e.g. authentication token) towards which the interaction and information transit between software and/or hardware components, network, and users.

The output of this inspection method is a checklist that aims to evaluate the authentication method that will be used to authenticate users. After generating the inspection method checklist, the security and usability evaluators will be able to identify security and usability problems and their severity rates. However, users' usability and security problems are rated by three severity levels:

- **Major**: refers to catastrophic problems that should be given a high fixing priority level, they must be fixed before releasing the software.

- **Intermediate**: it is important to fix this type of problem as soon as possible.

- **Minor**: refers to problems with a low fixing priority level, which means that these problems should be fixed only if there is extra time available.

# 4 Case Study

This section aims to clarify how to use the proposed usable security measurement methodology for developing usable and secure authentication method to access Multifunction Teller Machine (MTM) account through the user phone.

* **Step 1: Identifying the MTM's task models and scenarios:**

The users' tasks to use MTM may include: authenticate user to a system, transfer funds to an international bank account, buy a ticket concert, access a MTM through a mobile phone, deposit a check using checking image and send a silent alarm. For example Table 2 clarifies the related scenario and the required features for the task below.

**Task:** *Access and authenticate to MTM with your mobile phone*
<table><caption>**Table 2.** An example task to access MTM with mobile phone, its related scenario and sub-tasks</caption><thead><tr><td>Scenario</td><td>Sub-Tasks</td></tr></thead><tbody><tr><td>Customer accesses a MTM via mobile phone in order to make his/her mortgage monthly payment. The phone is equipped with a special chip that enables to communicate with the MTM.</td><td>Sub-tasks performed using a mobile phone:<ol><li>Select "Access my MTM" from the cell phone main menu;</li><li>Enter your 4 digit PIN (the PIN is entered on the customer's phone keypad then transmitted to a central server and checked against file saved there);</li><li>Select "Make a Payment" from the MTM's menu;</li><li>Select the type of payment which is "Mortgage";</li><li>Tap the exact amount;</li><li>Select "Submit".</li></ol></td></tr></tbody></table>

Based on this scenario, we have identified the usability and security problems and their related perspectives (see Table 3).

<table><caption>**Table 3.** Usability and security problems associated with the considered task</caption><thead><tr><td>Usability</td><td>Security</td></tr></thead><tbody><tr><td><strong>Problem:</strong> Overwhelm Customers with complexity when dealing with different communication channels.</td><td><strong>Problem:</strong> Credentials across several channels</td></tr><tr><td><strong>Perspective</strong><ul><li>Customers have to manage complexity when dealing with different services offered through different types of communication channels such as MTM, Web, and WAP.</li><li>Customers will still be required to authenticate to the system by entering a PIN. Unlike passwords, PINs have no meaning to the customer, and then it might be even harder to remember than a password (i.e., passwords can be created to be pronounceable). PINs become harder to remember for customers who have many different ones to keep track of.</li></ul></td><td><strong>Perspective</strong><ul><li>Using the same authentication credentials for both WAP and MTM channel, can provide convenience for the customers. However, PIN code is the only acceptable alternative for the WAP channel, and is not considered to provide good enough security (i.e., longer PINs (6 or 8 digit PINs) would be more secure than 4-digit PINs).</li><li>Additionally, when PIN is used for authentication over the phone, the risk of eavesdropping the telephone line is a supplementary threat, especially since it cannot be encrypted.</li></ul></td></tr></tbody></table>

## Step 2: Connecting the tasks' scenarios with the related usability criteria and factors

Let us consider the task scenario detailed in the previous step to illustrate the applicability of the usability factors and their corresponding criteria using MTM tasks.
Table 4 illustrates the procedure to adopt for connecting the tasks scenarios to the related usability criteria and factors.

<table><caption>**Table 4.** Mapping the tasks' scenarios to the nine usability factors and eight usability criteria</caption><thead><tr><th rowspan="2">Task Scenario</th><th rowspan="2">Security Problem/Threat</th><th rowspan="2">Measurable Usability Criterion</th><th colspan="8">USABILITY FACTORS</th></tr><tr><th>Efficiency</th><th>Satisfaction</th><th>Productivity</th><th>Learnability</th><th>Safety</th><th>Trustfulness</th><th>Accessibility</th><th>Universality</th><th>Usefulness</th></tr></thead><tbody><tr><td>Authenticate user to a system</td><td>- Storage of Information<br>- Replay attacks<br>- Eavesdrop-ping<br>- Session hi-jacking<br>- Man-in-the-middle<br>- Verifier im-personation.</td><td>Minimal Action</td><td>●</td><td>●</td><td></td><td>●</td><td></td><td>●</td><td></td><td></td><td></td></tr></tbody></table>

In addition, for measurement purpose QUIM suggested 127 measures for usability factors [18]. However, other measures can be used for measuring such factors, such as those proposed in ISO 25022 [10]. For example, the efficiency can be measured, by measuring how cost-effective is the user, using the following formula:

$$X = TE / C$$

Where TE is the task effectiveness, which refers to whether the task is executed correctly or not, and C is the total cost of the task, where costs could, for example, include the user's time, the time of others giving assistance, and the cost of computing resources.

### Step 3: Applying the usability security inspection method

Based on discussion in section 3 (step 3), we have identified examples of the security and usability review questions in order to generate the usability security inspection method checklist (see Table 5).
<table><caption>**Table 5.** An example of the usable security inspection method checklist</caption><thead><tr><th colspan="8">Usable Security Inspection Method</th></tr><tr><th colspan="8">Usability Criteria: Security</th></tr><tr><th colspan="8">Description: Capability of the application to protect information and data so that unauthorized persons or systems cannot read or modify them and authorized persons or systems are not denied access</th></tr><tr><th>#</th><th>Usability Review</th><th colspan="2">Occurrence</th><th>Comments</th><th>Security Review</th><th colspan="2">Occurrence</th><th>Comments</th></tr></thead><tbody><tr><td>1.1</td><td>When using different communication channels, is PIN authentication used (i.e., when accessing MTM, Web, and WAP: PINs are easier to remember)?</td><td>Y</td><td>N</td><td>Y / N</td><td>-----</td><td>Y</td><td>N</td><td>Y / N</td><td>It needs system review to be able to implement it.</td></tr><tr><td colspan="10"><sup>1</sup> Long PINs give stronger security, but bad usability because the PIN is harder to remember and takes longer to type.</td></tr><tr><td colspan="10"><sup>2</sup> With enough memory and/or a crypto processor</td></tr><tr><td colspan="10"><sup>3</sup> This would provide a higher level of security but lower system response time and thereby usability. The risk of eavesdropping the telephone network is a real threat, especially since it cannot be encrypted.</td></tr></tbody></table>

From the generated checklist, we have identified security problems, their severity rates and recommendations to resolve them (see Table 6).

<table><caption>**Table 6.** An example of security problems related to the security usability criteria</caption><thead><tr><th>Problem Description</th><th>Usability Criteria</th><th>Severity Rate</th><th>Security Issue</th><th>Interdependencies</th><th>Recommendations</th></tr></thead><tbody><tr><td>Unsafe PIN length (Security review1.1)</td><td>Security</td><td>Major</td><td>A MTM machine relies on short, low-entropy PINs for authentication. A four-digit PIN can be broken in less than a second, and a 6-digit PIN in about 10 seconds, while a 10-digit PIN would likely take weeks to crack.</td><td>Performance, efficiency.</td><td>(ISO 9564-1:2002) allows for PINs from 4 up to 12 digits, but also notes that for usability reasons, an assigned numeric PIN should not exceed six digits in length. So ideally, use PINs with a large number of digits for instance a 6-digit PIN.</td></tr></tbody></table>

## 5 Conclusion

This paper presents a methodological approach for measuring usable security conflicts while featuring how to supplement tasks models with measures for access control services in the cloud. A practical contribution is the use of such approach for the evaluation of access control security services in the context of cloud. The enhanced task models with measures aimed at detailing the interrelationships and conflicts between security
and usability. In comparison with the existing models for designing usable security authentication mechanisms (such as [15]), the approach introduces clear steps to improve the usability of user authentication and access control services in the cloud. An important aspect is that the methodology does not only point out general security and usability recommendations, but specifies explicitly how a compromise can be established when these two key factors come into conflict.

## REFERENCES

[1] Azuma, M., 1996. Software products evaluation system: quality models, metrics and processes—International Standards and Japanese practice. Information and Software Technology 38, 3, 145-154.

[2] Beckerle, M. and Martucci, L.A., 2013. Formal definitions for usable access control rule sets from goals to metrics. In Proceedings of the Ninth Symposium on Usable Privacy and Security ACM, 2.

[3] Braz, C., Seffah, A., and Naqvi, B., 2018. Integrating a Usable Security Protocol into User Authentication Services Design Process, CRC Press, Boca Raton, FL 33487, USA.

[4] Card, S.K., Newell, A., and Moran, T.P., 1983. The psychology of human-computer interaction.

[5] Cranor, L.F. and Garfinkel, S., 2005. Security and usability: designing secure systems that people can use. " O'Reilly Media, Inc.".

[6] Forget, A., Chiasson, S., and Biddle, R., 2015. Choose Your Own Authentication. In Proceedings of the 2015 New Security Paradigms Workshop ACM, 1-15.

[7] Hausawi, Y.M. and Allen, W.H., 2015. Usable-Security Evaluation. In Human Aspects of Information Security, Privacy, and Trust Springer, 335-346.

[8] Hausawi, Y.M., Allen, W.H., and Bahr, G.S., 2014. Choice-based authentication: A usable-security approach. In Universal Access in Human-Computer Interaction. Design and Development Methods for Universal Access Springer, 114-124.

[9] Hayashi, E., Das, S., Amini, S., Hong, J., and Oakley, I., 2013. CASA: context-aware scalable authentication. In Proceedings of the Ninth Symposium on Usable Privacy and Security ACM, 3.

[10] ISO/IEC, 2014. ISO/IEC 27000: Information technology -- Security techniques -- Information security management systems -- Overview and vocabulary. International Organization for Standardization.

[11] Jøsang, A., Zomai, M.A., and Suriadi, S., 2007. Usability and privacy in identity management architectures. In Proceedings of the fifth Australasian symposium on ACSW frontiers-Volume 68 Australian Computer Society, Inc., 143-152.

[12] Kainda, R., Flechais, I., and Roscoe, A., 2010. Security and usability: Analysis and evaluation. In Availability, Reliability, and Security, 2010. ARES'10 International Conference on IEEE, 275-282.

[13] Marinos, A. and Briscoe, G., 2009. Community cloud computing. In Cloud Computing Springer, 472-484.

[14] Nayak, S.K., Mohapatra, S., and Majhi, B., 2012. An improved mutual authentication framework for cloud computing. International Journal of Computer Applications 52, 5.

[15] Nielsen, J., 2000. Security & Human Factors. Available: https://www.nngroup.com/articles/security-and-human-factors/.

[16] Peffers, K., Tuunanen, T., Rothenberger, M.A., and Chatterjee, S., 2007. A design science research methodology for information systems research. Journal of management information systems 24, 3, 45-77.

[17] Salini, P. and Kanmani, S., 2012. Survey and analysis on security requirements engineering. Computers & Electrical Engineering 38, 6, 1785-1797.

[18] Seffah, A., Donyaee, M., Kline, R.B., and Padda, H.K., 2006. Usability measurement and metrics: A consolidated model. Software Quality Journal 14, 2, 159-178.

[19] Von Solms, B. and Von Solms, R., 2004. The 10 deadly sins of information security management. Computers & Security 23, 5, 371-376.

[20] Zhao, R. and Yue, C., 2014. Toward a secure and usable cloud-based password manager for web browsers. Computers & Security 46,10, 32-47.

[21] Faily, S., and Fléchais, I. 2016. Finding and resolving security mis-usability with mis-usability cases. Requirement Engineering 21, 2, 209-223.