Eliciting Persona Characteristics forRisk-based Decision Making
111

2

3

Andrew M’manga , Shamal Faily , John McAlaney , Chris Williams , Youki Kadobayashi and Daisuke Miyamoto
1
Bournemouth University
Poole, UK{ammanga, sfaily, jmcalaney}@bournemouth.ac.uk
2
Defence Science and Technology Laboratory
Porton Down, UK
cwilliams@mail.dstl.gov.uk
3
Nara Institute of Science and Technology
Nara, Japan{youki-k, daisu-mi}@is.naist.jp

3

Personas are behavioural specifications of archetypical users in Human Factors Engineering and User Interaction
research aimed at preventing biased views system designers may have of users. Personas are therefore nuanced
representations of goals and expectations that should be addressed when designing systems. Previous work has
shown how personas may be validated by grounding in qualitative models; however, more evidence is needed on
the applicability for grounding models in risk decision making research. We present an approach for eliciting
persona characteristics for risk-based decision making by using Observe Orient Decide Act (OODA) as a modellingbaseline. The approach illustrates how modelling personas based on decision makers’ understanding of risk
facilitates designing for risk and uncertainty.
User-centred design, Personas, Risk-based decision making, Security

1. INTRODUCTION

that decision making is an iterative process. While
RRP facilitates the understanding of RBDM, it isindividually not sufficient for eliciting and specifying
design requirements for RBDM. In summary, RRP
comprises the following eight steps:

Risk-based decision making (RBDM) is explained
as an attempt to make informed decisions underconditions of risk and uncertainty. In cyber security
risks are unwanted outcomes resulting fromthreats, while uncertainty may be characterised bytime limitations, insufficient information, andconstantly changing environments. Understandingrisk-based decision making is a step towards theidentification of design requirements that would
facilitate decision making under risk and uncertainconditions. To achieve this, research techniquesmust be capable of complementing the differences
between system design and risk-based decision
making methods.

1) Situation Assessment
How may the situational be understood?
2) Goal formation
What is the goal(s)?
3) Information exploration
Which information is relevant for decision
making?
4) Information needs assessment
Where can additional decision making
information be sourced?

2. BACKGROUND
2.1 Risk Rationalisation Process

5) Information limitations analysis
What remains unknown?

The Risk Rationalisation Process (RRP) (M’manga,2018) was devised to communicate the rationale
behind RBDM. The Risk Rationalisation Processbuilds on Boyd’s (1996) Observe Orient Decide Act
model (OODA) by describing decision making
factors that go beyond OODA’s situation
awareness focus. This includes recognising thatdecisions are products of multiple weighed andvalidated options, decisions are goal driven, and© 2018 M’manga et al.
Published by BCS Learning andDevelopment Ltd. Proceedings of British
HCI 2018. Belfast, UK.

6) Options generation
What are the alternative decision options
and their implications?
7) Options validation
Where could assumptions be incorrect?
8) Option selection

1

Eliciting person characteristics for risk-based decision making
Andrew M’manga ● Shamal Faily ● John McAlaney ● Chris Williams ● Youki Kadobayashi ● Daisuke Miyamoto

The most informed and objective option isput forward as the basis for a decision.

The Risk Rationalisation Process has seven steps
from Situation assessment to Option validation thatoutlines
anormative
approachtorisk
rationalisation. Option selection, the final step in
RRP was intentionally left out as it is only a productand not a risk rationalisation facilitator. On the other
hand, the argumentation model only has the three
key parts; claim, grounds, and warrants. Randomly
matching the two methods had a high likelihood of
producing redundant or inconsistent persona
characteristics. For examples, information identified
during Information limitations analysis could also
appear during Option validation as a reason for
selecting one option over another.

2.2 Personas
Personas are an archetypical representation oftarget users, that represent user requirements inuser centred design (Cooper et al., 2014). As arepresentation of a group of target users, theirformulation is a result of thematic refinement from auser behaviour corpus. Personas are defined bytheir characteristics which typically include;
activities, attitudes, aptitudes, motivations, andskills.
The authenticity and use of personas have
however been called to question (Chapman andMilham, 2006), citing a lack of traceability between
persona and source data. However, some of thearguments posed by the critics have no bearing.
For example, the expectation that two separate
teams working on the same data should arrive at
identical personas is an impossibility. The nature ofqualitative research is not to produce exact
replicable results, but provide consistency(Carcary, 2009). In regards to traceability, Faily &Fléchais (2011) have demonstrated how Toulmin’sargumentation model (claims, grounds, warrants)(Toulmin, 2003) can validate the grounding ofpersona characteristics in source data.

To overcome this problem, we analysed RRP andcategorised it into the three groups of Assessment;
steps related to situation understanding, Goals;
steps related to option selection, and Validation;
steps related to verification (see Figure 1). These
were then mapped to claim, grounds, and warrants
respectively.

To illustrate; Ben, a Penetration tester persona, has
the characteristic (claim) “ethics is a passed on
soft-skill that pen testers are obliged to pick up”.
This is validated by the respective grounds “need tounderstand client’s business to avoid conflict withIT”; these grounds are connected to thecharacteristic with the warrant “pen testing industry
dies if people lose faith in what we do”. Both thegrounds and warrant are traceable to empirical
data (Faily, 2018).

Figure 1: Categorisation of RRP

3.2 Persona characteristics elicitation
The second part of our approach took the form of apersona characteristics elicitation exercise aimed atvalidating the RRP to persona mapping, andadditional validation for RRP’s risk-based decision
making facilitation.
The elicitation exercise was carried out in Japan
with a group of 30 industrial participants
undertaking a cybersecurity course. Cybersecurity
was chosen as its activities exemplify RBDM inaction. Participants were drawn from 11 different
sectors including Transport, Oil, Electricity andManufacturing, with experience ranging from 1 to
20 years.

Given that personas are an established techniqueduring the early stages of design, our research
aimed at exploring the question; how might
persona characteristics be grounded in risk-based
decision making research (data)?
3. APPROACH

Participants were trained on RRP and thenprovided with a cybersecurity decision making
scenario containing elements of risk anduncertainty (see Figure 3). Participants were thenasked to come up with a solution and provide arationale for their decisions using RRP. Responses
obtained were categorised as assessment, goals,and validation (explained in Section 3.1), thesewere then thematically analysed for clusters of risk
rationalisation variables using the qualitative data
analysis tool; Nvivo. Following the RRP to persona
mapping, we used the Persona Case technique(Faily & Fléchais, 2011) to elicit behaviour

3.1 Risk rationalisation process to persona
mapping
Our approach was to first identify ways of relating
RRP to personas validated by the argumentation
model (Toulmin, 2003). By doing this, elicited
persona characteristics addressing risk anduncertainty would both be authentic, traceable toempirical data, stand up to validation, andgrounded in rationale risk-based decision makingdata.

2Eliciting person characteristics for risk-based decision making
Andrew M’manga ● Shamal Faily ● John McAlaney ● Chris Williams ● Youki Kadobayashi ● Daisuke Miyamotovariables; these were exported to a spreadsheet
andcategorised
according
toToulmin’s
argumentation model. Finally, the spreadsheet wasimported into CAIRIS (Computer Aided Integrationof Requirements and Information Security), a tool

supporting the Persona Case technique, andcapable of supporting argumentation models for.

Figure 2: Persona modelling flow

persona modelling (Faily, 2018b). Figure 2
summarises the persona characteristics elicitation
flow from scenario to persona formulationassessment on the use of the Shinkansen
as an information transfer alternative.
•

4.2 Persona characteristics facilitation

Figure 3: Problem scenario

The second part of the findings relates to validating
the mapping from RRP to persona characteristics.

4. FINDINGS

Fourteen RBDM persona characteristics (claims)
were elicited for a persona (Rio), each withsupporting grounds and warrants. As an example,
the characteristic “Enquire on business partner’s
security capabilities” indicated that the participants
were willing to negotiate lesser secure transmission
options as grounds to the warrant “Transfercompatibility”. The finding hints on a need toestablishing procedures for the selection of lesser
secure information transmission options. Figure 4
illustrates this characteristic as modelled in CAIRIS.

4.1 Decision making facilitation
The first part of the findings relates to RRP’s
capability in facilitating RBDM.
•Out of the 30 participants, 28 successfully
used RRP to illustrate the rationale behind
their decision.

•Participants found that the hypotheticalnature of the scenario made identifying
limitations in their rationale hard. Identifying
limitations is an expectation in the twovalidation steps; Information limitation
analysis and Option validation. Further
investigations will be required with actualscenarios.

•A commonly proposed solution to thescenario was the use of the Shinkansen(bullet train) as a physical transferalternative. This illustrates the influencenational\geographic factors have on theparticipant’s perception of risk, as it would
be an unlikely option in other countries.
Putting the finding in perspective could
imply carrying out a comprehensive risk

While RRP has Situation assessment as afirst step, findings have shown that this is
only applicable to Reactive risk analysis.
Proactive risk analysis (illustrated in thescenario) inverts the first two steps, starting
from
Goal
formation
toSituationassessment. The reasoning behind this isthat the goal prompting risk assessment
precedes the risk encounter during
proactive analysis.

Figure 4: Persona characteristic argumentation modelin CAIRIS

3

Eliciting person characteristics for risk-based decision making
Andrew M’manga ● Shamal Faily ● John McAlaney ● Chris Williams ● Youki Kadobayashi ● Daisuke Miyamoto

5. CONCLUSION AND FUTURE WORK

7. REFERENCES

In this paper, we presented a method for eliciting
persona characteristics for risk-based decision
making by adapting techniques familiar to UX (Userexperience design) researchers and Human
Factors engineers.

Boyd, J. (1996) The essence of winning and losing.
Unpublished lecture notes.
Carcary, M. (2009) The Research Audit Trial–
Enhancing Trustworthiness in Qualitative Inquiry.
Electronic Journal of Business Research
Methods, 7, pp. 11-24.

The premise of the method is to use personas infacilitating the specification of requirements during
the early stages of design for risk-based decision
making.
We
demonstrated
methodsfor
authenticating and validating personas by proving
traceability to empirical data, and by grounding
characteristics in justified risk decision making. Our
method focuses on eliciting characteristics for riskbased decision making. It does not, however,preclude the use of complementary methods fordesigning a well-rounded persona.

Chapman, C. and Milham, R. (2006) The personas’
new clothes: methodological and practicalarguments against a popular method. In:Proceedings of the human factors andergonomics society annual meeting. SAGEPublications, 50, pp. 634–636.
Cooper, A., Reimann, R., Cronin, D., and Noessel,C. (2014) About face: The essentials ofinteraction design. John Wiley & Sons.

For future work, the personas will be re-framed asa goal model. Goal modelling is used inRequirements Engineering for specifying andnegotiating requirements. Additional studies will
also be conducted to further identify how RRP cansupport design for risk-based decision making.

Faily, S. (2018) Ben and Matt [online], Available
from: https://cairis.org/ben_matt/ [Accessed 13May 2018].
Faily, S. (2018b) Designing Usable and Secure
Software with IRIS and CAIRIS. Springer.
Faily, S., and Flechais, I. (2011) Persona cases: atechnique for grounding personas. Proceedingsof the SIGCHI Conference on Human Factors in
Computing Systems, Vancouver Canada, pp.
2267–2270, ACM.

6. ACKNOWLEDGEMENT
The research was funded by Bournemouth
University
studentship
DSTLX1000104780R_BOURNEMOUTH_PhD_RB
DM, with the initial collaborative meeting between
UK/Japan researchers facilitated by support fromthe Great Britain Sasakawa Foundation. We arealso grateful to DSTL for their sponsorship of thiswork.

M’manga, A. (2018) Risk Rationalisation Process.
[online].
Availablefrom:https://doi.org/10.5281/zenodo.1255383.
Toulmin, S. (2003) The uses of argument.
Cambridge University Press, Cambridge U.K.

4