Formal Mental Models for Human-Centered Cybersecurity
Adam M. Houser,Matthew L. Bolton,Adam M. HouserMatthew L. Boltona Johns Hopkins University Applied Physics Laboratory,Laurel,MD,USAb Department of Systems and Information Engineering,University of Virginia,Charlottesville,VA,USAAdam M. Houser received the Ph.D. in industrial engineering from the State University of New York at Buffalo in Buffalo,New York,USA in 2018. Since then,he has worked at the Johns Hopkins University Applied Physics Laboratory as a senior systems engineer.Matthew Bolton is an Associate Professor of Systems and Information Engineering at the University of Virginia. He obtained his Ph.D. in Systems Engineering from UVA in 2010. He previously held academic appointments at the University of Illinois in Chicago and the University at Buffalo.
DOI: https://doi.org/10.1080/10447318.2024.2314353
IF: 4.92
2024-03-08
International Journal of Human-Computer Interaction
Abstract:Human users are increasingly recognized as a vector of cybersecurity attack. One problem that contributes to this condition is the growing complexity of digital tools. Such complexity can make it difficult for users to understand how tools work and how their actions will impact security. This work sought to answer the research question: Can mental modeling analyses (from human factors engineering and human-automation interaction) be developed to effectively discover cybersecurity risks? To answer this, we extend mental models with cybersecurity-specific concepts. The resulting models are then incorporated into model checking analyses (an automated approach to formal verification) to discover if and when mismatches between human mental models and systems can cause security failures. We evaluated our approach by successfully applying it to a case study regarding the security configuration of a popular cloud data storage service. We ultimately discuss the results of this analysis and outline future research possibilities.
computer science, cybernetics,ergonomics