Mental Models – General Introduction and Review of Their Application to Human-Centred Security

Abstract

The human-centred security research area came into being about fifteen years ago, as more and more people started owning their own computers, and it became clear that there was a need for more focus on the non-specialist computer user. The primary attitude fifteen years ago, in terms of how these new users were concerned, was one of exasperation and paternalism. The term "stupid user" was often heard, often muttered sotto voce by an IT specialist dealing with the aftermath of a security incident. A great deal of research has been published in this area, and after pursuing some unfruitful avenues a number of eminent researchers have started to focus on the end-user's perceptions and understandings. This has come from a realisation that end users are not the opponents, but rather allies in the battle against those carrying out nefarious activities. The most promising research direction currently appears to be to focus on mental models, a concept borrowed from the respected and long-standing field of Psychology and, in particular, cognitive science. The hope is that if we understand the end-user and his/her comprehension of security better, we will be able to design security solutions and interactions more effectively. In this paper we review the research undertaken in this area so far, highlight the limitations thereof, and suggest directions for future research.

Why Doesn’t Jane Protect Her Privacy?

“…In the literature there are similar findings that people are more aware of privacy violations than of any other type of violations [47]. Few people mentioned specific aspects such as integrity and availability in a study into online security understanding [19].…”

How Influential Are Mental Models on Interaction Performance? Exploring the Gap between Users’ and Designers’ Mental Models through a New Quantitative Method

“…The theory of mental models has obscure origins [4,5], but the notion of mental models first appeared in a book written by the psychologist Craik. Craik [6] believed that a brain could translate an external process into a model of the world, which is "a small-scale model of external reality and of its own possible actions within the head."…”

“…General techniques to elicit individuals' mental models and team members' shared mental models were summarized in three comprehensive review papers [25][26][27]. Specifically, in the field of HCI, techniques to elicit mental models have four major categories: (1) verbalization through interview, thinking aloud, laddering and so forth: verbalization is the most widely used elicitation technique [5]. However, people's verbalization was inconsistent and tended to evolve as they spoke [28,29].…”

Is It Still Where I Expect It?—Users’ Current Expectations of Interface Elements on the Most Frequent Types of Websites

“…One drawback of the online survey used here was that it included many elements and website types, meaning that participants could not be asked why they placed each interface element in a certain location without the following drawbacks: they would be pulled out of their task which could increase the time spent filling in the survey and in turn could increase the number of dropouts. Furthermore, asking participants to sketch a prototypical website can result in users drawing how they imagine a website or how they would wish an ideal website to be (Volkamer and Renaud, 2013). Second, the generalizability of our results is to a certain extent limited by the focus on three website types only.…”