US4USec: A User Story Model for Usable Security

Constant integration of new technologies in our daily lives exposes us to various security threats. While numerous security solutions have been developed to protect us from these threats, they fail due to users’ insufficient comprehension of how to employ them optimally. This challenge often stems from inadequate capture of Usable Security (USec) requirements, leading to these requirements being overlooked or not properly considered in the final solution, resulting in barely usable security solutions. A viable solution is to adeptly capturing USec requirements. Although techniques like User Stories (US) have gained popularity for focusing on users’ needs, they encounter difficulties when dealing with non-functional requirements (NFR), like USec. This occurs due to the lack of well-defined US models explicitly tailored to address these particular requirements. This paper aims to tackle this issue by proposing US4USec, a US model tailored for USec. US4USec has been constructed based on best practices for the consideration and integration of NFR into US models that have been identified via a Systematic Literature Review (SLR). The coverage and completeness of US4USec have been demonstrated by applying it to a set of security US.