Secure-by-Design Product Experience Engineering: Integrating User Research, Interaction Design, Usability Evaluation, and Cybersecurity Requirements Across the Product Development Lifecycle
DOI:
https://doi.org/10.63282/3050-9262.IJAIDSML-V7I4P102Keywords:
Secure-by-Design, Product Experience Engineering, User Research, Interaction Design, Usability Evaluation, Cybersecurity Requirements, Human-Centered SecurityAbstract
In modern digital products, usability, user trust, privacy, and cybersecurity are tightly intertwined. Product Experience Engineering and cybersecurity are typically handled as separate processes, though, and cybersecurity requirements are added at the end of the development process or usability requirements are not considered when implementing security. This paper introduces a conceptual framework of Secure-by-Design Product Experience Engineering that can be applied in the product development lifecycle by integrating UX research, interaction design, usability evaluation, and cybersecurity requirements. The approach is designed to provide a seamless link between user behavior and expectations, security and privacy, interaction needs, and system needs, while assessing the product experience in a realistic context of use. User research reveals patterns of user behavior, user expectations, trust factors, accessibility requirements, and security concerns from user interactions. In this framework, insights are intended to be translated into security-sensitive workflows, understandable authentication processes, clear permission models, feedback mechanisms, and privacy-sensitive interaction patterns. Usability evaluation is applied throughout various stages to check for learnability, efficiency, error prevention, cognitive load, and understanding of security-related interactions. At the same time, security needs are not considered as post-development implementation requirements, which is intended to allow potential security conflicts to be detected with user experience at an earlier stage. The framework also highlights the iterative process of validation, in which the results of assessments of the usability requirements and needs, along with user feedback, guide further design decisions. This paper introduces Secure-by-Design Product Experience Engineering (PXE), a conceptual framework derived through a structured integrative review and framework synthesis of empirical and normative evidence for integrating UX research, interaction design, usability evaluation, and cybersecurity requirements across the product development lifecycle. The resulting framework provides organizations with a structured and testable basis for integrating security, usability, and user-centered design as complementary engineering goals throughout the product lifecycle, while empirical validation of the PXE framework remains future work.
References
[1] J. H. Saltzer and M. D. Schroeder, "The protection of information in computer systems," Proc. IEEE, vol. 63, no. 9, pp. 1278–1308, Sep. 1975, doi: 10.1109/PROC.1975.9939.
[2] D. Balfanz, "In search of usable security: Five lessons from the field," IEEE Security & Privacy, vol. 2, no. 5, pp. 19–24, Sep./Oct. 2004, doi: 10.1109/MSP.2004.71.
[3] F. Mathis, K. Vaniea, and M. Khamis, "Prototyping usable privacy and security systems: Insights from experts," Int. J. Human–Computer Interaction, vol. 38, no. 5, pp. 468–490, 2022, doi: 10.1080/10447318.2021.1949134.
[4] T. R. Schorlemmer, K. G. Kalu, L. Chigges, K. M. Ko, E. A. Isghair, S. Bagchi, S. Torres-Arias, and J. C. Davis, "Signing in four public software package registries: Quantity, quality, and influencing factors," in Proc. 2024 IEEE Symp. Security and Privacy (SP), 2024, doi: 10.1109/SP54263.2024.00215.
[5] F. Sharevski, A. Trowbridge, and J. Westbrook, "Novel approach for cybersecurity workforce development: A course in secure design," in Proc. 2018 IEEE Integrated STEM Education Conf. (ISEC), 2018.
[6] Y. Valdés-Rodríguez, J. Hochstetter-Diez, J. Díaz-Arancibia, and R. Cadena-Martínez, "Towards the integration of security practices in agile software development: A systematic mapping review," Applied Sciences, vol. 13, art. no. 4578, 2023.
[7] J. Boyens, A. Smith, N. Bartol, K. Winkler, A. Holbrook, and M. Fallon, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, NIST SP 800-161r1-upd1, May 2022, includes updates as of Nov. 1, 2024.
[8] European Parliament and Council of the European Union, "Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) No 168/2013 and Regulation (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)," Official Journal of the European Union, 2024.
[9] ETSI, "CYBER; Cyber Security for Consumer Internet of Things: Baseline Requirements," ETSI EN 303 645 V3.1.3, Sep. 2024.
[10] CISA et al., "Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software," TLP:CLEAR.
[11] M. Fagan, K. Megas, P. Watrobski, J. Marron, and B. Cuthill, Profile of the IoT Core Baseline for Consumer IoT Products, NIST IR 8425, Sep. 2022.
[12] Joint Task Force, Assessing Security and Privacy Controls in Information Systems and Organizations, NIST SP 800-53A Rev. 5, Jan. 2022.
[13] Joint Task Force, Security and Privacy Controls for Information Systems and Organizations, NIST SP 800-53 Rev. 5, Sep. 2020.
[14] NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST Cybersecurity White Paper (CSWP) 29, Feb. 26, 2024.
[15] NIST, NIST Privacy Framework: A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0, NIST CSWP 01162020, Jan. 16, 2020.
[16] D. Temoshok, J. L. Fenton, Y.-Y. Choong, N. Lefkovitz, A. Regenscheid, R. Galluzzo, and J. P. Richer, Digital Identity Guidelines: Authentication and Authenticator Management, NIST SP 800-63B-4, Jul. 2025.
[17] R. Ross, V. Pillitteri, R. Graubart, D. Bodeau, and R. McQuaid, Developing Cyber-Resilient Systems: A Systems Security Engineering Approach, NIST SP 800-160, Vol. 2 Rev. 1, Dec. 2021.
[18] R. Ross, M. Winstead, and M. McEvilley, Engineering Trustworthy Secure Systems, NIST SP 800-160, Vol. 1 Rev. 1, Nov. 2022.
[19] M. Souppaya, K. Scarfone, and D. Dodson, Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities, NIST SP 800-218, Feb. 2022.
[20] NIST Information Technology Laboratory, Human-Centered Cybersecurity Guidelines and Resources Concept Paper, Aug. 12, 2026.
[21] A. Bouhoula, K. Kubicek, A. Zac, C. Cotrini, and D. Basin, "Automated large-scale analysis of cookie notice compliance," in Proc. 33rd USENIX Security Symp., 2024.
[22] J. Amador, Y. Ma, S. Hasama, E. Lumba, G. Lee, and E. Birrell, "Prospects for improving password selection," in Proc. 19th Symp. Usable Privacy and Security (SOUPS), 2023, pp. 263–282.
[23] S. Zibaei, A. Salehi-Abari, and J. Thorpe, "Dissecting nudges in password managers: Simple defaults are powerful," in Proc. 19th Symp. Usable Privacy and Security (SOUPS), 2023, pp. 211–225.
[24] I. C. Ngong, B. Stenger, J. P. Near, and Y. Feng, "Evaluating the usability of differential privacy tools with data practitioners," in Proc. 20th Symp. Usable Privacy and Security (SOUPS), 2024.
[25] H. Habib, M. Li, E. Young, and L. F. Cranor, "'Okay, whatever': An evaluation of cookie consent interfaces," PrivacyCon, 2022.
[26] H. Habib and L. F. Cranor, "Evaluating the usability of privacy choice mechanisms," in Proc. 18th Symp. Usable Privacy and Security (SOUPS), 2022, pp. 273–289.
[27] L. Lassak, E. Pan, B. Ur, and M. Golla, "Why aren't we using passkeys? Obstacles companies face deploying FIDO2 passwordless authentication," in Proc. 33rd USENIX Security Symp., 2024, pp. 7231–7248.
[28] L. Lassak, N. Lindemann, and M. Kowalewski, "From TOTPs to security keys: Studying the reality of passwordless FIDO2 authentication with PIN and biometrics in a corporate environment," in Proc. 21st Symp. Usable Privacy and Security (SOUPS), 2025, pp. 371–389.
[29] K. Sowon, C. W. Munyendo, L. Klucinec, E. Maingi, G. Suleh, L. F. Cranor, G. Fanti, C. Tucker, and A. Gueye, "Design and evaluation of privacy-preserving protocols for agent-facilitated mobile money services in Kenya," in Proc. 21st Symp. Usable Privacy and Security (SOUPS), 2025, pp. 391–413.
[30] I. Keswani, K. Walker, A. Clement, E. Kitur, N. Wonghirundacha, R. Aubrey, V. Song, and E. Birrell, "User understandings of technical terms in app privacy labels," in Proc. 21st Symp. Usable Privacy and Security (SOUPS), 2025.
[31] F. Herbert, C. W. Munyendo, J. Hielscher, S. Becker, and Y. Zou, "Digital security perceptions and practices around the world: A WEIRD versus non-WEIRD comparison," in Proc. 34th USENIX Security Symp., 2025.
[32] A. Polamarasetty, L. M. Tanczer, E. Costanza, and K. Chetty, "Usability determines safety for at-risk users: Evaluating hidden device detectors for intimate partner surveillance," in Proc. 22nd Symp. Usable Privacy and Security (SOUPS), 2026.
[33] L. M. Abels, M. Smith, and A.-M. Ortloff, "I never reuse passwords! Development and validation of a security and privacy social desirability scale (SP-SDS) for end users without a background in computer science," in Proc. 21st Symp. Usable Privacy and Security (SOUPS), 2025, pp. 415–434.
[34] A. Buckmann, J. M. Nold, Y. Acar, and Y. Zou, "More than usability: Differential access to digital security and privacy," in Proc. 21st Symp. Usable Privacy and Security (SOUPS), 2025, pp. 455–474.
[35] D. Lawo, J. Hindrichs, and G. Stevens, "Who can actually follow IT-security advice? Exploring the usability of IT-security advice," in Proc. 22nd Symp. Usable Privacy and Security (SOUPS), 2026, pp. 685–704.
