Usable security involves designing security measures that accommodate users’ needs and behaviors. Balancing usability and security poses challenges: the more secure the systems, the less usable they will be. On the contrary, more usable systems will be less secure. Numerous studies have addressed this balance. These studies, spanning psychology and computer science/engineering, contribute diverse perspectives, necessitating a systematic review to understand strategies and findings in this area. This systematic literature review examined articles on usable security from 2005 to 2022. A total of 55 research studies were selected after evaluation. The studies have been broadly categorized into four main clusters, each addressing different aspects: (1) usability of authentication methods, (2) helping security developers improve usability, (3) design strategies for influencing user security behavior, and (4) formal models for usable security evaluation. Based on this review, we report that the field’s current state reveals a certain immaturity, with studies tending toward system comparisons rather than establishing robust design guidelines based on a thorough analysis of user behavior. A common theoretical and methodological background is one of the main areas for improvement in this area of research. Moreover, the absence of requirements for Usable security in almost all development contexts greatly discourages implementing good practices since the earlier stages of development.

Knowing about a danger is not enough to avoid it. Our daily lives offer countless examples of occasions in which we act imprudently for various reasons, even though we know we are taking risks. Nevertheless, circumstances in which we lack the necessary knowledge can lead us to run into unpleasant or harmful situations without being aware of it. In cybersecurity, knowledge of the dangers (as well as the mechanics of a possible attack) makes a huge difference. This is why specific training is provided in organizations, along with awareness campaigns. However, security training is often generic, boring, and a mere fulfillment of obligations rather than a tool for behavioral change. Today, we can deliver content through various devices and platforms that people access for both work and leisure, so that learning can happen incidentally and with almost no effort. Distributing knowledge in small, dedicated units creates the conditions for lasting, effective learning and is more effective than teaching through traditional courses (whether delivered in-person or online). In this article, we present an ongoing project on cybersecurity informal learning, including the design of a small video game. The intervention is aimed at helping young adults (18–25 years) to understand the mechanics of cookies and their role in the dynamics of cyberattacks. Consistent with the idea that a comprehensive course may be unsuitable for delivering cybersecurity training, the game covers and deliberately limits itself to that topic only. We also provide detailed considerations related to the evaluation of its effectiveness, although this is outside the scope of the present paper.

The usability/security trade-off indicates the inversely proportional relationship that seems to exist between usability and security. The more secure the systems, the less usable they will be. On the contrary, more usable systems will be less secure. So far, attempts to reduce the gap between usability and security have been unsuccessful. In this paper, we offer a theoretical perspective to exploit this tradeoff rather than fight it, as well as a practical approach to the use of contextual improvements in system usability to reward secure behavior. The theoretical perspective, based on the concept of reinforcement, has been successfully applied to several domains, and there is no reason to believe that the cybersecurity domain will represent an exception. Although the purpose of this article is to devise a research agenda, we also provide an example based on a single-case study where we apply the rationale underlying our proposal in a laboratory experiment.

Knowledge of possible cyber threats as well as awareness of appropriate security measures plays a crucial role in the ability of individuals to not only discriminate between an innocuous versus a dangerous cyber event, but more importantly to initiate appropriate cybersecurity behaviors. The purpose of this study was to construct a Cybersecurity Awareness INventory (CAIN) to be used as an instrument to assess users’ cybersecurity knowledge by providing a proficiency score that could be correlated with cyber security behaviors. A scale consisting of 46 items was derived from ISO/IEC 27032. The questionnaire was administered to a sample of college students (N = 277). Based on cybersecurity behaviors reported to the research team by the college’s IT department, each participant was divided into three groups according to the risk reports they received in the past nine months (no risk, low risk, and medium risk). The ANOVA results showed a statistically significant difference in CAIN scores between those in the no risk and medium-risk groups; as expected, CAIN scores were lower in the medium-risk group. The CAIN has the potential to be a useful assessment tool for cyber training programs as well as future studies investigating individuals’ vulnerability to cyberthreats.

Fatigue in air traffic management (ATM) is a well-recognized safety concern. International organizations like ICAO and EASA have responded by advocating for fatigue risk management systems (FRMSs). EU Regulation 2017/373, implemented in January 2020, mandates specific requirements for air traffic service providers (ANSPs) regarding controller fatigue, stress, and rostering practices. These regulations are part of broader safety management protocols. Despite ongoing efforts to raise awareness about fatigue in ATC, standardized operational requirements remain elusive. To address this gap, Eurocontrol recently published “Guidelines on fatigue management in ATC rostering systems” (23 April 2024). This initiative aims to facilitate the adoption of common fatigue management standards across operations. However, neither EU Regulation 2017/373 nor existing documentation provides definitive rostering criteria. ANSPs typically derive these criteria from a combination of scientific research, best practices, historical data, and legal and operational constraints. Assessing and monitoring fatigue in the real-world ATC setting is complex. The multifaceted nature of fatigue makes it difficult to study, as it is influenced by many factors including sleep quality, circadian rhythms, psychosocial stressors, individual differences, and environmental conditions. Long-term studies are often required to fully understand these complex interactions. This paper presents two case studies that attempt to create an evidence-based protocol for fatigue risk monitoring in ATC operations. These studies utilize a non-invasive approach and collect multidimensional data. The cases involved en-route and tower (TWR) controllers from different ATC centers. The results highlight the importance of fatigue assessment in ATC and shed light on the challenges of implementing fatigue monitoring systems within operational environments.

Procrastination may be seen as the outcome of a learning history of delaying the onset of task execution and its completion, both in terms of time and effort. In this study, we examined the performance of 55 university students who carried out two writing tasks consisting of summarizing two academic papers, each within a different time slot (i.e., five vs. three days to complete). The two assignments were part of the class activity and were perceived by participants as homogeneous in terms of text appreciation and difficulty, therefore making the two conditions comparable. The Pure Procrastination Scale was used to categorize subjects as high and low procrastinators, and to compare their performances. Results show that students who report more procrastination behaviors tend to increase their productivity as the deadline approaches, while low procrastinators are more productive throughout the time at their disposal, with peak activity during the intermediate day. Such a strategy was consistent across two deadlines (five vs. three days), and the difference between the two subgroups can be ascribed to the task-oriented coping style, which seems to be lacking in high-procrastinators.