Publications

Displaying 1 - 25 of 60

Report on the Design-A-Thon: Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness

September 3, 2025

Author(s)

Michael Fagan, Julie Haney, Daniel Eliot, Barbara Cuthill, Kristina Rigopoulos

This report documents the first SOUPS Design-A-Thon, which was held on August 11th, 2024, and focused on Designing Effective and Accessible Approaches for Digital Product Cybersecurity Education and Awareness. In total, eight individuals participated in

Smart Home Users' Security and Privacy Perceptions and Actions Differ by Device Category: Results from a U.S. Survey

June 21, 2025

Author(s)

Julie Haney, Yasemin Acar, Anna Li, Faith Haney

There are few insights into how users' perspectives on smart home security and privacy differ depending on device category. This may leave the smart home community at a disadvantage in knowing how to focus user education efforts to address device-specific

"A five-year-old could understand it" versus "This is way too confusing": Exploring Non-expert Understandings and Perceptions of Cybersecurity Definitions

April 28, 2025

Author(s)

Lorenzo Neil, Charlotte Healy, Julie Haney

Experts struggle with explaining cybersecurity in a language and tone appropriate for non-expert audiences. This communication gap may make it difficult for a broad and diverse audience to fully engage in cybersecurity. Fundamental forms of communication

Workshop Summary Report for ConnectCon 2024: "Minding the Gaps in Human-Centered Cybersecurity"

April 7, 2025

Author(s)

Julie Haney, Matthew Canham, Mike Elkins, Lisa Flynn, Matthew Gordin, Victoria Granova, Wenjing Huang, Jody Jacobs, Greg Moody, Ann Rangarajan, Michael Ross, Robert Thomson, Joe Uchill

In August 2024, the National Institute of Standards and Technology (NIST) co-sponsored ConnectCon, an interactive workshop that facilitated meaningful conversations and connections between researchers and practitioners on the topic of human-centered

Perspectives on E2EV: Results from Interviews with Election Experts

January 14, 2025

Author(s)

Kristen Greene, Shanee Dawkins, Julie Haney, Mary Theofanos, Jody Jacobs, Sandra Spickard Prettyman, Kristin L. K. Koskey

Leveraging the Human Factors Discipline for Better Cybersecurity Outcomes: A Roundtable Discussion

December 1, 2024

Author(s)

Margaret Cunningham, Calvin Nobles, Nikki Robinson, Julie Haney

"The Human Factor" department co-editor Julie Haney recently spoke with three human factors experts to get to the bottom of what the oft-misunderstood human factors discipline actually is, how the cybersecurity community and organizations can benefit from

From Compliance to Impact: Tracing the Transformation of an Organizational Security Awareness Program

November 26, 2024

Author(s)

Julie Haney, Wayne Lutters

There is a growing recognition of the need for a transformation from organizational security awareness programs focused on compliance  measured by training completion rates  to those resulting in behavior change. However, few researchers or practitioners

Towards Bridging the Research-Practice Gap: Understanding Researcher-Practitioner Interactions and Challenges in Human-Centered Cybersecurity

June 13, 2024

Author(s)

Julie Haney, Clyburn Cunningham, Susanne Furman

Human-centered cybersecurity (HCC) researchers seek to improve people's experiences with cybersecurity. However, a disconnect between researchers and practitioners, the research-practice gap, can prevent the application of research into practice. While

From Ivory Tower to Real World: Building Bridges Between Research and Practice in Human-Centered Cybersecurity

March 21, 2024

Author(s)

Julie Haney

Research insights critical to improving people's cybersecurity experiences and outcomes may not be integrated into practice, demonstrating the often-observed and dreaded "research-practice gap." This talk will describe recent NIST research efforts to

Towards Integrating Human-Centered Cybersecurity Research Into Practice: A Practitioner Survey

January 30, 2024

Author(s)

Julie Haney, Clyburn Cunningham, Susanne M. Furman

The "research-practice gap" can prevent the appli- cation of valuable research insights into practice. While the gap has been studied in several fields, it is unclear if prior findings and recommendations apply to human-centered cybersecurity (HCC), which

Tradeoffs, Transparency, and Shared Responsibility: Exploring Users' Perceptions of Smart Home Security and Privacy in the U.S.

December 13, 2023

Author(s)

Julie Haney

Smart home technology may expose adopters to increased risk to network security, information privacy, and physical safety. However, users of this technology may lack understanding of the privacy and security implications, and manufacturers often fail to

Cybersecurity Definitions for Non-Experts

August 6, 2023

Author(s)

Lorenzo Neil, Julie Haney, Kerrianne Buchanan, Charlotte Healy

Despite the importance of cybersecurity, there is no standard definition nor common terminology for explaining cybersecurity. Existing definitions largely target academics or technical experts but not non-experts (those without cybersecurity proficiency)

Mind the Gap: Exploring Human-Centered Security Researcher-Practitioner Interactions (Extended Abstract)

August 6, 2023

Author(s)

Clyburn Cunningham, Susanne M. Furman, Julie Haney

Our work-in-progress study aims to develop an understanding of current researcher-practitioner interaction points and associated challenges throughout the entire human-centered security research life cycle.

Measuring the Effectiveness of U.S. Government Security Awareness Programs: A Mixed-Methods Study

July 31, 2023

Author(s)

Jody Jacobs, Julie Haney, Susanne M. Furman

This paper presents our research from our mixed-methods study analyzing how organizations determine security awareness program effectiveness. This paper is being submitted to the 10TH International Conference on HCI in Business, Government and

Data Guardians: Behaviors and Challenges While Caring for Others' Personal Data

July 23, 2023

Author(s)

Julie Haney, Sandra Prettyman, Mary Frances Theofanos, Susanne M. Furman

Many professional domains require the collection and use of personal data. Protecting systems and data is a major concern in these settings, necessitating that workers who handle personal data under- stand and practice good security and privacy habits

Smart Home Device Loss of Support: Consumer Perspectives and Preferences

July 23, 2023

Author(s)

Julie Haney, Susanne M. Furman

Unsupported smart home devices can pose serious safety and security issues for consumers. However, unpatched and vulnerable devices may remain connected because consumers may not be alerted that their devices are no longer supported or do not understand

Analyzing Cybersecurity Definitions for Non-experts

July 4, 2023

Author(s)

Lorenzo Neil, Julie Haney, Kerrianne Buchanan

There is no standard definition for cybersecurity, with current definitions often being technically-complex and targeted at practitioners and academics. However, non-experts (those who do not have security expertise) need an understandable definition to

IoT Cybersecurity Labels: Lessons Learned When Applying Human-Centered Research to Practice

May 23, 2023

Author(s)

Julie Haney

This presentation will describe the development of consumer-focused IoT cybersecurity label criteria in response to a U.S. Presidential Executive Order. The talk will include a discussion of the value of leveraging human-centered IoT research insights

User Perceptions and Experiences with Smart Home Updates

May 22, 2023

Author(s)

Julie Haney, Susanne M. Furman

Updates may be one of the few tools consumers have to mitigate security and privacy vulnerabilities in smart home devices. However, little research has been undertaken to understand users' perceptions and experiences with smart home updates. To address

Users Are Not Stupid: Six Cyber Security Pitfalls Overturned

March 16, 2023

Author(s)

Julie Haney

The skilled and dedicated professionals who strive to improve cyber security may unwittingly fall victim to misconceptions and pitfalls that hold customers and users back from reaching their full potential of being active partners in security. These

Compliance or Impact? Insights into How U.S. Government Organizations Determine the Effectiveness of Security Awareness Programs

March 2, 2023

Author(s)

Julie Haney, Jody Jacobs, Susanne M. Furman

The goal of security awareness programs is to positively influence employee security behaviors. However, organizations in compliance-focused sectors may struggle to determine program effectiveness, often relying on training completion rates rather than

Guest Editor Introduction: IEEE Security & Privacy Special Issue "Usable Security and Privacy for Security and Privacy Workers"

February 4, 2023

Author(s)

Julie Haney, Mary Ellen Zurko

This special issue facilitates a dialog between researchers and practitioners toward informing the development of tools, techniques, and other support mechanisms that are valuable to security and privacy workers, leading to more usable, secure, and privacy

Handout: Users Are Not Stupid: 6 Cybersecurity Pitfalls Overturned

January 30, 2023

Author(s)

Julie Haney, Susanne M. Furman

The cybersecurity community tends to focus and depend on technology to solve today's cybersecurity problems, often without taking into consideration the human element - the key individual and social factors impacting cybersecurity adoption. This handout

Federal Cybersecurity Role-Based Training Approaches, Successes, and Challenges

January 11, 2023

Author(s)

Jody Jacobs, Julie Haney, Susanne M. Furman

This Special Publication details our research exploring cybersecurity role-based training for those who for individuals who are assigned management, operational, and technical roles having security and privacy responsibilities.

Purdue CERIAS Presentation: Users Are Not Stupid: Six Cybersecurity Pitfalls Overturned

December 7, 2022

Author(s)

Julie Haney

Whether you're implementing security policy or developing products, considering the human element is critical. Yet security professionals often fall victim to misconceptions and pitfalls that undermine users' ability to reach their full security potential

Search Publications by: Julie Haney (Fed)