Guidelines

← Back

These Inclusive Security Guidelines translate findings from the literature review, WCAG 2.2 accessible authentication, and the STRIDE/LINDDUN threat modelling into practical design recommendations for authentication and account recovery experiences for users with Multiple Sclerosis (MS).

Download Guidelines

Two versions are available depending on your needs.

Full Academic Guidelines

Detailed guideline set mapped to STRIDE, LINDDUN, and WCAG 2.2. Recommended for marking and technical review.

Download PDF Download DOCX

Practitioner Quick Guide

Plain-language summary for healthcare professionals, charities, and non-academic stakeholders.

Download PDF Download DOCX
How to use these guidelines: These guidelines are intended to support designers, developers, and security practitioners in evaluating and improving authentication and account recovery systems. They should be applied alongside existing security best practices, with particular attention to users experiencing cognitive, motor, or sensory impairments such as those associated with Multiple Sclerosis.

Guideline Sections

  • Use plain language and short instructions (avoid jargon).
  • Avoid memory-heavy steps (e.g., “recall a password hint”).
  • Minimise time pressure and allow retry without penalty.

  • Prefer phishing-resistant methods (e.g., passkeys) where possible.
  • Provide alternatives to transcription-heavy 2FA (avoid long code entry).
  • Support assistive tech and clear focus order / keyboard navigation.

  • Offer multiple recovery routes (email + device approval, not CAPTCHA-only).
  • Use consistent, supportive error messages and clear next steps.
  • Use adaptive rate limiting (avoid harsh lockouts for repeated mistakes).

  • Use uniform responses to prevent account detectability (no enumeration).
  • Explain what happens after login/recovery in simple language.
  • Minimise personal data collected and displayed in alerts.
↑ Return to top