Methodology

1. Research Approach

This project adopted a qualitative, design-oriented methodology to investigate how cybersecurity threat modelling can be adapted to better support users with Multiple Sclerosis (MS) during authentication and account recovery tasks.

Rather than quantitatively measuring attack likelihood or system performance, the research focused on how accessibility barriers may indirectly introduce security and privacy risks. This approach was chosen because the project aimed to explore the relationship between accessibility, usability, and cybersecurity rather than assess technical infrastructure or production-scale performance.

The methodology combined threat modelling, inclusive design principles, prototype development, and expert evaluation to investigate how accessible authentication systems can be designed without weakening security.

2. System Scope and Modelling Strategy

The project focused on four user-facing security processes commonly found within authentication systems:

• User registration and credential creation
• Login and authentication
• Account recovery and passphrase reset
• Session and security state management

A System Context Diagram was created to identify system actors, trust boundaries, and external dependencies involved in these workflows.

This was followed by a Level 1 Data Flow Diagram (DFD), which modelled processes, data stores, and authentication-related data flows. These diagrams provided the structural foundation for subsequent threat modelling.

3. Threat Modelling Frameworks

Two complementary threat modelling frameworks were used:

STRIDE was applied to identify security threats such as:

• Spoofing and phishing
• Information disclosure
• Denial of service and lockout scenarios
• Privilege escalation and session abuse

LINDDUN was applied to identify privacy threats including:

• Detectability and account enumeration
• Linkability and identifiability
• Information disclosure
• User unawareness and transparency issues

Combining STRIDE and LINDDUN supported analysis of both security and privacy risks within authentication and recovery workflows.

4. Inclusive Adaptation for MS-Related Barriers

Traditional threat modelling frameworks typically assume a generic user. This project introduced an inclusive lens to better account for challenges experienced by users living with MS.

Accessibility barriers considered included:

• Cognitive fatigue: reduced tolerance for complex or repetitive tasks
• Memory difficulties: challenges with recall-based authentication
• Reduced processing speed: difficulty responding to time-limited interactions
• Motor impairments: barriers caused by precise or repetitive input requirements
• Error recovery barriers: increased likelihood of lockout or abandonment

Rather than viewing these solely as usability concerns, this project treated them as factors capable of increasing security and privacy risk.

5. Prototype Development

Findings from the threat modelling process were translated into a set of Inclusive Security Guidelines, which informed the design and implementation of a functional web-based prototype.

The prototype implemented:

• Registration workflow
• Login and authentication workflow
• Account recovery workflow
• Passphrase and passkey authentication options
• Privacy-preserving recovery mechanisms

The prototype was designed as a research demonstrator rather than production-ready software, prioritising interaction design, accessibility, and secure workflow design.

6. Evaluation Strategy

The prototype was evaluated through expert review involving participants from cybersecurity, accessibility, and healthcare backgrounds.

Evaluation methods included:

• System Usability Scale (SUS)
• Heuristic evaluation
• Open-ended qualitative feedback

Evaluation focused on usability, clarity, accessibility, and perceived balance between security, privacy, and inclusive design.