🔧 How User Capabilities Influence Secure Design

Developers must research and understand their target audience before designing security features. The capabilities and experience of end users directly determine which security features to include, how complex they should be, and how they are presented.

📖 Designing for Different User Groups

User Group	Capabilities / Experience	How This Influences Secure Design
Children (under 13)	Cannot assess risk. Share passwords freely. Do not understand privacy implications.	Parental controls, restricted sharing, no public profiles by default, COPPA compliance. Roblox hides personal info by default for under-13 accounts.
Elderly / low tech literacy	Unfamiliar with security concepts. Struggle with complex passwords. Highly susceptible to phishing.	Biometric login (fingerprint/face), large clear security prompts, simplified 2FA (push notification instead of codes), automatic security updates. Banking apps use fingerprint login.
General consumers	Moderate tech skills. Use multiple apps daily. Reuse passwords. May ignore updates.	Password strength meters, breach notification popups, auto-save to password manager prompts, forced HTTPS. Instagram shows "suspicious login" alerts with location.
Professionals (healthcare, finance)	Domain experts but not IT experts. Need fast access under pressure. Handle sensitive data daily.	Smart card / badge authentication, role-based access (nurse vs doctor vs admin), session timeouts with quick re-auth, audit logging. Hospital systems use tap-and-go badge login.
IT administrators	Deep technical knowledge. Manage security policies for entire organisations.	Granular permission controls, SSH key authentication, API access with scoped tokens, detailed audit logs, CLI tools, MFA with hardware keys (YubiKey).