Human-centered design is a creative approach to problem-solving. It is a process that puts the people you are designing for, along with their needs, attitudes, experiences, and beliefs, at the center. In human-centered design, the audience is usually referred to as the user.

The process culminates in the creation of a new solution that has been tailored to the needs, attitudes, experiences, and beliefs of the recipient.

This is only possible by focusing on the user, empathy, active listening, and then generating ideas and building lots of prototypes.

Relevant links: Ideo > Tools (https://www.ideo.org/tools);

Design Kit > What is Human-Centered Design? (https://www.designkit.org/human-centered-design)

The human-centered design consists of three phases:

	The phase when you observe the people you are designing for, do research, and explore needs.
	The phase when you use the knowledge you have gathered to generate ideas, create new possibilities, prototypes, and solutions.
	The phase when you bring your solution to life, test, and gather feedback

How will you know that the solution is indeed human-centered design?

If the people you want to create for have been at the center of the process all along, and the final solution meets their needs, then it is definitely human-centered design

But what about the company's priorities?

After all, every company has its own priorities. Not all of them coincide with what the user wants. What do you run your business for?

Do you want a stable life, a good income, or maybe you want to pursue your dreams? Whatever it is, there's nothing wrong with putting your business priorities and your team, not the user, at the center.

So is human-centered design a utopia?

No. Today's business must take care of the user, and human-centered design is one of the most effective ways to do that. However, running a business is not a "users or me" choice. 

Are you asking yourself who is more important: the user or you? Human-centered design  or company priorities? 

Well, it's a no-win dilemma. 

Without the user, there is no company. Without your company, there is no product, service, or user. You should strike a balance and take care of yourself as well.

In the following section, you'll find guidelines for using human-centered design in the context of cybersecurity, without compromising your company's priorities.

As we said, human-centered design is successful mostly thanks to empathizing with the user. People need your attention, need to feel the company cares about them and their values. So let's think about those values. 

Most users need to feel safe in the online environment. Remember that pandemic has caused that millions of new people start to work, buy and communicate online. So for them, the online environment is something new, they need to feel safe more than others. Their trust in your company on the Internet may be much more fragile than those who are used to e-commerce. 

So what you need is to build a safe website, platform and/ or software for your users. You must find all bugs as soon as possible — here you can use human-centered design.

Where to start?

Use the model of a bug bounty program.
 

A bug bounty is a program offered by many companies, websites, organizations, and software developers. It relies on end-users to recognize bugs (especially those concerning security exploits and vulnerabilities) and report them to admins. 

This kind of program helps the company to test their products more thoroughly. Even if the company hires professional Quality Assurance personnel usually not every detail or combination can be tested before the release. More tests mean more efficiency in discovering and resolving bugs before the general public is aware of them, also, preventing abuses and hacking.

What you may create your bug bounty program for? And when?

While launching an online product, website, or software, think about creating a bug bounty program. Of course, it is advisable that the bug bounty program is supplementary to other forms of quality assurance done before the release.

However, one or even a few people can't find everything in a short time. Remember that an employee or a B2B specialist is an additional cost for your company. You can optimize time and costs by opening the bug bounty program.

To run a bug bounty program you need to establish:
	categories of bugs to report		channel of communication for sending reports
	a relevant bounty		bounty policy

How to create categories of bugs and relevant bounties?

There is no one method of creating bugs' categories and assigning bounties. Everything depends on your product, website, software, and content. Take a look at a case study.

Website: www.aswatson.com

A.S. Watson opened a bug bounty program in July 2020. The goal is to make sure that the company's more popular retail websites and mobile apps are secure.

A.S. Watson Group has posted information about its program on HackerOne: https://hackerone.com/watson_group?type=team&view_policy=true

A.S. Watson Group operating model

Establishing product categories

The company divided the websites and apps that were included in the program into 2 categories. Next, it gave one a higher priority than the other.
 

Establishing bug categories

Not all bugs are equally important to a business, so it is important to prioritize them clearly. A.S. Watson Group has divided bugs into 4 categories: 

	low
	medium		more important
	high
	critical

Establishing bounties

A.S. Watson Group gives rewards in the mentioned 2 product categories and according to the bug category. The amount per reported bug is $100-4000. Look at the table below.
 

According to data on the HackerOne website, the bug bounty program has already helped the company to resolve 60 problems reported. The average amount per reported bug is $250.

Establishing clear channels and rules of communication

The HackerOne website is a platform for companies to engage with the ethical hacking community.

So A.S. Watson Group doesn't need to establish special communication channels because the platform itself already provides them.

A.S. Watson Group takes full advantage of HackerOne's platform options: adding updates, notifications of changes, and showcasing the ranking of top hacks. Also, its page informs potential applicants of this:
 

	how long they have to wait for the first response from the company
	how long it takes to process reports
	how long applicants have to wait for their prize
	how long it takes to implement improvements

What are the benefits to the company?

		A.S. Watson Group's operating model is simple and transparent, enhancing the company's overall credibility.
		The company is able to test its websites and apps more often thanks to a well-organized, professional community.
		Thanks to the ethical hacking community, the company can identify many more bugs in a shorter time compared to testing everything by an in-house tester.
		Creating a specific table with product and bug categories attracts process-oriented people.
		Attractive reward encourages goal-oriented people.
		Interesting content and/ or unusual products attract creative people.

What are the benefits of an ethical hacking community?

		Hackers do what they are good at.
		They get paid for their work.
		If they have a deep sense of meaning, they feel that they contribute to the company, product, service, and industry through this work.
		They contribute to increasing cyber security.
		They contribute to improving websites and applications.
		They protect the general public from potential threats.
		They can build their portfolio.

It looks like a win-win scenario.

Certainly, A.S. Watson Group cares about cyber security through its bug bounty program. Where's the human-centered design?

A.S. Watson Group's bug bounty program is a perfect example of a balance between corporate priorities and human-centered design. Why? Let's take a look. 

What may be the highest priority of the A.S. Watson Group?
Probably it is a better quality of their websites and apps, higher income, bigger audience.
 

What will the company achieve thanks to ethical hacking?
A safer online environment for the general public.
 

So who is in the center of the company's interests?
User. That's why we can say it is human-centered design.

There is no single way to create a good bug bounty program, and there are no exact rules for giving bounties or categorizing bugs. That's why you should look for inspiration on websites where big companies like Aliexpress, Android, Deutsche Telekom (T-mobile), and Google announce their programs.

Check for example:

HackerOne: https://hackerone.com/bug-bounty-programs

BugCrowd: https://www.bugcrowd.com/bug-bounty-list/#accept