Bartsch, S;
Sasse, MA;
(2012)
How Users Bypass Access Control and Why: The Impact of Authorization Problems on Individuals and the Organization.
(Research Notes
RN/12/06
).
UCL Department of Computer Science: London, UK.
![]() |
PDF
RN_12_06.pdf Available under License : See the attached licence file. Download (252kB) |
Abstract
Many organizations struggle with ineffective and/or inefficient access control, but these problems and their consequences often remain invisible to security decision-makers. Prior research has focused on improving the policy-authoring part of authorization and does not show the full range of problems, their impact on organizations, and underlying causes. We present a study of 118 individual's experiences of authorization measures in a multi-national company and their self-reported subsequent behavior. We follow the recent advances in applying economic models to security usability and analyze the interrelations of authorization issues with individuals' behaviors and organizational goals. Our results indicate that authorization problems significantly impact the productivity and effective security of organizations. From the data, we derive authorization Personas and their daily problems, which are to a large extent caused by the procedures for policy changes and the decision-making, and lead to the circumvention of the measure. As one research contribution, we develop a holistic model of authorization problems. More practically, we recommend to monitor non-compliance, such as password-sharing, for indications of authorization problems, and to establish light-weight procedures for policy changes with adequate degrees of centralization and formalization, and support for decision-making.
Type: | Report |
---|---|
Title: | How Users Bypass Access Control and Why: The Impact of Authorization Problems on Individuals and the Organization |
Open access status: | An open access version is available from UCL Discovery |
Language: | English |
Additional information: | © University College London 2012 |
UCL classification: | UCL UCL > Provost and Vice Provost Offices UCL > Provost and Vice Provost Offices > UCL BEAMS UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science > Dept of Computer Science |
URI: | https://discovery.ucl.ac.uk/id/eprint/1389948 |
Archive Staff Only
![]() |
View Item |