UCL Discovery
UCL home » Library Services » Electronic resources » UCL Discovery

How Users Bypass Access Control and Why: The Impact of Authorization Problems on Individuals and the Organization

Bartsch, S; Sasse, MA; (2012) How Users Bypass Access Control and Why: The Impact of Authorization Problems on Individuals and the Organization. (Research Notes RN/12/06 ). UCL Department of Computer Science: London, UK. Green open access

[img] PDF
RN_12_06.pdf
Available under License : See the attached licence file.

Download (252kB)

Abstract

Many organizations struggle with ineffective and/or inefficient access control, but these problems and their consequences often remain invisible to security decision-makers. Prior research has focused on improving the policy-authoring part of authorization and does not show the full range of problems, their impact on organizations, and underlying causes. We present a study of 118 individual's experiences of authorization measures in a multi-national company and their self-reported subsequent behavior. We follow the recent advances in applying economic models to security usability and analyze the interrelations of authorization issues with individuals' behaviors and organizational goals. Our results indicate that authorization problems significantly impact the productivity and effective security of organizations. From the data, we derive authorization Personas and their daily problems, which are to a large extent caused by the procedures for policy changes and the decision-making, and lead to the circumvention of the measure. As one research contribution, we develop a holistic model of authorization problems. More practically, we recommend to monitor non-compliance, such as password-sharing, for indications of authorization problems, and to establish light-weight procedures for policy changes with adequate degrees of centralization and formalization, and support for decision-making.

Type: Report
Title: How Users Bypass Access Control and Why: The Impact of Authorization Problems on Individuals and the Organization
Open access status: An open access version is available from UCL Discovery
Language: English
Additional information: © University College London 2012
UCL classification: UCL
UCL > Provost and Vice Provost Offices
UCL > Provost and Vice Provost Offices > UCL BEAMS
UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science
UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science > Dept of Computer Science
URI: https://discovery.ucl.ac.uk/id/eprint/1389948
Downloads since deposit
394Downloads
Download activity - last month
Download activity - last 12 months
Downloads by country - last 12 months

Archive Staff Only

View Item View Item