TU Darmstadt / ULB / TUbiblio

Guiding Decisions on Authorization Policies: A Participatory Approach to Decision Support

Bartsch, Steffen ; Sasse, Angela
Hrsg.: Ossowski, Sascha ; Lecca, Paola (2012)
Guiding Decisions on Authorization Policies: A Participatory Approach to Decision Support.
Trento, Italy
doi: 10.1145/2245276.2232015
Konferenzveröffentlichung, Bibliographie

Kurzbeschreibung (Abstract)

<span style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12.8px; ">Most organizations have access control policies, and many have to change them frequently to get work done. Currently, the way such changes are made often has a significant impact on the organization's security, productivity, and employee satisfaction. Those who have to make the decisions are put on the spot, and depending on their perspective and circumstances, the decision is biased towards business or security interests. A decision support system for access control policies could mitigate these problems, but to be effective, such a system needs a significant amount of information about specific security and business risks and benefits, and collecting this information requires significant investment. In this paper, we present a participatory approach to collecting this information, which not only reduces cost, but increases effectiveness because it ensures that specific local knowledge and downstream risks are represented and visible to decision-makers. We evaluated our systematically developed decision-support prototype in formative evaluations with employees and decision-makers from a variety of backgrounds. We found that, among others, decision support is highly dependent on the organizational context and that the collected factors need to be contextualized for the contributing individuals.</span>

Typ des Eintrags: Konferenzveröffentlichung
Erschienen: 2012
Herausgeber: Ossowski, Sascha ; Lecca, Paola
Autor(en): Bartsch, Steffen ; Sasse, Angela
Art des Eintrags: Bibliographie
Titel: Guiding Decisions on Authorization Policies: A Participatory Approach to Decision Support
Sprache: Englisch
Publikationsjahr: 2012
Verlag: ACM
Buchtitel: Proceedings of the 27th Annual ACM Symposium on Applied Computing
Reihe: SAC '12
Veranstaltungsort: Trento, Italy
DOI: 10.1145/2245276.2232015
Zugehörige Links:
Kurzbeschreibung (Abstract):

<span style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12.8px; ">Most organizations have access control policies, and many have to change them frequently to get work done. Currently, the way such changes are made often has a significant impact on the organization's security, productivity, and employee satisfaction. Those who have to make the decisions are put on the spot, and depending on their perspective and circumstances, the decision is biased towards business or security interests. A decision support system for access control policies could mitigate these problems, but to be effective, such a system needs a significant amount of information about specific security and business risks and benefits, and collecting this information requires significant investment. In this paper, we present a participatory approach to collecting this information, which not only reduces cost, but increases effectiveness because it ensures that specific local knowledge and downstream risks are represented and visible to decision-makers. We evaluated our systematically developed decision-support prototype in formative evaluations with employees and decision-makers from a variety of backgrounds. We found that, among others, decision support is highly dependent on the organizational context and that the collected factors need to be contextualized for the contributing individuals.</span>

Freie Schlagworte: Security, Usability and Society;Secure Data
ID-Nummer: TUD-CS-2012-0046
Fachbereich(e)/-gebiet(e): LOEWE > LOEWE-Zentren > CASED – Center for Advanced Security Research Darmstadt
20 Fachbereich Informatik > SECUSO - Security, Usability and Society
20 Fachbereich Informatik > Theoretische Informatik - Kryptographie und Computeralgebra
Profilbereiche > Cybersicherheit (CYSEC)
LOEWE > LOEWE-Zentren
20 Fachbereich Informatik
Profilbereiche
LOEWE
Hinterlegungsdatum: 28 Jul 2016 18:35
Letzte Änderung: 30 Mai 2018 12:53
PPN:
Zugehörige Links:
Export:
Suche nach Titel in: TUfind oder in Google
Frage zum Eintrag Frage zum Eintrag

Optionen (nur für Redakteure)
Redaktionelle Details anzeigen Redaktionelle Details anzeigen