Institutional Research Information Service
UCL Logo
Please report any queries concerning the funding data grouped in the sections named "Externally Awarded" or "Internally Disbursed" (shown on the profile page) to your Research Finance Administrator. Your can find your Research Finance Administrator at https://www.ucl.ac.uk/finance/research/rs-contacts.php by entering your department
Please report any queries concerning the student data shown on the profile page to:

Email: portico-services@ucl.ac.uk

Help Desk: http://www.ucl.ac.uk/ras/portico/helpdesk
Publication Detail
How users bypass access control and why: the impact of authorization problems on individuals and the organization
  • Publication Type:
  • Authors:
    Bartsch S, Sasse MA
  • Publisher:
    UCL Department of Computer Science
  • publication date:
  • Place of publication:
    London, UK
  • Report number:
  • Status:
  • Series name:
    Research Notes
Many organizations struggle with ineffective and/or inefficient access control, but these problems and their consequences often remain invisible to security decision-makers. Prior research has focused on improving the policy-authoring part of authorization and does not show the full range of problems, their impact on organizations, and underlying causes. We present a study of 118 individual's experiences of authorization measures in a multi-national company and their self-reported subsequent behavior. We follow the recent advances in applying economic models to security usability and analyze the interrelations of authorization issues with individuals' behaviors and organizational goals. Our results indicate that authorization problems significantly impact the productivity and effective security of organizations. From the data, we derive authorization Personas and their daily problems, which are to a large extent caused by the procedures for policy changes and the decision-making, and lead to the circumvention of the measure. As one research contribution, we develop a holistic model of authorization problems. More practically, we recommend to monitor non-compliance, such as password-sharing, for indications of authorization problems, and to establish light-weight procedures for policy changes with adequate degrees of centralization and formalization, and support for decision-making.
Publication data is maintained in RPS. Visit https://rps.ucl.ac.uk
 More search options
UCL Researchers
Dept of Computer Science
University College London - Gower Street - London - WC1E 6BT Tel:+44 (0)20 7679 2000

© UCL 1999–2011

Search by