Contextual design: defining customer-centered systems
Contextual design: defining customer-centered systems
CCS '99 Proceedings of the 6th ACM conference on Computer and communications security
On SDSI's linked local name spaces
Journal of Computer Security
Personal Servers as Digital Keys
PERCOM '04 Proceedings of the Second IEEE International Conference on Pervasive Computing and Communications (PerCom'04)
Field studies of computer system administrators: analysis of system management tools and practices
CSCW '04 Proceedings of the 2004 ACM conference on Computer supported cooperative work
Security in the wild: user strategies for managing security as an everyday, practical problem
Personal and Ubiquitous Computing
Distributed Proving in Access-Control Systems
SP '05 Proceedings of the 2005 IEEE Symposium on Security and Privacy
Secrecy, flagging, and paranoia: adoption criteria in encrypted email
Proceedings of the SIGCHI Conference on Human Factors in Computing Systems
Understanding SPKI/SDSI using first-order logic
International Journal of Information Security
SOUPS '06 Proceedings of the second symposium on Usable privacy and security
Sabbath day home automation: "it's like mixing technology and religion"
Proceedings of the SIGCHI Conference on Human Factors in Computing Systems
Towards understanding IT security professionals and their tools
Proceedings of the 3rd symposium on Usable privacy and security
Proceedings of the SIGCHI Conference on Human Factors in Computing Systems
Expandable grids for visualizing and authoring computer security policies
Proceedings of the SIGCHI Conference on Human Factors in Computing Systems
A case study of enterprise identity management system adoption in an insurance organization
Proceedings of the Symposium on Computer Human Interaction for the Management of Information Technology
Exploring reactive access control
CHI '10 Extended Abstracts on Human Factors in Computing Systems
Role-based differentiation for insider detection algorithms
Proceedings of the 2010 ACM workshop on Insider threats
Infringo ergo sum: when will software engineering support infringements?
Proceedings of the FSE/SDP workshop on Future of software engineering research
Heuristics for evaluating IT security management tools
Proceedings of the Seventh Symposium on Usable Privacy and Security
Relating declarative semantics and usability in access control
Proceedings of the Eighth Symposium on Usable Privacy and Security
Physical access control administration using building information models
CSS'12 Proceedings of the 4th international conference on Cyberspace Safety and Security
Privacy management in dynamic groups: understanding information privacy in medical practices
Proceedings of the 2013 conference on Computer supported cooperative work
Combining social authentication and untrusted clouds for private location sharing
Proceedings of the 18th ACM symposium on Access control models and technologies
Formal definitions for usable access control rule sets from goals to metrics
Proceedings of the Ninth Symposium on Usable Privacy and Security
Privacy practices in collaborative environments: a study of emergency department staff
Proceedings of the 17th ACM conference on Computer supported cooperative work & social computing
| Hi-index | 0.01 |
In this work we ask the question: what are the challenges of managing a physical or file system access-control policy for a large organization? To answer the question, we conducted a series of interviews with thirteen administrators who manage access-control policy for either a file system or a physical space. Based on these interviews we identified three sets of real-world requirements that are either ignored or inadequately addressed by technology: 1) policies are made/implemented by multiple people; 2) policy makers are distinct from policy implementers; and 3) access-control systems don't always have the capability to implement the desired policy. We present our interview results and propose several possible solutions to address the observed issues.