Five dimensions of information security awareness
ACM SIGCAS Computers and Society
Privacy and Rationality in Individual Decision Making
IEEE Security and Privacy
User experiences with sharing and access control
CHI '06 Extended Abstracts on Human Factors in Computing Systems
Over-exposed?: privacy patterns and considerations in online and mobile photo sharing
Proceedings of the SIGCHI Conference on Human Factors in Computing Systems
Communications of the ACM - The psychology of security: why do good users make bad decisions?
Research Methods for Human-Computer Interaction
Research Methods for Human-Computer Interaction
Folk models of home computer security
Proceedings of the Sixth Symposium on Usable Privacy and Security
Hi-index | 0.00 |
Most organizations have access control policies, and many have to change them frequently to get work done. Currently, the way such changes are made often has a significant impact on the organization's security, productivity, and employee satisfaction. Those who have to make the decisions are put on the spot, and depending on their perspective and circumstances, the decision is biased towards business or security interests. A decision support system for access control policies could mitigate these problems, but to be effective, such a system needs a significant amount of information about specific security and business risks and benefits, and collecting this information requires significant investment. In this paper, we present a participatory approach to collecting this information, which not only reduces cost, but increases effectiveness because it ensures that specific local knowledge and downstream risks are represented and visible to decision-makers. We evaluated our systematically developed decision-support prototype in formative evaluations with employees and decision-makers from a variety of backgrounds. We found that, among others, decision support is highly dependent on the organizational context and that the collected factors need to be contextualized for the contributing individuals.