Granularity and Usability in Authorization Policies

Abstract

Emerging security systems need to carefully reconcile usability considerations in their design. In this context, we address authorization policies, which are used to limit the actions a principal may exercise on a resource. We compare two designs from the standpoint of the ease with which such policies can be devised and expressed. The two designs we consider are read-write-execute policies in UNIX, which was designed many decades ago, and identity-based policies in Amazon Web Services (AWS), which is a modern system. These can be seen, in the evolution of such designs, as two extremes—in the former, only the three actions read, write and execute are allowed in an authorization policy; in the latter, more than a thousand actions are allowed. While a richer set of actions lends to finer-grained authorization policies, the question we pose is: are such policies easier to formulate? Our question is important because a trend in the design of such policy languages in real systems over the years has been to enrich the set of actions. For a meaningful comparison between the two extremes, we design an overlay authorization policy syntax for AWS that allows the three actions read, write and execute only. We then describe our design of an ethics-approved, human participants study to assess whether a richer set of actions indeed results in better usability, and our results from carrying out the study. Using carefully chosen statistical methods that are appropriate for our study, we find that there is indeed evidence that allowing for a richer set of actions lends to better usability. Our work has significant implications to design in emerging security systems that seek to reconcile usability.

Portions of this work were supported via grants from the Natural Sciences and Engineering Research Council of Canada (NSERC) and Mitacs, Canada.