research-article

More than skin deep: measuring effects of the underlying model on access-control system usability

Authors:

Robert W. Reeder,

Lorrie F. Cranor,

Michael K. Reiter,

Kami VanieaAuthors Info & Claims

CHI '11: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems

Pages 2065 - 2074

https://doi.org/10.1145/1978942.1979243

Published: 07 May 2011 Publication History

Abstract

In access-control systems, policy rules conflict when they prescribe different decisions (allow or deny) for the same access. We present the results of a user study that demonstrates the significant impact of conflict-resolution method on policy-authoring usability. In our study of 54 participants, varying the conflict-resolution method yielded statistically significant differences in accuracy in five of the six tasks we tested, including differences in accuracy rates of up to 78%. Our results suggest that a conflict-resolution method favoring rules of smaller scope over rules of larger scope is more usable than the Microsoft Windows operating system's method of favoring deny rules over allow rules. Perhaps more importantly, our results demonstrate that even seemingly small changes to a system's semantics can fundamentally affect the system's usability in ways that are beyond the power of user interfaces to correct.

References

[1]

A. Adams and M. A. Sasse. Users are not the enemy. Communications of the ACM, 42(12):41--46, December 1999.

Digital Library

[2]

L. Bauer, L. F. Cranor, R. W. Reeder, M. K. Reiter, and K. Vaniea. A user study of policy creation in a flexible access-control system. ACM SIGCHI Conference on Human Factors in Computing Systems, pages 543--552, April 2008.

Digital Library

[3]

S. Brostoff, M. A. Sasse, D. Chadwick, J. Cunningham, U. Mbanaso, and S. Otenko. 'R-What?' Development of a role-based access control policy-writing tool for e-Scientists. Software Practice &#38; Experience, 35(9):835--856, June 2005.

Digital Library

[4]

X. Cao and L. Iverson. Intentional access management: Making access control usable for end-users. 2nd Symposium on Usable Privacy and Security, pages 20--31, 2006.

Digital Library

[5]

D. J. Dougherty, K. Fisler, and S. Krishnamurthi. Specifying and reasoning about dynamic access-control policies. 3rd International Joint Conference on Automated Reasoning, Lecture Notes in Computer Science, Vol. 4130, pages 632--646, August 2006.

Digital Library

[6]

K. Fisler and S. Krishnamurthi. A model of triangulating environments for policy authoring. 15th ACM Symp. on Access Control Models and Technologies, p. 3--12, June 2010.

Digital Library

[7]

I. Goldberg, D. Wagner, R. Thomas, and E. A. Brewer. A secure environment for untrusted helper applications: Confining the wily hacker. 6th USENIX Security Symposium, July 1996.

Digital Library

[8]

N. S. Good and A. Krekelberg. Usability and privacy: a study of Kazaa P2P file-sharing. ACM SIGCHI Conf. on Human Factors in Computing Systems, pages 137--144, April 2003.

Digital Library

[9]

P. Inglesant, M. A. Sasse, D. Chadwick, and L. L. Shi. Expressions of expertness: The virtuous circle of natural language for access control policy specification. 2008 Symposium on Usable Privacy and Security, July 2008.

Digital Library

[10]

S. Jajodia, P. Samarati, V. S. Subrahmanian, and E. Bertino. A unified framework for enforcing multiple access control policies. 1997 ACM SIGMOD International Conference on Management of Data, pages 474--485, 1997.

Digital Library

[11]

M. Johnson, S. M. Bellovin, R. W. Reeder, and S. E. Schechter. Laissez-faire file sharing: Access control designed for individuals at the endpoints. 2009 New Security Paradigms Workshop, pages 1--10, 2009.

Digital Library

[12]

A. Kapadia, G. Sampemane, and R. H. Campbell. KNOW why your access was denied: Regulating feedback for usable security. 11th ACM Conference on Computer and Communications Security, pages 52--61, 2004.

Digital Library

[13]

C.-M. Karat, C. Brodie, and J. Karat. Usability design and evaluation for privacy and security solutions. In L. F. Cranor and S. Garfinkel, editors, Security and Usability, chapter 4, pages 47--74. O'Reilly, Sebastopol, CA, 2005.

[14]

C.-M. Karat, J. Karat, C. Brodie, and J. Feng. Evaluating interfaces for privacy policy rule authoring. ACM SIGCHI Conference on Human Factors in Computing Systems, pages 83--92, 2006.

Digital Library

[15]

B. W. Lampson. Protection. Operating Systems Review, 8(1):18--24, January 1974.

Digital Library

[16]

R. A. Maxion and R. W. Reeder. Improving user-interface dependability through mitigation of human error. International Journal of Human-Computer Studies, 63(1--2):25--50, July 2005.

Digital Library

[17]

R. W. Reeder. Expandable Grids: A user interface visualization technique and a policy semantics to support fast, accurate security and privacy policy authoring. PhD thesis, Computer Science Department, Carnegie Mellon University, Pittsburgh, PA, May 2008. Available as technical report number Carnegie Mellon University-CS-08--143.

Digital Library

[18]

R. W. Reeder, L. Bauer, L. F. Cranor, M. K. Reiter, K. Bacon, K. How, and H. Strong. Expandable grids for visualizing and authoring computer security policies. ACM SIGCHI Conference on Human Factors in Computing Systems, pages 1473--1482, April 2008.

Digital Library

[19]

J. Rode, C. Johansson, P. DiGioia, R. S. Filho, K. Nies, D. H. Nguyen, J. Ren, P. Dourish, and D. Redmiles. Seeing further: Extending visualization as a basis for usable security. 2nd Symp. on Usable Privacy and Security, pages 145--155, 2006.

Digital Library

[20]

B. Shneiderman. Direct manipulation: A step beyond programming languages. Computer, 16(8):57--69, August 1983.

Digital Library

[21]

U.S. Senate Sergeant at Arms. Report on the investigation into improper access to the Senate Judiciary Committee's computer system. Available at http://judiciary.senate.gov/testimony.cfm?id=1085&#38;wit_id=2514, March 2004.

[22]

T. Whalen, D. Smetters, and E. F. Churchill. User experiences with sharing and access control. Conference on Human Factors in Computing Systems Extended Abstracts, pages 1517--1522, April 2006.

Digital Library

[23]

M. E. Zurko, R. Simon, and T. Sanfilippo. A user-centered, modular authorization service built on an RBAC foundation. 1999 IEEE Symposium on Security and Privacy, pages 57--71, May 1999.

[24]

M. E. Zurko and R. T. Simon. User-centered security. Workshop on New Security Paradigms, pages 27--33, Lake Arrowhead, CA, September 1996. Available at http://www.memesoft.com/adage/.

Digital Library

Cited By

Zhang SKlucinec LNorton KSadeh NCranor LKelley PKapadia A(2024)Exploring expandable-grid designs to make iOS app privacy labels more usableProceedings of the Twentieth USENIX Conference on Usable Privacy and Security10.5555/3696899.3696907(139-157)Online publication date: 12-Aug-2024
https://dl.acm.org/doi/10.5555/3696899.3696907
Obrezkov D(2024)Cognition Behind Access Control: A Usability Comparison of Rule- and Category-Based MechanismsICT Systems Security and Privacy Protection10.1007/978-3-031-65175-5_26(367-380)Online publication date: 26-Jul-2024
https://doi.org/10.1007/978-3-031-65175-5_26
Malkin NLuo APoveda JMazurek M(2023)Optimistic Access Control for the Smart Home2023 IEEE Symposium on Security and Privacy (SP)10.1109/SP46215.2023.10179475(3043-3060)Online publication date: May-2023
https://doi.org/10.1109/SP46215.2023.10179475
Show More Cited By

Index Terms

More than skin deep: measuring effects of the underlying model on access-control system usability

Index terms have been assigned to the content through auto-classification.

Recommendations

Exploring reactive access control
CHI '11: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems

As users store and share more digital content at home, access control becomes increasingly important. One promising approach for helping non-expert users create accurate access policies is reactive policy creation, in which users can update their policy ...
An authorization mechanism for a relational database system

A multiuser database system must selectively permit users to share data, while retaining the ability to restrict data access. There must be a mechanism to provide protection and security, permitting information to be accessed only by properly authorized ...
Access Control for Home Data Sharing: Attitudes, Needs and Practices
CHI '10: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems

As digital content becomes more prevalent in the home, non-technical users are increasingly interested in sharing that content with others and accessing it from multiple devices. Not much is known about how these users think about controlling access to ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

CHI '11: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems

May 2011

3530 pages

ISBN:9781450302289

DOI:10.1145/1978942

General Chair:
Desney Tan
Microsoft Research
,
Program Chairs:
Geraldine Fitzpatrick
Vienna University of Technology
,
Carl Gutwin
University of Saskatchewan
,
Bo Begole
PARC
,
Wendy A. Kellogg
IBM Research

Copyright © 2011 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

SIGCHI: ACM Special Interest Group on Computer-Human Interaction

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 07 May 2011

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Conference

CHI '11

Sponsor:

SIGCHI

CHI '11: CHI Conference on Human Factors in Computing Systems

May 7 - 12, 2011

BC, Vancouver, Canada

Acceptance Rates

CHI '11 Paper Acceptance Rate 410 of 1,532 submissions, 27%;

Overall Acceptance Rate 6,199 of 26,314 submissions, 24%

Upcoming Conference

CHI 2025

Sponsor:
sigchi

ACM CHI Conference on Human Factors in Computing Systems

April 26 - May 1, 2025

Yokohama , Japan

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

21
Total Citations
View Citations
503
Total Downloads

Downloads (Last 12 months)18
Downloads (Last 6 weeks)1

Reflects downloads up to 08 Mar 2025

Other Metrics

View Author Metrics

Citations

Cited By

Zhang SKlucinec LNorton KSadeh NCranor LKelley PKapadia A(2024)Exploring expandable-grid designs to make iOS app privacy labels more usableProceedings of the Twentieth USENIX Conference on Usable Privacy and Security10.5555/3696899.3696907(139-157)Online publication date: 12-Aug-2024
https://dl.acm.org/doi/10.5555/3696899.3696907
Obrezkov D(2024)Cognition Behind Access Control: A Usability Comparison of Rule- and Category-Based MechanismsICT Systems Security and Privacy Protection10.1007/978-3-031-65175-5_26(367-380)Online publication date: 26-Jul-2024
https://doi.org/10.1007/978-3-031-65175-5_26
Malkin NLuo APoveda JMazurek M(2023)Optimistic Access Control for the Smart Home2023 IEEE Symposium on Security and Privacy (SP)10.1109/SP46215.2023.10179475(3043-3060)Online publication date: May-2023
https://doi.org/10.1109/SP46215.2023.10179475
Linsner SSteinbrink EKuntke FFranken JReuter C(2022)Supporting users in data disclosure scenarios in agriculture through transparencyBehaviour & Information Technology10.1080/0144929X.2022.206807041:10(2151-2173)Online publication date: 10-May-2022
https://doi.org/10.1080/0144929X.2022.2068070
Zhang BGill PMihai NTripunitara M(2022)Granularity and Usability in Authorization PoliciesEmerging Information Security and Applications10.1007/978-3-030-93956-4_5(68-86)Online publication date: 12-Jan-2022
https://doi.org/10.1007/978-3-030-93956-4_5
Logas JZhong RAlmeida SDas S(2021)Tensions between Access and Control in MakerspacesProceedings of the ACM on Human-Computer Interaction10.1145/34329144:CSCW3(1-33)Online publication date: 5-Jan-2021
https://dl.acm.org/doi/10.1145/3432914
Xu TNaing HLu LZhou YMark GFussell SLampe Cschraefel mHourcade JAppert CWigdor D(2017)How Do System Administrators Resolve Access-Denied Issues in the Real World?Proceedings of the 2017 CHI Conference on Human Factors in Computing Systems10.1145/3025453.3025999(348-361)Online publication date: 2-May-2017
https://dl.acm.org/doi/10.1145/3025453.3025999
Centivany AGlushko BKaye JDruin ALampe CMorris DHourcade J(2016)"Popcorn Tastes Good"Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems10.1145/2858036.2858516(1126-1137)Online publication date: 7-May-2016
https://dl.acm.org/doi/10.1145/2858036.2858516
Shebaro BOluwatimi OBertino E(2015)Context-Based Access Control Systems for Mobile DevicesIEEE Transactions on Dependable and Secure Computing10.1109/TDSC.2014.232073112:2(150-163)Online publication date: 10-Mar-2015
https://dl.acm.org/doi/10.1109/TDSC.2014.2320731
Jaferian PRashtian HBeznosov K(2014)To authorize or not authorizeProceedings of the Tenth USENIX Conference on Usable Privacy and Security10.5555/3235838.3235865(301-320)Online publication date: 9-Jul-2014
https://dl.acm.org/doi/10.5555/3235838.3235865
Show More Cited By

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Figures

Tables

Media

View Table of Conten