Document Type

Technical Report

Publication Date


Technical Report Number



Effective computer security requires looking not just at technology, but also at how it meshes with users in the real-world enterprises depending on it. As part of a longer-term series of projects, we have been looking at these issues-- particularly access control-- in a variety of real-world enterprises. In previous work, we looked at companies in the finance and software industries; this paper reports on a study of a hospital's access control systems. Both studies employ ethnographic methods to elicit observations on the failures of current access control technologies in large, dynamic organizations; participants in the corporate study were largely drawn from IT staff members, whereas this clinical study involved a larger number of end users.