Date of Award

11-1-2013

Document Type

Thesis (Ph.D.)

Department or Program

Department of Computer Science

First Advisor

Sean Smith

Abstract

Access control is a core component of any information-security strategy. Researchers have spent tremendous energy over the past forty years defining abstract access-control models and proving various properties about them. However, surprisingly little attention has been paid to how well these models work in real socio-technical systems (i.e., real human organizations). This dissertation describes the results of two qualitative studies (involving 52 participants from four companies, drawn from the financial, software, and healthcare sectors) and observes that the current practice of access control is dysfunctional at best. It diagnoses the broken assumptions that are at the heart of this dysfunction, and offers a new definition of the access-control problem that is grounded in the requirements and limitations of the real world.

Comments

Originally posted in the Dartmouth College Computer Science Technical Report Series, number TR2013-745.

Download

Share

COinS