Guiding decisions on authorization policies
Guiding decisions on authorization policies
复制标题
指导授权政策决策
DOI：
10.1145/2245276.2232015
复制
发表时间：
2012
期刊：
影响因子：
--
通讯作者：
Bartsch S
中科院分区：
文献类型：
--
作者：
Bartsch S
大多数组织都有访问控制策略，许多组织必须经常更改它们才能完成工作。目前，进行此类更改的方式通常会对组织的安全性、生产力和员工满意度产生重大影响。那些必须做出决定的人被置于现场，根据他们的观点和情况，决定偏向于商业或安全利益。访问控制策略的决策支持系统可以缓解这些问题，但是要想有效，这样的系统需要大量关于特定安全和业务风险和收益的信息，而收集这些信息需要大量的投资。在本文中，我们提出了一种参与式的方法来收集这些信息，这不仅降低了成本，而且提高了效率，因为它确保了特定的当地知识和下游风险被决策者代表和可见。我们对来自不同背景的员工和决策者进行了形成性评估，评估了我们系统开发的决策支持原型。我们发现，在其他因素中，决策支持高度依赖于组织环境，并且收集的因素需要为贡献个体的环境化。
Most organizations have access control policies, and many have to change them frequently to get work done. Currently, the way such changes are made often has a significant impact on the organization's security, productivity, and employee satisfaction. Those who have to make the decisions are put on the spot, and depending on their perspective and circumstances, the decision is biased towards business or security interests. A decision support system for access control policies could mitigate these problems, but to be effective, such a system needs a significant amount of information about specific security and business risks and benefits, and collecting this information requires significant investment. In this paper, we present a participatory approach to collecting this information, which not only reduces cost, but increases effectiveness because it ensures that specific local knowledge and downstream risks are represented and visible to decision-makers. We evaluated our systematically developed decision-support prototype in formative evaluations with employees and decision-makers from a variety of backgrounds. We found that, among others, decision support is highly dependent on the organizational context and that the collected factors need to be contextualized for the contributing individuals.