"Comply or Die" Is Dead: Long Live Security-Aware Principal Agents
"Comply or Die" Is Dead: Long Live Security-Aware Principal Agents
复制标题
“不服从就死”已死：具有安全意识的主要特工万岁
DOI：
10.1007/978-3-642-41320-9_5
复制
发表时间：
2013
期刊：
影响因子：
--
通讯作者：
M. Sasse
中科院分区：
文献类型：
--
作者：
I. Kirlappos;A. Beautement;M. Sasse
信息安全已经适应了现代协作组织的性质，放弃了过去的“命令和控制”方法。但当涉及到管理员工的信息安全行为时，许多组织仍然使用禁止行为和制裁违规行为的政策。虽然许多组织都意识到这种“要么遵守，要么死亡”的方法不适用于员工合作、分享和表现主动性的现代企业，但他们没有其他方法来培养安全行为。我们对126名员工不遵守组织政策的原因进行了访谈分析，确定了安全与生产活动之间的感知冲突是不遵守组织政策的关键驱动因素，并通过对1256名员工的调查确认了结果。我们的结论是，有效的问题检测和安全措施适应需要去中心化——员工是必须决定如何在特定环境中实施安全的主要代理人。但这需要比目前大多数员工拥有更高水平的安全意识和技能。任何针对安全行为的活动都需要改变员工对自己在安全中的角色的看法，将他们转变为具有安全意识的主要代理人。
Information security has adapted to the modern collaborative organisational nature, and abandoned “command-and-control” approaches of the past. But when it comes to managing employee’s information security behaviour, many organisations still use policies proscribing behaviour and sanctioning non-compliance. Whilst many organisations are aware that this “comply or die” approach does not work for modern enterprises where employees collaborate, share, and show initiative, they do not have an alternative approach to fostering secure behaviour. We present an interview analysis of 126 employees’ reasons for not complying with organisational policies, identifying the perceived conflict of security with productive activities as the key driver for non-compliance and confirm the results using a survey of 1256 employees. We conclude that effective problem detection and security measure adaptation needs to be de-centralised - employees are the principal agents who must decide how to implement security in specific contexts. But this requires a higher level of security awareness and skills than most employees currently have. Any campaign aimed at security behaviour needs to transform employee’s perception of their role in security, transforming them to security-aware principal agents.
用户如何绕过访问控制 - 以及原因：授权问题对个人和组织的影响
DOI：
--
发表时间：
2013
期刊：
European Conference on Information Systems (ECIS) 2013 Completed Research
影响因子：
--
作者：
Bartsch S
通讯作者：
Bartsch S