Direkt zum Inhalt

Baumer, Thomas ; Reittinger, Tobias ; Kern, Sascha ; Pernul, Günther

Digital Nudges for Access Reviews: Guiding Deciders to Revoke Excessive Authorizations

Baumer, Thomas , Reittinger, Tobias , Kern, Sascha and Pernul, Günther (2024) Digital Nudges for Access Reviews: Guiding Deciders to Revoke Excessive Authorizations. In: Twentieth Symposium on Usable Privacy and Security (SOUPS 2024), 11 - 13 Aug 2024, Philadelphia, PA, USA.

Date of publication of this fulltext: 10 Sep 2024 04:14
Conference or workshop item
DOI to cite this document: 10.5283/epub.59116


Abstract

Organizations tend to over-authorize their members, ensuring smooth operations. However, these excessive authorizations offer a substantial attack surface and are the reason regulative authorities demand periodic checks of their authorizations. Thus, organizations conduct time-consuming and costly access reviews to verify these authorizations by human decision-makers. Still, these deciders only ...

Organizations tend to over-authorize their members, ensuring smooth operations. However, these excessive authorizations offer a substantial attack surface and are the reason regulative authorities demand periodic checks of their authorizations. Thus, organizations conduct time-consuming and costly access reviews to verify these authorizations by human decision-makers. Still, these deciders only marginally revoke authorizations due to the poor usability of access reviews. In this work, we apply digital nudges to guide human deciders during access reviews to tackle this issue and improve security. In detail, we formalize the access review problem, interview experts (n=10) to identify several nudges helpful for access reviews, and conduct a user study (n=102) for the Choice Defaults Nudge. We show significant behavior changes in revoking authorizations. We also achieve time savings and less stress. However, we also found that improving the overall quality requires more advanced means. Finally, we discuss design implications for access reviews with digital nudges.



Involved Institutions


Details

Item typeConference or workshop item (Paper)
DateAugust 2024
Additional Information (public)This paper is included in the Proceedings of the Twentieth Symposium on Usable Privacy and Security. August 12–13, 2024 • Philadelphia, PA, USA 978-1-939133-42-7
InstitutionsBusiness, Economics and Information Systems > Institut für Wirtschaftsinformatik > Lehrstuhl für Wirtschaftsinformatik I - Informationssysteme (Prof. Dr. Günther Pernul)
Informatics and Data Science > Department Information Systems > Lehrstuhl für Wirtschaftsinformatik I - Informationssysteme (Prof. Dr. Günther Pernul)
Related URLs
URLURL Type
https://github.com/AccessReview/AvailabilityOther
KeywordsAccess Control, Digital Nudges, Choice Defaults, Expert Interviews, User Study, Formalization
Dewey Decimal Classification000 Computer science, information & general works > 004 Computer science
300 Social sciences > 330 Economics
600 Technology > 600 Technology (Applied sciences)
StatusPublished
RefereedYes, this version has been refereed
Created at the University of RegensburgYes
URN of the UB Regensburgurn:nbn:de:bvb:355-epub-591163
Item ID59116

Export bibliographical data

Owner only: item control page

nach oben