Rational security: modelling everyday password use

Geoffrey B Duggan, Hilary Johnson, Beate Grawemeyer

Research output: Contribution to journalArticle

  • 19 Citations

Abstract

To inform the design of security policy, task models of password behaviour were constructed for different user groups—Computer Scientists, Administrative Staff and Students. These models identified internal and external constraints on user behaviour and the goals for password use within each group. Data were drawn from interviews and diaries of password use. Analyses indicated password security positively correlated with the sensitivity of the task, differences in frequency of password use were related to password security and patterns of password reuse were related to knowledge of security. Modelling revealed Computer Scientists viewed information security as part of their tasks and passwords provided a way of completing their work. By contrast, Admin and Student groups viewed passwords as a cost incurred when accessing the primary task. Differences between the models were related to differences in password security and used to suggest six recommendations for security officers to consider when setting password policy.
LanguageEnglish
Pages415-431
Number of pages18
JournalInternational Journal of Human-Computer Studies
Volume70
Issue number6
Early online date3 Mar 2012
DOIs
StatusPublished - Jun 2012

Fingerprint

Students
computer scientist
Security of data
Group
security policy
Costs
student
staff
costs
interview

Cite this

Rational security: modelling everyday password use. / Duggan, Geoffrey B; Johnson, Hilary; Grawemeyer, Beate.

In: International Journal of Human-Computer Studies, Vol. 70, No. 6, 06.2012, p. 415-431.

Research output: Contribution to journalArticle

Duggan, Geoffrey B ; Johnson, Hilary ; Grawemeyer, Beate. / Rational security: modelling everyday password use. In: International Journal of Human-Computer Studies. 2012 ; Vol. 70, No. 6. pp. 415-431
@article{7104b1b0779a4a739a7b8a36573558c6,
title = "Rational security: modelling everyday password use",
abstract = "To inform the design of security policy, task models of password behaviour were constructed for different user groups—Computer Scientists, Administrative Staff and Students. These models identified internal and external constraints on user behaviour and the goals for password use within each group. Data were drawn from interviews and diaries of password use. Analyses indicated password security positively correlated with the sensitivity of the task, differences in frequency of password use were related to password security and patterns of password reuse were related to knowledge of security. Modelling revealed Computer Scientists viewed information security as part of their tasks and passwords provided a way of completing their work. By contrast, Admin and Student groups viewed passwords as a cost incurred when accessing the primary task. Differences between the models were related to differences in password security and used to suggest six recommendations for security officers to consider when setting password policy.",
author = "Duggan, {Geoffrey B} and Hilary Johnson and Beate Grawemeyer",
year = "2012",
month = "6",
doi = "10.1016/j.ijhcs.2012.02.008",
language = "English",
volume = "70",
pages = "415--431",
journal = "International Journal of Human-Computer Studies",
issn = "1071-5819",
publisher = "Academic Press",
number = "6",

}

TY - JOUR

T1 - Rational security: modelling everyday password use

AU - Duggan,Geoffrey B

AU - Johnson,Hilary

AU - Grawemeyer,Beate

PY - 2012/6

Y1 - 2012/6

N2 - To inform the design of security policy, task models of password behaviour were constructed for different user groups—Computer Scientists, Administrative Staff and Students. These models identified internal and external constraints on user behaviour and the goals for password use within each group. Data were drawn from interviews and diaries of password use. Analyses indicated password security positively correlated with the sensitivity of the task, differences in frequency of password use were related to password security and patterns of password reuse were related to knowledge of security. Modelling revealed Computer Scientists viewed information security as part of their tasks and passwords provided a way of completing their work. By contrast, Admin and Student groups viewed passwords as a cost incurred when accessing the primary task. Differences between the models were related to differences in password security and used to suggest six recommendations for security officers to consider when setting password policy.

AB - To inform the design of security policy, task models of password behaviour were constructed for different user groups—Computer Scientists, Administrative Staff and Students. These models identified internal and external constraints on user behaviour and the goals for password use within each group. Data were drawn from interviews and diaries of password use. Analyses indicated password security positively correlated with the sensitivity of the task, differences in frequency of password use were related to password security and patterns of password reuse were related to knowledge of security. Modelling revealed Computer Scientists viewed information security as part of their tasks and passwords provided a way of completing their work. By contrast, Admin and Student groups viewed passwords as a cost incurred when accessing the primary task. Differences between the models were related to differences in password security and used to suggest six recommendations for security officers to consider when setting password policy.

UR - http://www.scopus.com/inward/record.url?scp=84858182438&partnerID=8YFLogxK

UR - http://dx.doi.org/10.1016/j.ijhcs.2012.02.008

U2 - 10.1016/j.ijhcs.2012.02.008

DO - 10.1016/j.ijhcs.2012.02.008

M3 - Article

VL - 70

SP - 415

EP - 431

JO - International Journal of Human-Computer Studies

T2 - International Journal of Human-Computer Studies

JF - International Journal of Human-Computer Studies

SN - 1071-5819

IS - 6

ER -