International Journal On Cyber Situational Awareness (IJCSA)
ISSN: (Print) 2057-2182 ISSN: (Online) 2057-2182
DOI: 10.22619/IJCSA
Published Semi-annually. Est. 2014
Editor-in-Chief:
Dr Cyril Onwubiko, Chair – Cyber Security & Intelligence, E-Security Group, Research Series, London, UK; IEEE UK & Ireland Section Secretary
Associate Editors:
Professor Frank Wang, Head of School / Professor of Future Computing, Chair IEEE Computer Society, UK&RI, School of Computing, University of Kent, Canterbury, UK
Dr Thomas Owens, Senior Lecturer & Director of Quality, Department of Electronic and Computer Engineering, Brunel University, London, UK
Transparent password policies: A case study of investigating end-user situational awareness
Alberto Bullo, Eliana Stavrou and Stavros Stavrou
Abstract:
Transparent password policies are utilized by organizations in an effort to ease the end-user (e.g. customer) from the burden of configuring authentication settings while maintaining a high level of security. However, authentication transparency can challenge security and usability and can impact the awareness of the end-users with regards to the protection level that is realistically achieved. For authentication transparency to be effective, the triptych security – usability – situational awareness should be considered when designing relevant security solutions / products. Although various efforts have been made in the literature, the usability aspects of the password selection process are not well understood or addressed in the context of end-user situational awareness. This research work specifies three security and usability-related strategies that represent the organizations’, the end users’ and the attackers’ objectives with regards to password construction. Understanding each actor’s perspective can greatly assist in increasing situational awareness with regards to the authentication controls usage and effectiveness. Furthermore, a case study is presented to evaluate if, and in what way, transparent password policies, that isolate users’ involvement can affect the perspective of the end-user with regards to the security situation. Results showed that the transparent approached utilized has created a negative situation, users were not aware and never dealt with changing or trying to alter default security settings configured on their wireless access point, leaving their home network vulnerable to external attacks. Finally, initial recommendations are made to organizations that would like to implement and evaluate transparent authentication controls.
Keyword: Transparent security; transparent password policy; password cracking; usable security; end-user cyber situational awareness.
ISSN: 2057-2182
Volume 2. No. 1
DOI: 10.22619/IJCSA.2017.100116
Date: Nov. 2017
Reference to this paper should be made as follows:
Bullo, A., Stavrou, E. & Stavrou, S. (2017). Transparent password policies: A case study of investigating end-user situational awareness. International Journal on Cyber Situational Awareness, Vol. 2, No. 1, pp85-99.