作者
Tianyin Xu, Han Min Naing, Le Lu, Yuanyuan Zhou
发表日期
2017/5/2
图书
Proceedings of the 2017 CHI Conference on Human Factors in Computing Systems
页码范围
348-361
简介
The efficacy of access control largely depends on how system administrators (sysadmins) resolve access-denied issues. A correct resolution should only permit the expected access, while maintaining the protection against illegal access. However, anecdotal evidence suggests that correct resolutions are occasional---sysadmins often grant too much access (known as security misconfigurations) to allow the denied access, posing severe security risks. This paper presents a quantitative study on real-world practices of resolving access-denied issues, with a particular focus on how and why security misconfigurations are introduced during problem solving. We characterize the real-world security misconfigurations introduced in the field, and show that many of these misconfigurations were the results of trial-and-error practices commonly adopted by sysadmins to work around access denials. We argue that the lack of …
学术搜索中的文章
T Xu, HM Naing, L Lu, Y Zhou - Proceedings of the 2017 CHI Conference on Human …, 2017