NDLI: Where do security policies come from?

Please wait, while we are loading the content...

Do windows users follow the principle of least privilege?: investigating user account control practices

Usably secure, low-cost authentication for mobile banking

The impact of social navigation on privacy policy configuration

Where do security policies come from?

On the impact of real-time feedback on users' behaviour in mobile location-sharing applications

Encountering stronger password requirements: user attitudes and behaviors

Two heads are better than one: security and usability of device associations in group scenarios

Optimizing a policy authoring framework for security and privacy policies

Folk models of home computer security

Parenting from the pocket: value tensions and technical directions for secure and private parent-teen mobile safety

A closer look at recognition-based graphical passwords on mobile devices

Influence of user perception, security needs, and social factors on device pairing method choices

Feasibility of structural network clustering for group-based privacy control in social networks

Improving users' security choices on home wireless networks

Towards understanding ATM security: a field study of real world ATM use

Textured agreements: re-envisioning electronic consent

Where do security policies come from?

Content Provider	ACM Digital Library
Author	Herley, Cormac Florêncio, Dinei
Abstract	We examine the password policies of 75 different websites. Our goal is understand the enormous diversity of requirements: some will accept simple six-character passwords, while others impose rules of great complexity on their users. We compare different features of the sites to find which characteristics are correlated with stronger policies. Our results are surprising: greater security demands do not appear to be a factor. The size of the site, the number of users, the value of the assets protected and the frequency of attacks show no correlation with strength. In fact we find the reverse: some of the largest, most attacked sites with greatest assets allow relatively weak passwords. Instead, we find that those sites that accept advertising, purchase sponsored links and where the user has a choice show strong inverse correlation with strength. We conclude that the sites with the most restrictive password policies do not have greater security concerns, they are simply better insulated from the consequences of poor usability. Online retailers and sites that sell advertising must compete vigorously for users and traffic. In contrast to government and university sites, poor usability is a luxury they cannot afford. This in turn suggests that much of the extra strength demanded by the more restrictive policies is superfluous: it causes considerable inconvenience for negligible security improvement.
Starting Page	1
Ending Page	14
Page Count	14
File Format	PDF
ISBN	9781450302647
DOI	10.1145/1837110.1837124
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2010-07-14
Publisher Place	New York
Access Restriction	Subscribed
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in