• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>IEEE Pacific Rim International Symposium on Dependable Computing >Accounting for the Human User in Predictive Security Models
【24h】

Accounting for the Human User in Predictive Security Models

机译：在预测安全性模型中为人类用户核算

获取原文
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Given the growing sophistication of cyber attacks, designing a perfectly secure system is not generally possible. Quantitative security metrics are thus needed to measure and compare the relative security of proposed security designs and policies. Since the investigation of security breaches has shown a strong impact of human errors, ignoring the human user in computing these metrics can lead to misleading results. Despite this, and although security researchers have long observed the impact of human behavior on system security, few improvements have been made in designing systems that are resilient to the uncertainties in how humans interact with a cyber system. In this work, we develop an approach for including models of user behavior, emanating from the fields of social sciences and psychology, in the modeling of systems intended to be secure. We then illustrate how one of these models, namely general deterrence theory, can be used to study the effectiveness of the password security requirements policy and the frequency of security audits in a typical organization. Finally, we discuss the many challenges that arise when adopting such a modeling approach, and then present our recommendations for future work.
机译：鉴于网络攻击的日趋复杂，通常不可能设计出完全安全的系统。因此，需要定量的安全度量来度量和比较建议的安全设计和策略的相对安全性。由于对安全漏洞的调查显示出人为错误的严重影响，因此在计算这些指标时忽略人为用户可能会导致误导性结果。尽管如此，尽管安全研究人员长期以来一直观察到人类行为对系统安全性的影响，但是在设计可抵御人类如何与网络系统交互的不确定性的系统方面，所做的改进很少。在这项工作中，我们开发了一种方法，该方法包括在社会科学和心理学领域中产生的用户行为模型纳入旨在确保安全的系统建模中。然后，我们说明如何使用这些模型之一（即通用威慑理论）来研究密码安全需求策略的有效性以及典型组织中安全审核的频率。最后，我们讨论了采用这种建模方法时出现的许多挑战，然后提出了对未来工作的建议。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号