Grant: Strategic Projects - Group

The management of security and privacy in IT settings is an enormous, difficult, and costly problem with over $15B spent on tools alone around the world in 2004. Yet little is known about security administrators, their roles and responsibilities within organizations, and how effective existing tools and practices are at protecting organizations and employees while still allowing productive collaborative work. Much like an air-traffic controller, if a security administrator makes an error, entire organizations may be compromised leading to, in the best case, loss of productivity and, in the worst case, injury or death to people.   The goals of this project are to make the first significant strides to understand and improve this critical area of practice by: 1) studying security administrators within organizations; 2) understanding and modeling their tasks and the effectiveness and usability of the tools they currently use to perform these tasks; 3) developing models, theories, and guidelines of security administration that can aid developers and planners in evaluating and improving these tools; and 4) refining and validating these findings by developing new tools, and testing them with real administrators in real settings using established principles of human-computer interaction.   Our novel approach considers the problem as the interaction of three main factors: Humans, Organizations, and Technologies (HOT). Given this context, we will conduct field studies of security administrators in real, complex organizations in order to characterize their roles, responsibilities, interactions with others, the tasks they perform, and the tools they use. Analysis of this data will then allow us to bring together the human, organizational, and technology centred approaches to form guidelines and techniques for the creation of advanced security administration systems and their evaluation.   The ultimate effect will be better security administration systems that address the needs of organizations, the people who set security policies, and those who implement them and will thus enhance the overall level of trust in complex information systems that form the foundation of modern organizations.