SimPass: quantifying the impact of password behaviours and policy directives on an organisation's systems

Renaud, K. and Mackenzie, L. (2013) SimPass: quantifying the impact of password behaviours and policy directives on an organisation's systems. Journal of Artificial Societies and Social Simulation, 16(3), Art. 3.

Abstract

Users are often considered the weakest link in the security chain because of their natural propensity for choosing convenience over safe practice. One area with a vast amount of evidence related to poor user behaviour is that of password management. We have a pretty good idea of the extent to which careless user behaviour impacts on the individual user’s personal security. However, we do not fully understand the impact on the organisation as a whole when such laxity is aggregated across a large number of employees, nor do we know how best to intervene so as to improve the level of protection of critical systems. Current wisdom mandates the use of increasingly draconian policies to curb insecure user behaviours but it is clear that this approach has limited effectiveness. Unfortunately, no one really understands how the individual directives contained in these policies impact on the security of an organisation’s systems. Sometimes a mandated tightening of policy can have unexpected side-effects which are not easily anticipated and may indeed prove entirely counterproductive. It would be very difficult to investigate these issues in a real-life environment so here we describe a simulation model, which seeks to replicate a typical organisation, with employee agents using a number of systems over an extended period. The model is configurable, allowing adjustment of particular input parameters in order to reflect different policy dictats so as to determine their impact on the security of the simulated organisation’s systems. This tool will support security specialists developing policies within their organisations by quantifying the longitudinal impacts of particular rules.

• Item Type: Articles
• Status: Published
• Refereed: Yes
• Glasgow Author(s) Enlighten ID: Mackenzie, Dr Lewis and Renaud, Professor Karen
• Authors: Renaud, K., and Mackenzie, L.
• College/School: College of Science and Engineering > School of Computing Science
• Journal Name: Journal of Artificial Societies and Social Simulation
• Publisher: University of Surrey
• ISSN: 1460-7425
• Published Online: 30 June 2013