Reducing Unauthorized Access by Insiders through User Interface Design: Making End Users Accountable

A long-time tenet of information security is the principle of least privilege, which requires that systems users be given the minimum amount of access privilege required to complete a task. However, many financial, medical, and customer records systems grant employees broad access for reasons of practical necessity. Unfortunately, with broad access rights comes potential for abuse. This paper investigates how user interface design features of a system can be designed to make end users feel more accountable for their actions in the system and less likely to abuse their access rights. To do so, we developed a factorial survey to determine the effects of user interface design features relating to three aspects of accountability: (1) identifiability, (2) evaluation, and (3) social presence. The results of the factorial survey show that the accountability design features significantly reduced intention to commit unauthorized access.

1. Introduction

A long-standing tenet of information security is the principle of least privilege, the concept that “every privileged user of the system should operate using the least amount of privilege necessary to complete the job” [42, p. 389]. However, many medical, financial, and personnel records systems are intentionally deployed with seemingly little regard for this principle. Rather than limiting access to specific areas, end users of these systems are given broad access to information.