Loading next page...
/lp/emerald-publishing/a-grounded-theory-approach-to-security-policy-elicitation-fvVCG1PaSW
- Publisher
- Emerald Publishing
- Copyright
- Copyright © Emerald Group Publishing Limited
- ISSN
- 2056-4961
- DOI
- 10.1108/ICS-12-2017-0086
- Publisher site
- See Article on Publisher Site
Abstract
PurposeIn this paper, the authors consider how qualitative research techniques that are used in applied psychology to understand a person’s feelings and needs provides a means to elicit their security needs.Design/methodology/approachRecognizing that the codes uncovered during a grounded theory analysis of semi-structured interview data can be interpreted as policy attributes, the paper develops a grounded theory-based methodology that can be extended to elicit attribute-based access control style policies. In this methodology, user-participants are interviewed and machine learning is used to build a Bayesian network-based policy from the subsequent (grounded theory) analysis of the interview data.FindingsUsing a running example – based on a social psychology research study centered around photograph sharing – the paper demonstrates that in principle, qualitative research techniques can be used in a systematic manner to elicit security policy requirements.Originality/valueWhile in principle qualitative research techniques can be used to elicit user requirements, the originality of this paper is a systematic methodology and its mapping into what is actionable, that is, providing a means to generate a machine-interpretable security policy at the end of the elicitation process.
Journal
Information & Computer Security – Emerald Publishing
Published: Oct 8, 2018
@Phil_Robichaud
@deepthiw
@JoseServera