thank you for watching our video about our paper.
It's problematic.
But i'm not concerned
university perspectives on account sharing.
We have three key findings in our paper:
first, overwhelmingly among our non-IT participants
account sharing through non-secure methods, is commonplace.
Second, the motivations to share accounts, stem from a mindset of academic freedom and
paternalistic norms;
And third, there is a disconnect between IT messaging efforts to spread best security
practices and the actual practices done by work groups.
If we have one overriding security commandment that our IT departments would like us to follow
it's probably this one.
Thou shalt not share your login in password,
and we see messages like this on Twitter and other social media,
such as passwords are like toothbrushes.
Don't share them even with friends,
yet to date we and others have found widespread account sharing the
people reported sharing eleven accounts on average in a recent Cscw.
Study that we conducted.
This is a problem.
If there is no way for the participants to share account securely.
We see here this information from checkpoint research that cyber attacks have increased
fifty percent year over year in the last couple of years.
And notice this top line,
education and research overwhelmingly surpassed even government and military for the reported
tax.
There are several factors that we think can contribute to this.
For instance, Academic freedom means that the IT Department cannot lock down the sites
that we might visit, or types of messages that we receive.
The IT department itself might be decentralized.
We have fewer restrictions, though, because of the educational setting
because of widespread, bring your own device policies.
This motivated our study to understand from a research university perspective what forms
of account sharing exists, and what motivates this account sharing.
So we advertised our study via flyers posted online and around campus in cooled emails
to candidates we identified as being potentially relevant to the study.
We used a pre-interview screening survey to determine which candidates were likely to
have insights on using accounts in the workplace, or on account sharing practices.
We tried to diversify the potential participant pool
by first coming up with job titles that would be likely to have knowledge of account use
and then emailing several people from all university departments.
Our final participant Pool, had a mix of it, workers, students, and full-time
an even ratio of male compared to non-male identified participants with an overall mix
of ages and University department affiliations.
Our procedure was to
was to obtain informed consent, then asked questions grouped by the following sections:
background information.
Types of digital accounts held and shared devices used work, group security norms it
policies that they were aware of, and because we conducted the study During the lockdown
we asked about any adaptations to the Coronavirus
a high level.
We found that most of our participants reported some form of account sharing
forms of account sharing reported were for managing logistics, controlling two-factor
authentication requests and sharing access to various platforms.
We also found several motivations for account sharing people thought of it as low risk.
They did it to save money, and because they found security was a secondary priority to
their jobs.
But I want to draw your attention here to the trust motivation.
People said, for instance, that they trusted other people in the University or research
setting with one full-time it worker noting.
I can't even tell you how many people have volunteered to give me their university credentials,
because I work with them,
and they like me and they trust me.
Non-it participants affirm this, explaining.
They trust the system to take care of their technology security.
One non-it worker states
i'm just a dummy to think the university keeps everything secure for me.
But maybe they don't.
I don't know
when asked to share a university policy on account sharing a minority of the non-it workers
could name one.
some participants shared the feeling that the security policies were so simple it was
absolutely unnecessary to seek out specific policies.
As one student echoes.
I think the understanding is not to share logging credentials with people outside the
lab, unless you have explicit permission to do so.
That's just an assumed policy, because it's never come up before.
It might be written somewhere in the onboarding manual, but it's so obvious that I just haven't
committed it to memory.
Further, several participants were aware that their practices were not secure,
as our title exemplifies a common feeling succinctly put by one of our participants.
It's problematic, But i'm not concerned.
This comfort with reliance on university authority is what we refer to as paternalistic norms.
It means the participants view.
The University as a Security guardian of sorts that takes care of security for them.
This means, you workers don't feel an individual responsibility because the University acts
in their interest for them
we found evidence that participants viewed the University as a security garden, which
is not out of the ordinary, as paternalistic norms are common in education,
but We also found that our expectation of how communication would be working on the
university side did not match the disconnected reality of what work groups were practicing.
Our insights show that first there is the perception that account sharing is a low-risk
practice, and there is also a widespread trust norm.
So we think we need to bump up our training so that people understand how to model for
threats in the University, for instance, they might not even be aware that a university
such as this is among the most highly attacked;
also because saving money is a priority.
Who would like universities such as this to sponsor password managers for use by everybody
at the site
to address some of the issues around cybersecurity.
Being a secondary priority.
As with prior work, we can better design accounts to allow for task delegation that will allow
for some secure sharing of data and controlling access to most of it.
We'd also like to see something like a cybersecurity buddy program,
because there is high trust in high likeability for it.
Members might be in a good position to partner with particular groups to make sure that there
is a liaison where information can flow.
Thank you for listening to our talk.
We're happy to take your questions.