Usable security and privacy: A case study of developing privacy management tools

ACM International Conference Proceeding Series

Volumn 93, Issue , 2005, Pages 35-43

  Brodie, Carolyn ^a   Karat, Clare Marie ^a   Karat, John ^a   Feng, Jinjuan ^b  

^a IBM T J WATSON RESEARCH CENTER   (United States)

^b University of Marylandw Baltimore County   (United States)

Author keywords

Design; Privacy; Privacy policies; Security; Social and legal issues

Indexed keywords

COMPLIANCE MONITORING; CONTROL ACCESS; PRIVACY CONCERNS; PRIVACY MANAGEMENT; PRIVACY POLICIES; PRIVACY REQUIREMENTS; RAPID GROWTH; SOCIAL AND LEGAL ISSUES; USABLE SECURITY;

ACCESS CONTROL; DESIGN; INFORMATION TECHNOLOGY; RESEARCH;

INFORMATION USE;

EID: 77953768744     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1073001.1073005     Document Type: Conference Paper

References (37)

1. Adams, A. and Sasse, A. (2001) Privacy in Multimedia Communications: Protecting Users, Not Just Data. In A. Blandford, J. Vanderdonkt & P. Gray [Eds.]: People and Computers XV - Interaction without frontiers. Joint Proceedings of HCI2001 and ICM2001, Lille, Sept. 2001. pp. 49-64. Springer.
2. th Very Large Database Conference (VLDB), Hong Kong, China, 2002.
3. th International Conference on Data Engineering, Bangalore, India, 2003.
4. Anderson R. J. A Security Policy Model for Clinical Information Systems. In the Proceedings of the 1996 IEEE Symposium on Security and Privacy, 30-43.
5. Anderson R. J. Privacy Technology Lessons from Healthcare. In the Proceedings of the 2000 IEEE Symposium on Security and Privacy.
6. Anton, A., He, Q., and Baumer, D. (2004) The complexity underlying JetBlue's privacy policy violations. IEEE Security & Privacy. August/September, 2004.
7. Ashley, P., Hada, S., Karjoth, G., Powers, C., and Schunter, M. (2003). Enterprise Privacy Architecture Language (EPAL 1.2). W3C Member Submission 10-Nov-2003. http://www.w3.org/Submission/EPAL/.
8. AT&T Privacy Bird (2003). http://privacybird.com/.
9. th European Symposium on Research in Computer Security (ESORICS), Springer-Verlag, Berlin, 2003.
10. Ball, E. (2003). Patient privacy in electronic prescription transfer. IEEE Security and Privacy, 1, 2, 77-80.
11. Baumer, D., Earp, J.B., and Payton, F. C. (2000). Privacy in medical records: IT implications of HIPAA. Computers and Society, December, 2000, 40-47.
12. th International Conference on Electronic Commerce Research (ICECR-6), October, 2003, Dallas, Texas.
13. Chatham, B. (2004). Online Privacy Concerns: More than Hype. The Forrester Report, 2004.
14. CRA Conference on "Grand Research Challenges in Information Security and Assurance". http://www.cra.org/Activities/grand.challenges/security/ November 16-19, 2003.
15. Cranor, L. (2002). Web Privacy with P3P. Cambridge: O'Reilly.
16. Cranor, L. F., Arjula, M., and Guduru, P., Use of a P3P user agent by early adopters. In the Proceedings of the 2002 ACM workshop on Privacy in the Electronic Society, 1-10.
17. Hagen, P. (2000). Personalization versus privacy. The Forrester Report, Nov., 2000, 1-19.
18. IBM. IBM Multi-National Consumer Privacy Survey. http://www.ibm.com/ services/files/privacy-survey-oct991.pdf.
19. IBM Tivoli Privacy Manager for eBusiness (2004). http://www-306.ibm.com/ software/tivoli/products/privacymgr-e-bus/.
20. rd Annual Meeting, 1989.
21. Karat, J., C. Karat, C. Brodie, and J. Feng, "Privacy in information technology: Designing to enable privacy policy management in organizations", International Journal of Human Computer Studies, in press.
22. th IEEE Computer Security Foundations Workshop, 271-281.
23. Lederer, S., Hong, J. I., Dey, A., and Landay, J. A., Personal Privacy through Understanding and Action: Five Pitfalls for Designers. Personal and Ubiquitous Computing 2004. 8(6): p. 440-454.
24. Manny, C. H. (2003). European and American privacy: Commerce, rights, and justice. Computer Law and Security Report, 19, 1, 2003, 4-10.
25. Michael, J.B., V.L. Ong, and N.C. Rowe, "Naturallanguage processing support for developing policygoverned software systems", 39th International Conference on Technology for Object-Oriented Languages and Systems, IEEE Computer Society Press, pp. 263-274.
26. Microsoft Internet Explorer (2004). Help Safeguard your privacy on the web. http://www.microsoft.com/windows/ie/using/howto/privacy/config.mspx.
27. National Research Council. (2003). Who goes there? Authentication through the lens of privacy. Washington, D.C: National Academies Press.
28. Neff, M., Byrd, R., and Boguraev, B. (2003) The Talent system: TEX-TRACT architecture and data model. In Proceedings of HLT-NAACL Workshop on Software Engineering and Architectures of Language Technology Systems, Edmonton, Alberta, Canada.
29. OASIS (2004). Privacy Policy Profile of XACML draft 01. http://docs.oasis-open.org/xacml/access-control-xacml-2-0-privacy-profile-spec- cd-01.pdf.
30. OECD (1980). OECD guidelines on the protection of privacy and transborder flows of personal data. http://www.oecd.org/home/.
31. Office of the Federal Privacy Commissioner of Australia. (2000). Privacy and Business (2000). http://www.privacy.gov.au.
32. Ponemon Institute and IAPP. (2004). 2003 Benchmark Study of Corporate Privacy Practices.
33. Smith, J. (1993). Privacy policies and practices: Inside the organizational maze. Communications of the ACM, 36, 12, 105-122.
34. The Stanford Student Computer and Network Privacy Project. A study of student privacy issues at Stanford University. Communications of the ACM, 45, 3, 2002, 23-25.
35. Whitten, A. and Tygar, J. D. (1999) Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0. In Proceedings of the 9th USENIX Security Symposium, August, 1999.
36. W3C (2002) A P3P Preference Exchange Language 1.0 (APPEL 1.0). http://www.w3.org/TR/P3Ppreferences/.
37. Zurko, M. E., Simon, R., and Sanfilippo, T. (1999) A User-Centered, Modular Authorization Service Built on an RBAC Foundation. In Proceedings of the 1999 Symposium on Security and Privacy, May, 1999, 57-71.