The compliance budget: managing security behaviour in organisations

By A. Beautement, M. Sasse, M. Wonham. New Security Paradigms Workshop, 2009

371 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/e5187906a1c01713046014ba916181c89d3867b1

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

Citations in the corpus

The Plight of the Targeted Attacker in a World of Scale (2010, background): “Beautement et al. [5] introduce the idea of a compliance budget for users, suggesting that once the burden of security policies reaches a certain point further complexity becomes intolerable.”
Security of smart manufacturing systems (2018, background): “If security policies and procedures become a burden to users, history suggests that they will be unwilling to comply with these policies and procedures [99,100] and may misuse the system”
The true cost of unusable password policies: password use in the wild (2010, background): “[3] propose the model of the Compliance Budget to understand how users balance the effort of complying with a security behaviour required by an”
"...No one Can Hack My Mind": Comparing Expert and Non-Expert Security Practices (2015, background): “[6] note that users are often knowledgeable about good security practices and are willing to make some efforts toward complying with them, but that there are limits to how much effort they can or will exert.”
So long, and no thanks for the externalities: the rational rejection of security advice by users (2009, neutral): “[19].”
The Why and How of the Integrative Review (2020, background): “The topic of compliance in the context of cybersecurity has been studied from a range of perspectives, from computer science (Wash et al., 2014) and cognition (Benenson et al., 2012) to economics (Beautement et al., 2009) and law (Good et al., 2006).”
Understanding Employee Responses to Stressful Information Security Requirements: A Coping Perspective (2014, background): “Specifically, the time-consuming security protocols that characterize SrS overload are part and parcel an employee’s job and are not experienced voluntarily [12]; in SrS-complexity situations, employees must digest complex administrative and technical security requirements or risk organizational san”