Reducing Unauthorized Access by Insiders through User Interface Design: Making End Users Accountable

A long-time tenet of information security is the principle of least privilege, which requires that systems users be given the minimum amount of access privilege required to complete a task. However, many financial, medical, and customer records systems grant employees broad access for reasons of practical necessity. Unfortunately, with broad access rights comes potential for abuse. This paper investigates how user interface design features of a system can be designed to make end users feel more accountable for their actions in the system and less likely to abuse their access rights. To do so, we developed a factorial survey to determine the effects of user interface design features relating to three aspects of accountability: (1) identifiability, (2) evaluation, and (3) social presence. The results of the factorial survey show that the accountability design features significantly reduced intention to commit unauthorized access.