@inproceedings{fb0c6e3056e5484e945233fe3bde325e,
title = "Security circumvention: To educate or to enforce?",
abstract = "Deliberate circumvention of information systems security is a common behavioral pattern among users. It not only defeats the purpose of having the security controls in place, but can also go far beyond in terms of the total damage it can cause. An organization grappling with circumvention can try to (i) train its users, or (ii) take on enforcement measures, or adopt a combination of the two. In this work, we look at the trade-off between these two very different approaches towards circumvention and try to gain some insights about how an organization might wish to tackle this menace.",
keywords = "Circumvention, IT Security, Monitoring, Security control, Training, Work-around",
author = "Debabrata Dey and Abhijeet Ghoshal and Atanu Lahiri",
note = "Publisher Copyright: {\textcopyright} 2018 IEEE Computer Society. All rights reserved.; 51st Annual Hawaii International Conference on System Sciences, HICSS 2018 ; Conference date: 02-01-2018 Through 06-01-2018",
year = "2018",
language = "English (US)",
series = "Proceedings of the Annual Hawaii International Conference on System Sciences",
publisher = "IEEE Computer Society",
pages = "5195--5204",
editor = "Bui, {Tung X.}",
booktitle = "Proceedings of the 51st Annual Hawaii International Conference on System Sciences, HICSS 2018",
}