Journal article
Empowering end users to confine their own applications: The results of a usability study comparing SELinux, AppArmor and FBAC-LSM
ACM Transactions on Information and System Security, Vol.14(2), pp.1-28
2011
Abstract
Protecting end users from security threats is an extremely difficult, but increasingly critical, problem. Traditional security models that focused on separating users from each other have proven ineffective in an environment of widespread software vulnerabilities and rampant malware. However, alternative approaches that provide more finely grained security generally require greater expertise than typical end users can reasonably be expected to have, and consequently have had limited success.
The functionality-based application confinement (FBAC) model is designed to allow end users with limited expertise to assign applications hierarchical and parameterised policy abstractions based upon the functionalities each program is intended to perform. To validate the feasibility of this approach and assess the usability of existing mechanisms, a usability study was conducted comparing an implementation of the FBAC model with the widely used Linux-based SELinux and AppArmor security schemes. The results showed that the functionality-based mechanism enabled end users to effectively control the privileges of their applications with far greater success than widely used alternatives. In particular, policies created using FBAC were more likely to be enforced and exhibited significantly lower risk exposure, while not interfering with the ability of the application to perform its intended task. In addition to the success of the functionality-based approach, the usability study also highlighted a number of limitations and problems with existing mechanisms. These results indicate that a functionality-based approach has significant potential in terms of enabling end users with limited expertise to defend themselves against insecure and malicious software.
Details
- Title
- Empowering end users to confine their own applications: The results of a usability study comparing SELinux, AppArmor and FBAC-LSM
- Authors/Creators
- Z.C. Schreuders (Author/Creator) - Murdoch UniversityT. McGill (Author/Creator) - Murdoch UniversityC. Payne (Author/Creator) - Murdoch University
- Publication Details
- ACM Transactions on Information and System Security, Vol.14(2), pp.1-28
- Publisher
- Association for Computing Machinery
- Identifiers
- 991005540115207891
- Copyright
- © 2011 ACM
- Murdoch Affiliation
- School of Information Technology
- Language
- English
- Resource Type
- Journal article
Metrics
2250 File views/ downloads
195 Record Views
InCites Highlights
These are selected metrics from InCites Benchmarking & Analytics tool, related to this output
- Citation topics
- 4 Electrical Engineering, Electronics & Computer Science
- 4.187 Security Systems
- 4.187.1404 Malware Detection
- Web Of Science research areas
- Computer Science, Information Systems
- ESI research areas
- Computer Science