![](bga.png)
Cohen, J. (1988). Statistical power analysis for the behav-
ioral sciences lawrence earlbaum associates. Hills-
dale, NJ, pages 20–26.
Crampton, J., Morisset, C., and Zannone, N. (2015).
On missing attributes in access control: Non-
deterministic and probabilistic attribute retrieval. In
SACMAT, pages 99–109. ACM.
Eick, S. G. and Wills, G. J. (1993). Navigating large net-
works with hierarchies. In IEEE Conference on Visu-
alization, 1993., pages 204–210.
Fisler, K., Krishnamurthi, S., Meyerovich, L. A., and
Tschantz, M. C. (2005). Verification and change-
impact analysis of access-control policies. In Pro-
ceedings of the 27th International Conference on Soft-
ware Engineering, ICSE ’05, pages 196–205, New
York, NY, USA. ACM.
Heydon, A., Maimone, M. W., Tygar, J. D., Wing, J. M., and
Zaremski, A. M. (1990). Miro: visual specification of
security. IEEE Transactions on Software Engineering,
16(10):1185–1197.
Johnson, B. and Shneiderman, B. (1991). Tree-maps: A
space-filling approach to the visualization of hierar-
chical information structures. In Proceedings of the
2nd Conference on Visualization ’91, pages 284–291,
Los Alamitos, CA, USA. IEEE.
Kirlappos, I. and Sasse, M. A. (2014). HAS 2014, chap-
ter What Usable Security Really Means: Trusting and
Engaging Users, pages 69–78. Springer.
Kolovski, V. (2007). Logic-based access control policy
specification and management. Technical report, De-
partment of Computer Science, University of Mary-
land, College Park.
Lacey, D. (2009). Managing the Human Factor in Infor-
mation Security: How to Win over Staff and Influence
Business Managers. Wiley Publishing.
Lampson, B. W. (1974). Protection. Operating Systems
Review, 8(1):18–24.
MacLean, A., Barnard, P., and Wilson, M. (1985). Eval-
uating the human interface of a data entry system:
user choice and performance measures yield different
tradeoff functions. People and computers: Designing
the interface, 5:45–61.
Meyer, M. (2011). Information visualization for scientific
discovery.
Montemayor, J., Freeman, A., Gersh, J., Llanso, T., and Pa-
trone, D. (2006). Information visualization for rule-
based resource access control. In Proc. of Int. Sympo-
sium on Usable Privacy and Security (SOUPS), pages
24–0.
Morisset, C. and Zannone, N. (2014). Reduction of access
control decisions. In SACMAT, pages 53–62. ACM.
Nergaard, H., Ulltveit-Moe, N., and Gjøsæter, T. (2015).
ViSPE: A Graphical Policy Editor for XACML, pages
107–121. Springer International Publishing, Cham.
Nielsen, J. (1993). Usability Engineering. Morgan Kauf-
mann Publishers Inc., San Francisco, CA, USA.
Nielsen, J. and Levy, J. (1994). Measuring usability: Prefer-
ence vs. performance. Commun. ACM, 37(4):66–75.
Pan, L., Liu, N., and Zi, X. (2013). Visualization frame-
work for inter-domain access control policy integra-
tion. China Communications, 10(3):67–75.
Pan, L. and Xu, Q. (2012). Visualization analysis of multi-
domain access control policy integration based on
tree-maps and semantic substrates. Intelligent Infor-
mation Management, 4(5):188–193.
Pina Ros, S., Lischka, M., and G
´
omez M
´
armol, F. (2012).
Graph-based xacml evaluation. In Proceedings of the
17th ACM Symposium on Access Control Models and
Technologies, SACMAT ’12, pages 83–92, New York,
NY, USA. ACM.
PwC (2015). 2015 information security breaches survey.
Technical report, HM Government and PwC Consult-
ing and Infosecurity Europe.
Rao, P., Ghinita, G., Bertino, E., and Lobo, J. (2009). Vi-
sualization for access control policy analysis results
using multi-level grids. In IEEE International Sym-
posium on Policies for Distributed Systems and Net-
works, 2009., pages 25–28.
Rissanen, E., Lockhart, H., and Moses, T. (2009). Xacml
v3. 0 administration and delegation profile version 1.0.
Committee Draft, 1.
Ritter, F. E., Baxter, G. D., and Churchill, E. F. (2014).
Foundations for Designing User-Centered Systems.
Springer, Springer London Heidelberg New York Dor-
drecht.
Rosa, W. D. (2009). Toward visualizing potential policy
conflicts in extensible access control markup language
(xacml). Theses and dissertations, University of New
Orleans, New Orleans.
Sackmann, S. and K
¨
ahmer, M. (2008). Expdt: Ein policy-
basierter ansatz zur automatisierung von compliance.
Wirtschaftsinformatik, 50(5):366–374.
Standard, O. (2005). extensible access control markup lan-
guage (xacml) version 2.0.
Stepien, B., Matwin, S., and Felty, A. Strategies for reduc-
ing risks of inconsistencies in access control policies.
Trudeau, S., Sinclair, S., and Smith, S. W. (2009). The ef-
fects of introspection on creating privacy policy. In
WPES ’09: Proceedings of the 8th ACM workshop
on Privacy in the electronic society, pages 1–10, New
York, NY, USA. ACM.
Vaniea, K., Ni, Q., Cranor, L., and Bertino, E. (2008). Ac-
cess control policy analysis and visualization tools for
security professionals. In SOUPS Workshop (USM).
Wang, W., Wang, H., Dai, G., and Wang, H. (2006). Visu-
alization of large hierarchical data by circle packing.
In Proceedings of the SIGCHI Conference on Human
Factors in Computing Systems, CHI ’06, pages 517–
520, New York, NY, USA. ACM.
ICISSP 2018 - 4th International Conference on Information Systems Security and Privacy
126