{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T04:31:11Z","timestamp":1750307471454,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":40,"publisher":"ACM","license":[{"start":{"date-parts":[[2010,9,7]],"date-time":"2010-09-07T00:00:00Z","timestamp":1283817600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2010,9,7]]},"DOI":"10.1145\/1854099.1854115","type":"proceedings-article","created":{"date-parts":[[2010,9,7]],"date-time":"2010-09-07T15:48:28Z","timestamp":1283874508000},"page":"62-70","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":7,"title":["A calculus for the qualitative risk assessment of policy override authorization"],"prefix":"10.1145","author":[{"given":"Steffen","family":"Bartsch","sequence":"first","affiliation":[{"name":"Universit\u00e4t Bremen, Bremen, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2010,9,7]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.21236\/ADA634134"},{"key":"e_1_3_2_1_2_1","volume-title":"Report to the nation on occupational fraud & abuse","author":"Association of Certified Fraud Examiners (ACFE).","year":"2006","unstructured":"Association of Certified Fraud Examiners (ACFE). Report to the nation on occupational fraud & abuse . 2006 . Association of Certified Fraud Examiners (ACFE). Report to the nation on occupational fraud & abuse. 2006."},{"key":"e_1_3_2_1_3_1","volume-title":"Audit Commission Publication","author":"Audit Commission","year":"1994","unstructured":"Audit Commission . Opportunity Makes a Thief: an Analysis of Computer Abuse . Audit Commission Publication , London, UK , 1994 . Audit Commission. Opportunity Makes a Thief: an Analysis of Computer Abuse. Audit Commission Publication, London, UK, 1994."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSFW.1990.128192"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/162124.162127"},{"key":"e_1_3_2_1_6_1","volume-title":"CA","author":"Britton D. W.","year":"2007","unstructured":"D. W. Britton and I. A. Brown . A security risk measurement for the RAdAC model. Master's thesis. Naval Postgraduate School Monterey , CA , March 2007 . D. W. Britton and I. A. Brown. A security risk measurement for the RAdAC model. Master's thesis. Naval Postgraduate School Monterey, CA, March 2007."},{"key":"e_1_3_2_1_7_1","unstructured":"Bundesamt f\u00fcr Sicherheit in der Informationstechnik (BSI). BSI-Standard 100-2. IT-Grundschutz-Vorgehensweise. Version 2.0 2008.  Bundesamt f\u00fcr Sicherheit in der Informationstechnik (BSI). BSI-Standard 100-2. IT-Grundschutz-Vorgehensweise. Version 2.0 2008."},{"key":"e_1_3_2_1_9_1","volume-title":"Common sense guide to prevention and detection of insider threats","author":"Cappelli D.","year":"2009","unstructured":"D. Cappelli , A. Moore , R. F. Trzeciak , and T. J. Shimeall . Common sense guide to prevention and detection of insider threats 3 rd edition - version 3.1 Technical report, CarnegieMellon , January 2009 . D. Cappelli, A. Moore, R. F. Trzeciak, and T. J. Shimeall. Common sense guide to prevention and detection of insider threats 3rd edition - version 3.1 Technical report, CarnegieMellon, January 2009.","edition":"3"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2007.21"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/IAW.2005.1495966"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1136\/bmj.318.7194.1328"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/ECUMN.2007.19"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/990036.990062"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9780511808098"},{"key":"e_1_3_2_1_16_1","first-page":"519","article-title":"The use of knowledge in society","volume":"35","author":"Hayek F. A.","year":"1945","unstructured":"F. A. Hayek . The use of knowledge in society . American Economic Review , 35 : 519 -- 530 , September 1945 . Reprinted in F.A. Hayek (ed.), Individualism and Economic Order. London: Routledge and Kegan Paul. F. A. Hayek. The use of knowledge in society. American Economic Review, 35:519--530, September 1945. Reprinted in F.A. Hayek (ed.), Individualism and Economic Order. London: Routledge and Kegan Paul.","journal-title":"American Economic Review"},{"key":"e_1_3_2_1_17_1","first-page":"2009","article-title":"Break glass procedure: Granting emergency access to critical ePHI systems","volume":"1","author":"HIPAA","year":"2009","unstructured":"HIPAA . Break glass procedure: Granting emergency access to critical ePHI systems . Retrieved on Jan , 1 , 2009 , 2009 . HIPAA. Break glass procedure: Granting emergency access to critical ePHI systems. Retrieved on Jan, 1, 2009, 2009.","journal-title":"Retrieved on Jan"},{"key":"e_1_3_2_1_18_1","volume-title":"In Proceedings of the INFORMS Conference on Information Systems and Technology","author":"Jaisingh J.","year":"2001","unstructured":"J. Jaisingh and J. Rees . Value at risk: A methodology for information security risk assessment . In In Proceedings of the INFORMS Conference on Information Systems and Technology , 2001 . J. Jaisingh and J. Rees. Value at risk: A methodology for information security risk assessment. In In Proceedings of the INFORMS Conference on Information Systems and Technology, 2001."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2004.07.004"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"crossref","unstructured":"A. K.\n      Lenstra\n     and \n      T.\n      Voss\n  . \n  Information security risk assessment aggregation and mitigation\n  . In H. Wang J. Pieprzyk and V. Varadharajan editors ACISP volume \n  3108\n   of \n  Lecture Notes in Computer Science pages \n  391\n  --\n  401\n  . \n  Springer 2004\n  .  A. K. Lenstra and T. Voss. Information security risk assessment aggregation and mitigation. In H. Wang J. Pieprzyk and V. Varadharajan editors ACISP volume 3108 of Lecture Notes in Computer Science pages 391--401. Springer 2004.","DOI":"10.1007\/978-3-540-27800-9_34"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/344287.344304"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0167-4048(02)00109-8"},{"key":"e_1_3_2_1_23_1","volume-title":"UGA-CS-LDIS","author":"Miller J. A.","year":"1999","unstructured":"J. A. Miller , M. Fan , S. Wu , I. B. Arpinar , A. P. Sheth , and K. J. Kochut . Security for the METEOR workflow management system. Technical report , UGA-CS-LDIS , University of Georgia , 1999 . J. A. Miller, M. Fan, S. Wu, I. B. Arpinar, A. P. Sheth, and K. J. Kochut. Security for the METEOR workflow management system. Technical report, UGA-CS-LDIS, University of Georgia, 1999."},{"key":"e_1_3_2_1_25_1","volume-title":"NIST","author":"NIST.","year":"1975","unstructured":"NIST. Fips 65 : Guidelines for automatic data processing risk analysis. Technical report , NIST , 1975 . NIST. Fips 65: Guidelines for automatic data processing risk analysis. Technical report, NIST, 1975."},{"key":"e_1_3_2_1_26_1","volume-title":"NIST","author":"NIST.","year":"1994","unstructured":"NIST. Fips 191 : Guideline for the analysis local area network security. Technical report , NIST , 1994 . NIST. Fips 191: Guideline for the analysis local area network security. Technical report, NIST, 1994."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"crossref","DOI":"10.1201\/9781420031195","volume-title":"Information security risk analysis","author":"Peltier T. R.","year":"2005","unstructured":"T. R. Peltier . Information security risk analysis . CRC press , 2005 . T. R. Peltier. Information security risk analysis. CRC press, 2005."},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/335169.335188"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1007\/11861386_38"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2006.8"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/PROC.1975.9939"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/2.485845"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0167-4048(02)01009-X"},{"key":"e_1_3_2_1_35_1","volume-title":"Computer security: principles and practice","author":"Stallings W.","year":"2008","unstructured":"W. Stallings and L. Brown . Computer security: principles and practice . Pearson Prentice Hall , 2008 . W. Stallings and L. Brown. Computer security: principles and practice. Pearson Prentice Hall, 2008."},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/587078.587106"},{"key":"e_1_3_2_1_37_1","volume-title":"Risk management guide for information technology systems - NIST special publication 800-30. Technical report","author":"Stoneburner G.","year":"2002","unstructured":"G. Stoneburner , A. Goguen , and A. Feringa . Risk management guide for information technology systems - NIST special publication 800-30. Technical report , National Institute of Standards and Technology , 2002 . G. Stoneburner, A. Goguen, and A. Feringa. Risk management guide for information technology systems - NIST special publication 800-30. Technical report, National Institute of Standards and Technology, 2002."},{"key":"e_1_3_2_1_38_1","volume-title":"Insight Consulting","author":"Manager The CRAMM","year":"2005","unstructured":"The CRAMM Manager . Cramm user guide issue 5.1. Technical report , Insight Consulting , 2005 . The CRAMM Manager. Cramm user guide issue 5.1. Technical report, Insight Consulting, 2005."},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.infoandorg.2006.08.001"},{"issue":"4","key":"e_1_3_2_1_40_1","article-title":"Opportunities for computer crime: considering systems risk froma criminological perspective","volume":"15","author":"Willison R.","year":"2006","unstructured":"R. Willison and J. Backhouse . Opportunities for computer crime: considering systems risk froma criminological perspective . European Journal , 15 ( 4 ), 2006 . R. Willison and J. Backhouse. Opportunities for computer crime: considering systems risk froma criminological perspective. European Journal, 15(4), 2006.","journal-title":"European Journal"},{"key":"e_1_3_2_1_41_1","volume-title":"Research on Mitigating the Insider Threat to Information Systems #2. RAND","author":"Wood B.","year":"2000","unstructured":"B. Wood . An insider threat model for adversary simulation. In R. H. Anderson, T. Bozek, T. Longsta, W. Meitzler, M. Skroch, and K. Van Wyk, editors, Research on Mitigating the Insider Threat to Information Systems #2. RAND , 2000 . B. Wood. An insider threat model for adversary simulation. In R. H. Anderson, T. Bozek, T. Longsta, W. Meitzler, M. Skroch, and K. Van Wyk, editors, Research on Mitigating the Insider Threat to Information Systems #2. RAND, 2000."},{"key":"e_1_3_2_1_42_1","volume-title":"WISE 2008: Twentieth Workshop on Information Systems and Economics","author":"Zhao X.","year":"2008","unstructured":"X. Zhao and M. E. Johnson . Access flexibility with escalation and audit . In WISE 2008: Twentieth Workshop on Information Systems and Economics , 2008 . X. Zhao and M. E. Johnson. Access flexibility with escalation and audit. In WISE 2008: Twentieth Workshop on Information Systems and Economics, 2008."},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-09762-6_8"}],"event":{"name":"SIN '10: 3rd International Conference of Security of Information and Networks","sponsor":["Microsoft Microsoft","RFBR Russian Foundation for Basic Research","SIGSAC ACM Special Interest Group on Security, Audit, and Control","Macquarie U., Austarlia","Darmstadt U., Germany","TBD, North Cyprus","TIT, South. Fed. U., Russia","Taganrog Institute of Technologies"],"location":"Taganrog Rostov-on-Don Russian Federation","acronym":"SIN '10"},"container-title":["Proceedings of the 3rd international conference on Security of information and networks"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1854099.1854115","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1854099.1854115","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T12:08:43Z","timestamp":1750248523000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1854099.1854115"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2010,9,7]]},"references-count":40,"alternative-id":["10.1145\/1854099.1854115","10.1145\/1854099"],"URL":"https:\/\/doi.org\/10.1145\/1854099.1854115","relation":{},"subject":[],"published":{"date-parts":[[2010,9,7]]},"assertion":[{"value":"2010-09-07","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}