IT security is a vital task; user authentication a fundamental part. Yet the policies to implement user authentication often have a poor cost/benefit ratio. This paper (i) analyzes the costs of typical user authentication policies based on interviews with large Austrian IT providers. It (ii) then elaborates on how the policies are chosen, focusing on a lack of real cost accounting, and riskaverse principal agents in the security departments.
['Ludwig Meyer', 'Martin Auer', 'Markus D. Klemen', 'Stefan Biffl']
Hidden Price of User Authentication: Cost Analysis and Stakeholder Motivation