Cloudy with a Chance of Misconceptions: Exploring Users' Perceptions and Expectations of Security and Privacy in Cloud Office Suites

Abstract

Cloud Office suites such as Google Docs or Microsoft Office 365 are widely used and introduce security and privacy risks to documents and sensitive user information. Users may not know how, where and by whom their documents are accessible and stored, and it is currently unclear how they understand and mitigate risks.

We conduct surveys with 200 cloud office users from the U.S. and Germany to investigate their experiences and behaviours with cloud office suites. We explore their se- curity and privacy perceptions and expectations, as well as their intuitions for how cloud office suites should ideally han- dle security and privacy.

We find that our participants seem to be aware of basic general security implications, storage models, and access by others, although some of their threat models seem underdeveloped, often due to lacking technical knowledge. Our participants have strong opinions on how comfortable they are with the access of certain parties, but are somewhat unsure about who actually has access to their docu- ments. Based on our findings, we distill recommendations for different groups associated with cloud office suites, which can help inform future standards, regulations, implementations, and configuration options.

Reference

@inproceedings{conf/soups/wermke20,
 author = {Dominik Wermke and
Christian Stransky and
Nicolas Huaman and
Niklas Busch and
Yasemin Acar and
Sascha Fahl},
 booktitle = {Sixteenth Symposium on Usable Privacy and Security, SOUPS 2020, August 12-14, 2020},
 month = {Aug},
 title = {Cloudy with a Chance of Misconceptions: Exploring Users' Perceptions and Expectations of Security and Privacy in Cloud Office Suites},
 url = {https://www.usenix.org/conference/soups2020/presentation/wermke},
 year = {2020}
}