RELAW 2010 _ Conceptualizing a Responsibility Based Approach for Elaborating and Verifying RBAC Policies Conforming With CobiT Framework Requirements

8/12/2019 RELAW 2010 _ Conceptualizing a Responsibility Based Approach for Elaborating and Verifying RBAC Policies Conforming With CobiT Framework Requirements

1/26

Conceptualizing a Responsibility based Approach for

Elaborating and Verifying RBAC Policies Conforming

with CobiT Framework Requirements

Christophe Feltus, Eric Dubois, Michal Petit

Third International Workshop on Requirements Engineering and Law

(RELAW 10) - September 28th2010


2/26

Motivation

The concept of role Business role

Application role

Governance requirements


3/26

Motivation

Our approach The method that we target is a 2 steps approach


4/26

Outlines

Presentation of the Responsibility meta-model Mapping with CobiT

Mapping with RBAC

Example of assignment process

Conclusions and future works


5/26

Outlines


Mapping with RBAC




6/26

Presentation of the Responsibility meta-

model

Elaboration of the model Employee, right, obligation, commitment and behavior


7/26

Presentation of the Responsibility meta-

model

Elaboration of the model Employee, right, obligation, commitment and behavior


8/26

Concept of obligation/accountability


9/26

Concept of right


10/26

Assignment/delegation process


11/26

Outlines


Mapping with RBAC




12/26

Building the responsibilities

Responsibility in CobiT are represented using a RACIchart

AI6:Manage Change

160 possibilities

Same rights and obligations to all employees ?

Need more precisions


13/26

Collect of tasks

Responsibilities from CobiT

Instantiation with CobiT informations :

4 responsibilities, business role (from RACI) and tasks (partially)


14/26

Responsibilities to tasks association

From CobiT:

From ITIL:

From the company:

is the employee who gets the action done

is the employee, who provides direction and

authorizes an action


15/26

Rights to tasks association

From CobiT:


16/26

Outlines


Mapping with RBAC




17/26

Role Based Access Control To simplify the management of granting permissions to

users

3 main elements :

User, Role and Permission

2 main functions :

User-role

assignment (URA)

Permission-role

assignment (PRA)

RBAC :


18/26

Mapping responsibility to RBAC role

Business role from Cobit = RBAC concept of role ? No, because :

Cobit Role (or Business role): an employee assigned to that role

is not obligatory assigned responsible for all the task of therole.

RBAC Role (or Application role): an employee assigned to that

role gets all the permissions needed by that role.

If Business role = applictaion role, some employees receives to

much permissions.


19/26



20/26



21/26

Outlines


Mapping with RBAC




22/26


Task : Prioritizing changes That task corresponds to one responsibility of being

responsible of activityAssess impact and prioritizing changes

Following RACI chart : that activity is assigned to the

business roles : BPO, PMO, Head operation, Head development


23/26


Suppose Bob one BPO identified by the CobiT manager

RBAC adminsitrator may assigned for that task:


24/26

Outlines


Mapping with RBAC




25/26


Business needs for a better alignement of the employeesresponsibility from the management frameworks down to

the technical rules

Our approach is to use the responibility as a pivite between

high layer requirements down to techical rules. Step 1: Responsibility building :

Business Role, Activities, Tasks, and Rights Responsibilities

Step 2 : Responsibility assignment :

Responsibilities, Employees, CommitmentApplication roles assigned to users


26/26

Thank you ! Questions ?

RELAW 2010 _ Conceptualizing a Responsibility Based Approach for Elaborating and Verifying RBAC Policies Conforming With CobiT Framework Requirements

Documents