Abstract
An innovative approach is proposed for aligning the different layers of the enterprise architecture of a European institution. The main objective of the alignment targets the definition and the assignment of the access rights needed by the employees according to business specifications. This alignment is realized by considering the responsibility and the accountabilities (doing, deciding and advising) of these employees regarding business tasks. Therefore, the responsibility (modeled in a responsibility metamodel) is integrated with the enterprise architecture metamodel using a structured method. The approach is illustrated and validated with a dedicated case study dealing with the definition of access rights assigned to employees involved in the user account provisioning and management processes.
Chapter PDF
Similar content being viewed by others
Keywords
References
Feltus, C., Petit, M., Vernadat, F.: Enhancement of CIMOSA with Responsibility Concept to Conform to Principles of Corporate Governance of IT. In: 13th IFAC Symposium on Information Control Problems in Manufacturing (INCOM 2009), Moscow, Russia (2009)
Feltus, C., Petit, M., Dubois, E.: Strengthening employee’s responsibility to enhance governance of IT: COBIT RACI chart case study. In: 1st ACM Workshop on Information Security Governance. ACM, New York (2009)
Clark, D., Wilson, R.: A comparison of commercial and military computer security policies. In: IEEE Symposium on Security and Privacy, p. 184 (1987)
Covington, M.J., Long, W., Srinivasan, S., Dev, A.K., Ahamad, M., Abowd, G.D.: Securing context-aware applications using environment roles. In: Symposium on Access Control Models And Technologies (SACMAT 2001), New York, NY, USA, pp. 10–20 (2001)
Ferraiolo, F., Sandhu, R., Gavrila, S., Kuhn, D.R., Chandramouli, R.: Proposed nist standard for role-based access control. ACM Trans. Inf. Syst. Secur. 4(3), 224–274 (2001)
Karp, A.H., Haury, H., Davis, M.H.: From abac to zbac: The evolution of access control models. Control (2009)
Covington, M.J., Sastry, M.R.: A Contextual Attribute-Based Access Control Model. In: Meersman, R., Tari, Z., Herrero, P. (eds.) OTM Workshops 2006, Part II. LNCS, vol. 4278, pp. 1996–2006. Springer, Heidelberg (2006)
Lang, B., Foster, I., Siebenlist, F., Ananthakrishnan, R., Freeman, T.: A flexible attribute based access control method for grid computing. Journal of Grid Computing 7(2), 169–180 (2008)
Crook, R., Ince, D., Nuseibeh, B.: Modelling access policies using roles in requirements engineering. Information and Software Technology 45(14), 979–991 (2003)
He, Q., Anton, A.I.: A framework for privacy-enhanced access control analysis in requirements engineering. In: Proc. of the 9th Requirements Engineering Foundation for Software Quality (REFSQ 09) (2003)
Neumann, G., Strembeck, M.: A scenario-driven role engineering process for functional rbac roles. In: SACMAT 2002. ACM, New York (2002)
Lankhorst, M. (ed.), the ArchiMate team: ArchiMate Language Primer (2004)
Zachman, J.A.: The Zachman Framework For Enterprise Architecture: Primer for Enterprise Engineering and Manufacturing. Engineering, 1–11 (July 2003)
The Open Group. TOGAF (The Open Group Architecture Framework) (2009)
Feltus, C., Petit, M., Sloman, M.: Enhancement of Business IT Alignment by Including Responsibility Components in RBAC. In: 5th Busital Workshop, Hammamet, Tunisia (2010)
Feltus, C., Petit, M., Dubois, E.: ReMoLa: Responsibility Model Language to Align Access Rights with Business Process Requirements. In: Fifth International Conference on Research Challenges in Information Science (RCIS 2011), Gosier, Guadeloupe, May 19-21 (2011)
Petit, M.: Some methodological clues for defining a unified enterprise modelling language. In: Proc. of the International Conference on Enterprise Integration Modeling Technology (ICEIMT 2001), Deventer, The Netherlands, pp. 359–369 (2003)
Feltus, C., Dubois, E., Proper, E., Band, I., Petit, M.: Enhancing the ArchiMate® Standard with a Responsibility Modeling Language for Access Rights Management. In: Proc. of the 5th ACM International Conference on Security of Information and Networks (SIN 2012), India (2012)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2012 IFIP International Federation for Information Processing
About this paper
Cite this paper
Petit, M., Feltus, C., Vernadat, F. (2012). Enterprise Architecture Enhanced with Responsibility to Manage Access Rights - Case Study in an EU Institution. In: Sandkuhl, K., Seigerroth, U., Stirna, J. (eds) The Practice of Enterprise Modeling. PoEM 2012. Lecture Notes in Business Information Processing, vol 134. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-34549-4_10
Download citation
DOI: https://doi.org/10.1007/978-3-642-34549-4_10
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-34548-7
Online ISBN: 978-3-642-34549-4
eBook Packages: Computer ScienceComputer Science (R0)