Conceptualizing a Responsibility based Approach for Elaborating and Verifying RBAC Policies Conforming with CobiT Framework Requirements

Christophe Feltus, Eric Dubois, Michaël Petit

Research output: Contribution in Book/Catalog/Report/Conference proceedingConference contribution

154 Downloads (Pure)

Abstract

The objective of this paper is to present the first results toward the definition of a two steps approach for aligning business level requirements issued from corporate framework such as CobiT down to technical policies such as the access rights modeled by RBAC. To achieve that, our approach is based on the concept of employees' responsibility. Using this concept is motivated by the importance and the omnipresence of the responsibility all along the company frameworks, from the CEO responsibilities such as in the financial sector as defined by Sarbanes-Oxley Act down to the responsibility at the operation layer such as the one of a trader who must follow stock quotes for private banking. The approach is illustrated based on an example, which highlights how access rights are assigned to employees having responsibilities defined at the CobiT framework layer.
Original languageEnglish
Title of host publicationProceedings of the Third International Workshop on Requirements Engineering and Law (RELAW10), in conjunction with RE 2010, Sydney, Australia
PublisherIEEE
Pages34-43
Number of pages10
ISBN (Print)978-1-4244-8761-5
DOIs
Publication statusPublished - 2010

    Fingerprint

Keywords

  • Alignment; CobiT; Responsibility; Traceability; Access right; RBAC; Requirement engineering.

Cite this

Feltus, C., Dubois, E., & Petit, M. (2010). Conceptualizing a Responsibility based Approach for Elaborating and Verifying RBAC Policies Conforming with CobiT Framework Requirements. In Proceedings of the Third International Workshop on Requirements Engineering and Law (RELAW10), in conjunction with RE 2010, Sydney, Australia (pp. 34-43). IEEE. https://doi.org/10.1109/RELAW.2010.5625355