Separation, review and supervision controls in the context of a credit application process: a case study of organisational control principles

ABSTRACT

This paper presents a case study of the organisational control principles present in a credit application process at the branch level of a bank. The case study has been performed in the context of an earlier suggested formal framework [6] for organisational control principles based on the Alloy predicate logic and its facilities for automated formal analysis and exploration [2].In particular, we establish and validate the novel concepts of specific and general obligations. The delegation of these two kinds of obligations must be controlled by means of review and supervision controls. The example of a credit application process is used to discuss these organisational controls.

REFERENCES

• 1: Andreas Schaad , Jonathan D. Moffett, A Framework for Organisational Control Principles, Proceedings of the 18th Annual Computer Security Applications Conference, p.229, December 09-13, 2002
• 2: Daniel Jackson , Ilya Shlyakhter , Manu Sridharan, A micromodularity mechanism, Proceedings of the 8th European software engineering conference held jointly with 9th ACM SIGSOFT international symposium on Foundations of software engineering, September 10-14, 2001, Vienna, Austria
• 3: A. Schaad , J. Moffett, Delegation of Obligations, Proceedings of the 3rd International Workshop on Policies for Distributed Systems and Networks (POLICY'02), p.25, June 05-07, 2002
• 4: Andreas Schaad , Jonathan Moffett , Jeremy Jacob, The role-based access control system of a European bank: a case study and discussion, Proceedings of the sixth ACM symposium on Access control models and technologies, p.3-9, May 2001, Chantilly, Virginia, United States [doi>10.1145/373256.373257]
• 5: Axel Kern , Andreas Schaad , Jonathan Moffett, An administration concept for the enterprise role-based access control model, Proceedings of the eighth ACM symposium on Access control models and technologies, June 02-03, 2003, Como, Italy [doi>10.1145/775412.775414]
• 6: Schaad, A., A Framework for Organisational Control Principles, in Department of Computer Science. 2003, University of York.
• 7: Jean Bacon , Ken Moody, Toward open, secure, widely distributed services, Communications of the ACM, v.45 n.6, June 2002 [doi>10.1145/508448.508475]
• 8: Naftaly H. Minsky , Victoria Ungureanu, Law-governed interaction: a coordination and control mechanism for heterogeneous distributed systems, ACM Transactions on Software Engineering and Methodology (TOSEM), v.9 n.3, p.273-305, July 2000 [doi>10.1145/352591.352592]
• 9: D. Richard Kuhn, Mutual exclusion of roles as a means of implementing separation of duty in role-based access control systems, Proceedings of the second ACM workshop on Role-based access control, p.23-30, November 06-07, 1997, Fairfax, Virginia, United States [doi>10.1145/266741.266749]
• 10: Gligor, V., S. Gavrila, and D. Ferraiolo. On the Formal Definition of Separation-of-Duty Policies and their Composition. in IEEE Symposium on Security and Privacy. 1998. Oakland, CA.
• 11: Urwick, L., Notes on the Theory of Organization. 1952: American Management Association.
• 12: Nicodemos Damianou , Naranker Dulay , Emil Lupu , Morris Sloman, The Ponder Policy Specification Language, Proceedings of the International Workshop on Policies for Distributed Systems and Networks, p.18-38, January 29-31, 2001
• 13: Ravi S. Sandhu , Edward J. Coyne , Hal L. Feinstein , Charles E. Youman, Role-Based Access Control Models, Computer, v.29 n.2, p.38-47, February 1996 [doi>10.1109/2.485845]
• 14: Longhua Zhang , Gail-Joon Ahn , Bei-Tseng Chu, A rule-based framework for role based delegation, Proceedings of the sixth ACM symposium on Access control models and technologies, p.153-162, May 2001, Chantilly, Virginia, United States [doi>10.1145/373256.373289]
• 15: Jason Crampton, Administrative scope and role hierarchy operations, Proceedings of the seventh ACM symposium on Access control models and technologies, June 03-04, 2002, Monterey, California, USA [doi>10.1145/507711.507736]
• 16: Ravi Sandhu , Venkata Bhamidipati , Qamar Munawer, The ARBAC97 model for role-based administration of roles, ACM Transactions on Information and System Security (TISSEC), v.2 n.1, p.105-135, Feb. 1999 [doi>10.1145/300830.300839]
• 17: Andreas Schaad , Jonathan D. Moffett, A lightweight approach to specification and analysis of role-based access control extensions, Proceedings of the seventh ACM symposium on Access control models and technologies, June 03-04, 2002, Monterey, California, USA [doi>10.1145/507711.507714]
• 18: A. Schaad, Detecting Conflicts in a Role-Based Delegation Model, Proceedings of the 17th Annual Computer Security Applications Conference, p.117, December 10-14, 2001

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.1 MODELS AND PRINCIPLES

Keywords:
control principles, delegation of obligation, management, review, roles, security, supervision