A procedure model for enterprise-wide authorization architecture

Association for Information Systems - 12th Americas Conference On Information Systems, AMCIS 2006

Volumn 4, Issue , 2006, Pages 2405-2414

  Wortmann, Felix ^a   Winter, Robert ^a  

^a UNIVERSITY OF ST GALLEN   (Switzerland)

Author keywords

Access control; Architecture; Authorization; Procedure model

Indexed keywords

AUTHORIZATION; AUTHORIZATION ARCHITECTURE; GENERICITY; INDUSTRY PRACTICES; IT SYSTEM; ORGANIZATIONAL UNITS; REFERENCE MODELS; THEORETICAL FOUNDATIONS;

ACCESS CONTROL; ARCHITECTURE;

INFORMATION SYSTEMS;

EID: 84870198364     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (25)

1. A-SIT (2004). Österreichisches IT-Sicherheitshandbuch - IT-Sicherheitsmanagement, http://www.asit.at/unterstuetzung/sicherheitshdb/OE-IT-SIHB_V2_2_Teil1.pdf, last accessed on 2005-02-17
2. Birkhölzer, T., Vaupel, J. (2003). IT-Architekturen - Planung, Integration, Wartung. Berlin: VDE.
3. BITKOM (2005). Kompass der IT-Sicherheitsstandards, http://www.bitkom.org/files/documents/BITKOM_Broschuere_Sicherheitsstandard_V1.01f.pdf, last accessed on 15.07.2005
4. Braun, C. and Wortmann, F. and Hafner, M., Winter, R. (2005). Method Construction - A Core Approach to Organizational Engineering, Santa Fe, 1295-1299.
5. Brocke vom, J. (2003). Referenzmodellierung - Gestaltung und Verteilung von Konstruktionsprozessen. Berlin: Logos.
6. BSI (2004). IT-Grundschutzhandbuch, http://www.bsi.de/gshb/deutsch/menue.htm, last accessed on 17.02.2005
7. Congress of the United States of America (2002). The Sarbanes-Oxley Act of 2002, http://news.findlaw.com/hdocs/docs/gwbush/sarbanesoxley072302.pdf, last accessed on 2005-12-06
8. Hafner, M. (2005). Entwicklung einer Methode für das Management der Informationssystemarchitektur im Unternehmen, Dissertation, Universität St. Gallen, St. Gallen, 2005
9. Hartje, H. and Probst, U. and Jäck, K., Hessler, M. (2003). SAP Berechtigungswesen - Design und Realisierung von Berechtigungskonzepten für SAP R/3 und SAP Enterprise Portal. Bonn: Galileo Press.
10. ISO (1997). ISO/IEC TR 13335-2 - Guidelines for the Management of IT Security - Managing and Planning IT Security, http://www.iso.org/iso/en/CatalogueDetailPage.CatalogueDetail?CSNUMBER=21755&ICS1=35&ICS2=40&ICS3=&scopelist=, last accessed on 2005-08-12
11. ISO (2000). ISO/IEC 17799 - Code of Practice for Information Security Management, http://www.iso.ch/iso/en/prodsservices/popstds/.../fr/CatalogueDetailPage.CatalogueDetail?CSNUMBER=33441&ICS1=35, last accessed on 2004-03-01
12. Jonscher, D., Dittrich, K. (1994). Realisierung von Sicherheitsstrategien mit Hilfe flexibler Zugriffskontrollmechanismen. In: Bauknecht, K.Dittrich, K. (eds.). Sicherheit in Informationssystemen. Zürich: vdf, 23-52.
13. Kern, A., Kuhlmann, M., Kuropka, R., Ruthert, A. (2004). A Meta Model for Authorisations in Application Security Systems and Their Integration into RBAC Administration, Yorktown Heights, 87-96.
14. Kern, A., Kuhlmann, M., Schaad, A., Moffett, J.D. (2002). Observations on the Role Life-Cycle in the Context of Enterprise Security Management, Proceedings of the 7th ACM Symposium on Access Control Models and Technologies, Monterey, 43-51.
15. Kuhlmann, M. and Shohat, D., Schimpf, G. (2003). Role Mining - Revealing Business Roles for Security Administration Using Data Mining Technology, Proceedings of the 8th ACM Symposium on Access Control Models and Technologies, Como, 179-186.
16. Menzies, C. and Martin, A. and Jourdan, C., Koch, M., Strohm, A., Heinze, T. (2004). Sarbanes-Oxley Act. Stuttgart: Schäffer-Poeschel.
17. Pernul, G. (1995). Information Systems Security - Scope, State-of-the-art and Evaluation of Techniques. International Journal of Information Management, 15 (3), 165-180.
18. Robinson, T. (2005). Data Security in the Age of Compliance. netWorker, 9 (3), 24-30.
19. Roeckle, H. and Schimpf, G., Weidinger, R. (2000). Process-Oriented Approach for Role-Finding to Implement Role-Based Security Administration in a Large Industrial Organization, Proceedings of the 5th ACM Workshop on Role-Based Access Control, Berlin, 103-110.
20. Rupprecht, J., Wortmann, F. (2006). Zugriffskontrolle in heterogenen Applikationslandschaften. In: Schelp, J.Winter, R. (eds.). Integrations management. Berlin: Springer, 123-168.
21. Samarati, P., de Capitani di Vimercati, S. (2002). Access Control - Policies, Models and Mechanisms. In: Focardi, R.Gorrieri, R. (eds.). Foundations of Security Analysis and Design - Tutorial Lectures. Berlin: Springer, 137-196.
22. Schütte, R. (1998). Grundsätze ordnungsmässiger Referenzmodellierung. Wiesbaden: Gabler.
23. vom Brocke, J. (2003). Referenzmodellierung - Gestaltung und Verteilung von Konstruktionsprozessen. Berlin: Logos.
24. Winter, R. (2003). An Architecture Model for Supporting Application Integration Decisions, Neapel.
25. Wortmann, F. (2006). Entwicklung einer Methode für die unternehmensweite Autorisierung, Dissertation, Universität St. Gallen, St. Gallen, 2006