Authors: Manish Gupta, Raj Sharman
Addresses: Department of Management Science and Systems, School of Management, State University of New York, Buffalo, NY, 14260, USA. ' Department of Management Science and Systems, School of Management, State University of New York, Buffalo, NY, 14260, USA
Abstract: Roles are convenient and powerful concept for facilitating access to distributed systems and for enforcing access management polices. Role-based access control (RBAC) is one of the most convenient and widely used role engineering models across enterprises. However, traditional role design process only factors in functional and job requirements of any user. Several threats arise due to insecure and inefficient design of roles when social and interaction dynamics in an organisational setting are ignored, where most activities are carried out a dynamic environment. Activity theory (AT) is one of the most applied and researched theories in context of understanding human actions, interactions with environments and dynamics against different social entities. The first section of the paper presents an overview of role engineering and AT concepts. Building on the concepts, the paper then presents methods in which AT can be applied for efficient and secure role engineering processes. A case study, carried out at a US based midsize financial institution, is also presented to demonstrate: 1) how traditional role engineering processes give way to threats; 2) how using AT methods can uncover some of the risks in role engineering process to mitigate risks.
Keywords: activity theory; role engineering; risk management; role-based access control; RBAC; access management; socio-cultural contexts; roles; role design processes; functional requirements; job requirements; insecure design; inefficient design; social dynamics; interaction dynamics; organisational settings; dynamic environments; human actions; social entities; USA; United States; financial institutions; threats; risk mitigation; business information systems.
International Journal of Business Information Systems, 2011 Vol.7 No.1, pp.60 - 77
Available online: 02 Dec 2010 *Full-text access for editors Access for subscribers Purchase this article Comment on this article