Role engineering for enterprise security management

Role Engineering forEnterprise Security Management......Page 2
Contents......Page 6
Background for the Book......Page 20
Role-Based Access Control......Page 22
Role Engineering......Page 23
How the Book Can Be Used......Page 24
References......Page 27
2 The Business Case for Role-Based Access Control......Page 28
Security Requirements......Page 29
Return on Investment......Page 30
The Security Case......Page 36
The Compliance Case......Page 37
References......Page 39
References......Page 51
3 Role Engineering in the Phases of the System Development Life Cycle......Page 40
Conducting a Role Engineering Effort as an Independent Activity......Page 41
Conducting a Role Engineering Effort in Conjunction with a System Development Effort......Page 42
What Is Role Engineering?......Page 52
An Example of Incorrect Engineering......Page 54
Sources of Roles......Page 57
Access Control Policy......Page 59
Role Names and Permissions......Page 60
Non-RBAC Support of the Access Control Policy......Page 62
Resources Subject to RBAC......Page 64
Constraints......Page 65
Use of Hierarchies......Page 66
Realization of Roles in IT Systems......Page 67
Role Engineering as Requirements Engineering......Page 70
Role Engineering as Systems Engineering......Page 72
References......Page 76
5 Defining Good Roles......Page 78
Types of Roles......Page 79
Role Engineering Guidelines......Page 80
Objects to Be Protected......Page 82
Identifying Protected Objects......Page 84
Role Names......Page 85
Supporting the Access Control Policy......Page 86
Business Rules and Security Rules......Page 88
More on Role Names......Page 90
More on Permissions......Page 91
When Are We Done?......Page 92
Approaches to Defining Roles......Page 94
The Scenario Hurdle......Page 99
References......Page 106
7 Designing the Roles......Page 108
How Do We Go About Engineering Roles?......Page 110
Structural Role Names Should Mirror Functional Role Names......Page 112
When to Use Hierarchies......Page 113
Defining Role Hierarchies......Page 116
Constraints......Page 119
References......Page 120
8 Engineering the Permissions......Page 122
Objects......Page 123
Levels of Abstraction......Page 124
Permissions Are Independent Building Blocks......Page 125
Two Schools of Thought......Page 127
Translating High-Level Permissions into IT Permissions......Page 129
Reference......Page 139
Potential Benefits of Role Engineering Tools......Page 140
What Tools Can Do......Page 141
Deciding Whether Tools Are Needed......Page 142
Cost-Benefit Analysis......Page 144
Tools Summary......Page 145
Workflows......Page 150
Relating Permissions to Roles......Page 152
Role Hierarchies......Page 153
Process for Role Formation......Page 155
Testing Roles Against Access Control Policy......Page 158
Organizing Role Definitions in a Repository......Page 161
References......Page 164
11 What Others Have Been Doing......Page 166
Permission Definition Projects......Page 167
Healthcare Scenarios......Page 172
Communication Mechanisms......Page 173
Work Method of the Task Force......Page 174
Existing and Emerging Standards......Page 176
RBAC Research Activities......Page 177
Automatic Assignment of Roles to Users......Page 179
Multihierarchy Role Relationships......Page 181
SACMAT and ACSAC......Page 183
References......Page 184
The Importance of Good Planning......Page 186
Planning the Project......Page 188
Communications Plan......Page 189
The Planning Process......Page 190
Discussion of the Six Questions......Page 191
Level of Effort......Page 192
Measuring Progress......Page 193
Summary......Page 195
References......Page 196
13 Staffing for Role Engineering......Page 198
Effectiveness Considerations......Page 199
Cost Considerations......Page 200
Stability Considerations......Page 201
Team Building......Page 203
Staff Selection......Page 205
Types of Individuals Needed......Page 206
Communications......Page 207
Staff Development......Page 209
Staff Evaluation......Page 210
References......Page 211
Quality of Role Definitions......Page 212
Problems in Execution of the Role Engineering Process......Page 215
Efficiency in the Use of Role Engineering Resources......Page 216
Backtracking......Page 217
Other Limitations of Role Engineering......Page 218
Practical Guidance from Eurekify, Ltd.......Page 219
Reference......Page 222
Making the Business Case......Page 224
Defining Good Roles......Page 225
Tools That Can Assist in the Role Engineering Process......Page 226
Planning and Staffing a Role Engineering Effort......Page 227
Potential Pitfalls and How to Avoid Them......Page 228
What We Can Expect in the Future......Page 229
References......Page 231
Bibliography......Page 232
About the Authors......Page 236
Index......Page 240