2011 School of Information Theory Tie Liu & Sriram Vishwanath Tie Liu & Sriram Vishwanath.
Towards a Framework for Achieving Effective Segregation of Duties U of Waterloo Symposium 2007...
-
Upload
emery-summers -
Category
Documents
-
view
213 -
download
0
description
Transcript of Towards a Framework for Achieving Effective Segregation of Duties U of Waterloo Symposium 2007...
Towards a Framework for Achieving Effective Segregation of Duties
U of Waterloo Symposium – 2007
Discussant: Ram Sriram
Motivation for this study
• Proposes a role-based separation of duties framework for improving security over information processing. • The framework is proposed within an accounting/transaction
cycle approach.• Expectation: The model can be used automate the resolution
of segregation of duties and conflicting access and other privileges.• Claim: It is a unified model of separation of duties.
Target Audience
Who is the target audience for this manuscript and the application that is described with in it?
• External Auditors?• Internal Auditors?• Evaluators of Sarbanes-Oxley?
Is the contribution new?
I am skeptical Both the concepts of separation of duties and
implementation within business cycles are not new.
How is this model different or how is it an improvement over well-recognized Clark-Wilson, Biba Integrity or other Access Matrix models.
Questions
Does not Clark-Wilson, Biba and others consider separation of duties in an automated context?
Why or in what sense, business cycles appropriate in automated and database environments?
Does it not conflict with one time data entry principles?
Other Questions
Is not business cycles and authorization, record-keeping and custody more appropriate to manual systems?
Are we going back in time to silo approaches?
How do computer-assisted controls play in this business cycles?
Don’t they mitigate the problems of conflicting duties?
Suggestions for Improvement
Agree: users have wrong rights assignments and also redundant and parallel access rights.
Tell the readers, how a business cycle based model will outcome this problem (in the context of an automated environment)?
Tell us how this model will be an improvement over access control matrices with read, write, execute privileges incorporated in them?
Methodology
This is a theoretical paper The tables on business cycles and
separation of duties – how are they different and contribute compared to what is already available in accounting information system textbooks?
All the best