Content area
Full text
Separation of duty, as a security principle, has as its primary objective the prevention of fraud and errors. This objective is achieved by disseminating the tasks and associated privileges for a specific business process among multiple users. This principle is demonstrated in the traditional example of separation of duty found in the requirement of two signatures on a check. Previous work on separation of duty requirements often explored implementations based on role-based access control (RBAC) principles. These implementations are concerned with constraining the associations between RBAC components, namely users, roles, and permissions. Enforcement of the separation of duty requirements, although an integrity requirement, thus relies on an access control service that is sensitive to the separation of duty requirements. A distinction between separation of duty requirements that can be enforced in administrative environments, namely static separation of duty, and requirements that can only be enforced in a run-time environment, namely dynamic separation of duty, is required. It is argued that RBAC does not support the complex work processes often associated with separation of duty requirements, particularly with dynamic separation of duty. The workflow environment, being primarily concerned with the facilitation of complex work processes, provides a context in which the specification of separation of duty requirements can be studied. This paper presents the "conflicting entities" administration paradigm for the specification of static and dynamic separation of duty requirements in the workflow environment.
The proliferation of computer networks facilitated the move toward office automation. Allen' identifies the move toward automating the office as one of the turning points in interacting with computers in the previous millennium. The convergence of computing, communications, and digital information has enabled business activities to be supported across boundaries previously deemed unsurpassable. Workflow, being the computerized facilitation of business processes,2 had become a much-discussed topic in the 1990s. Workflow management systems provide the facilities to define, manage, and execute business processes in an electronic fashion. Increasing use of electronic means to conduct business leads to significant increases in processing performance and efficiency. These advantages, however, come at a cost. One such cost is an increased information security risk.
Information security requires systems to provide five essential services, namely authentication, access control, integrity, confidentiality, and nonrepudiation. 3 These security services protect...