A Governance Framework for Mitigating Risks and Uncertainty in Collaborative Business Processes

Abstract

Abstract. The development of collaborative business process relies mostly on software services spanning multiple organizations. Therefore, uncertainty related to the shared assets and risks of Intellectual Property infringement form major concerns and hamper the development of inter-enterprise collaboration. This paper proposes a governance framework to enhance trust and assurance in such collaborative context, coping with the impacts of Cloud infrastructure. First, a collaborative security requirements engineering approach analyzes assets sharing relations in business process, to identify risks and uncertainties and, therefore, elicits partners' security requirements and profiles. Then, a 'due usage' aware policy model supports negotiation between asset provider's requirements and consumer's profiles. The enforcement mechanism adapts to dynamic business processes and Cloud infrastructures to provide end-to-end protection on shared assets.

Inter-organisational information security: a systematic literature review

“…The majority of these papers focuses on management issues. We found that 64 per cent of all research (14 papers) on governance (Li and Chandra, 2008; Su et al , 2012; Yulin et al , 2006) can be found in this category, and 24 per cent of research (eight papers) on organisational design/strategy (Bandyopadhyay et al , 2005; Davidson et al , 2013; Smith et al , 2007). In addition, some 67 per cent of research (ten papers) on technology (Cook et al , 2003; Lanjuan, 2006; Zhang et al , 2005) is based on a subjective/argumentative method.…”

“…Several scholars have sought to define tasks and critical activities relating to information security management in inter-organisational settings (Li and Chandra, 2008; Thalmann et al , 2012). Frameworks for management activities have aimed to assess (Deane et al , 2009; Lu et al , 2013; Nassimbeni and Sartor, 2012), monitor (Shing et al , 2007) and mitigate (Su et al , 2012) risks in inter-organisational business processes. In addition, a framework for “achieving interoperability when multiple security policies are employed” (Kokolakis and Kiountouzis, 2000) in inter-organisational collaboration has been suggested.…”

“…In other words, these papers reflect on different aspects of inter-organisational information security using some theory; however, they do not include empirical data. It is worth noting that this category constitutes 53 per cent of research (ten papers) on governance (Gritzalis et al , 2007; Li and Chandra, 2008; Su et al , 2012; Kokolakis and Kiountouzis, 2000); an additional 16 per cent (three papers) can be classed as philosophical (Deane et al , 2009; Dommun, 2008; Julisch and Hall, 2010; Kling, 1977). Consequently, the majority of governance frameworks presented are not empirically driven or tested.…”

Towards the Design of a Collaborative Cybersecurity Networked Organisation: Identification and Prioritisation of Governance Needs and Objectives

“…• Identifying and quantifying existing or potential hazards, for example at the level of communication, management and sharing of knowledge [67]; • major concerns related to the use of shared assets and risks of intellectual property infringement [15]; • reducing uncertainty [68];…”

“…Expectedly for such high-technology field, researchers already explore the benefits of advanced technological solutions such as blockchain [10,11] and translation gateways [12] to support collaborative processes. Others focus on developing ICT architectures encompassing numerous security layers [13] and integrating a number of frameworks, models and methodologies [14], with a particular interest in service-oriented architectures and their use to support governance of collaborating enterprises [15]. Another example of the technical perspective on collaboration is the application of the concept of System of Systems to study collaborative organisations, their behaviour and performance [16].…”