Aligning Business Process Access Control Policies with Enterprise Architecture

Abstract

Access control policies are a fundamental building block in meeting security and privacy requirements in organizations across business processes, enterprise architectures, and software architectures. Usage of different models for business processes and software makes eliciting and enforcing access control policies hard. Approaches like enterprise architecture management target complex mutual interdependencies between business and IT models but can be hard to apply. We suggest an approach to derive access control requirements from business processes and test compliance of software designs by data flow analyses. As a result, business processes and software designs are aligned w.r.t. access control requirements.

A Systematic Literature Review on Enterprise Architecture Visualization Methodologies

“…Zambon et al presented the qualitative time dependency (QualTD) model and approach, to carry out the qualitative assessment of availability risks in IT architectures[27]. Grandy et alproposed pliance of software designs by data flow analyses, to meet security and privacy requirements in organizations across business processes[99].Mayer et al visualized the security analysis of information systems by ArchiMate[108].G. EVALUATION AND VALIDATIONAddicks and Appelrath presented a method allowing for using artifacts of enterprise architectures, to evaluate business applications[18].…”