—Categories: About Waël, Privacy, Security

IAM Maturity Model

Identity and Access Management (IAM) has two seemingly opposed purposes: to enable user access to information, and to block user access to restricted information. In fact, strong security and user-friendly access are by no means mutually exclusive: a mature IAM solution provides both. Read a summary of my IAM Maturity Model.

—Categories: Security, Uncategorized

An Enterprise Legal Reference Model

We have developed an enterprise reference model used to conceptualize enterprise elements. The model suggests three planes:

  1. Subject and role-grouping plane: In this plane, the subjects are grouped into roles. Roles reflect subject access rights into the processes and activities of the middle plane.
  2. Process and activity plane: Here, processes are organized in a hierarchy which includes activity graphs.
  3. Object plane or data plane: This is the plane of data object identifiers. Objects enclose data.
Governance Analysis Method - Enterprise Reference Model
Enterprise Reference Model

These three planes are connected by mapping from the subject plane to the process plane. Mapping represents a logical association usually indicating right of access, or operating on an object to complete the process. Our method will focus on the top two layers of the reference model, namely the subject and the process layers.

The layers can be described as follows:

Subject plane

The subject plane includes the user groups and their roles. In enterprise governance requirements, a user or a group of users (a role) can be the subject of legal requirements. For example, the privacy or financial officer is a role defined by laws such as PIPEDA and Sarbanes-Oxley (SOX). Role formations are not mandatory, but they are almost pervasive in enterprise definitions. There are numerous references in legal requirements to role groupings.

Process plane

The process plane defines the process workflow. The process flow has the ability to implement process requirements, which are requirements that specify process compositions, in addition to precedence relations between activities. The process plane acts as the intermediary between the subject and object planes. It assists in mapping processes to the object layer. A mapping defines an explicit ‘reachability’ relation from users to activities and to objects. Semantically, a relation between an activity and an object means that the activity has access to an object. Given that there is a strict mapping between objects and activities, we shall consider access to an activity equivalent to object access.

Object plane

The object plane consists of object references. These references can also refer to composite objects. Our method will focus on the top two layers of the reference model, namely, the subject and the process layers.