Suchergebnisse

Information security is an essential subject for commercial and government organizations, and its deployment should be supported by software tools, both at design time (when authorization business rules are planned and designed) and at run time (when authorization business rules are applied and monitored). An authorization business rule (or authorization rules, for short) is a rule that states which operations may be executed on each data item by each user. Therefore, information security supporting tools should include features for editing, managing, and assuring the application and monitoring of authorization rules. These features may be structured in a framework composed by rule management and rule execution components. In real scenarios, evaluating and selecting tools to support organization business processes is typically handled by prospecting activities that are conducted in an ad-hoc way, and therefore are very time-consuming and hard to track. However, the rapid evolution of business scenarios, the increasing demand for traceability in business-IT alignment and the great number of IT solutions available for being evaluated require prospecting activities to be more systematic, traceable and quickly adapted to different scenarios. This work proposes a set of criteria and a systematic method for evaluating tools for management and execution of authorization rules. We have applied our approach in a real scenario. The results demonstrated that BRMS (Business Rule Management Systems) tools can be used for authorization rule management, and Oracle DBMS is the most suitable tool for authorization rules storage and execution. ; Segurança da informação é um tópico essencial para organizações privadas e governamentais, e sua disponibilização deve ser apoiada por ferramentas de software, tanto em tempo de projeto (quando regras de negócio de autorização são planejadas e projetadas) como em tempo de execução (quando regras de negócio de autorização são aplicadas e monitoradas). Uma regra de negócio de autorização (ou regra de autorização, de forma resumida) é uma regra que afirma quais operações podem ser executadas em cada item de dado por cada usuário. Portanto, ferramentas para apoiar a segurança da informação devem incluir características como edição, gestão, e garantir a aplicação e monitoramento de regras de autorização. Estas características podem ser estruturadas em um framework composto por compontentes de gestão e execução de regras. Em cenários reais, avaliar e selecionar ferramentas para apoiar processos de negócio da organização é em geral tratado por atividades de prospecção que são conduzidas de uma forma ad-hoc, e portanto consomem muito tempo e são difíceis de serem rastreadas. Entretanto, a evolução rápida de cenários do negócio, a demanda crescente de rastreabilidade para alinhamento do negócio e TI e o grande número de soluções de TI disponíveis para serem avalidas requerem atividades de prospecção mais sistemáticas, rastreabilidade e rápida adaptação a diferentes cenários. Este trabalho propõe um conjunto de critérios e um método sistemático para avaliação de ferramentas para gestão e execução de regras de autorização. Nós aplicamos nossa abordagem em um cenário real. Os resultados demonstraram que ferramentas BRMS (Business Rule Management Systems) podem ser usadas para gestão de regras de autorização, e que o SGBD Oracle, dentre as ferramentas analisadas, é a ferramenta mais adequada para armazenamento e execução de regras de autorização.

PurposeA literature review was conducted in order to establish a detailed definition of a knowledge-intensive process (KiP). Moreover, relevant theories from humanities – especially the fields of linguistics and philosophy – were thoroughly researched and adapted for establishing descriptive and analytical foundations for the phenomena involved. Finally, a cognitive business process management (BPM) theory was proposed in order to assess how sufficient are its respective explanatory and predictive powers. This study aims to discuss the aforementioned objective.Design/methodology/approachThis study proposes a novel theory for KiPs that describe the process flow based on the participants' interactions and their beliefs, desires and intentions as the main drivers of the process enactment and execution.FindingsThe proposal puts forth a comprehensive definition of a KiP, depicting knowledge intensity, participant interaction and decision-making. The inner dynamics of each of these two elements (as well as other associated elements) are described as an information systems (IS) theory that enables the study of KiPs in detail, going beyond the typical techniques of the BPM field and common obstacles.Originality/valueA theory proposal for KiP that applies concepts from speech act theory and intentional states as the main drivers for understanding the process dynamics are, to the best of the authors' knowledge, not present at the literature. Being an original proposal, the real-world scenario discussed brings up the explanatory and predictive powers of the theory as well as its innovative value for research in the field.