Welcome
Welcome on the Web site of the project ORKA – Organizational Control Architecture! ORKA is funded by the German Ministry for Education and Research in its "Software Engineering 2006" programme.
Organizational Control
Just as organisations have goals describing their primary business objectives, they also have goals with respect to controlling how these objectives are met. These are the control goals of an organisation which are enforced through a system of internal control. Such a system enables them to adhere to external laws and internal regulations, prevent and detect fraud and continuously enhance the overall quality of the business.
Independent of the type of organisation, these internal control systems use common underlying principles to establish and achieve control over business activities. Control is a central organisational function and results out of decentralisation efforts. It is the means by which activities and resources are coordinated and directed towards the achievement of an organisation's goal and implies a degree of monitoring and feedback.
The terms with which these organizational control principles are commonly referred to are the:
- Separation of duty and dual control
- Delegation and revocation of authority and obligations
- Supervision, review and audit
- Specification of accountability and competence
- Least privilege and need to know
From static rights management to dynamic organization-based control
In todays systems workflow processing and rights management are separated from each other to a large extent. Access permissions to resources of workflow tasks are specified manually. Since access permissions are not synchronized with workflows, they need to be adapted additionally. This situation makes realization of organizational control principles (e.g. delegation) difficult. Although organizational control principles are well-understood in the workflow area, underlying rights management systems do not cope with them. The ORKA project aims to provide an authorization architecture and its implementation that covers problems as described above. ORKA focuses on:
- Specification of access permissions with consideration of workflows and organizational control principles using role-based security policies,
- Holistic and integrated management of security policies regarding specification, enforcement, validation and administration,
- Generic enforcement architecture for easy integration into existing systems,
- Advanced user interfaces for improvement of usability and reduction of failures in specification and administration of security policies.