Aligning the business operations with the appropriate IT infrastructure is a challenging and critical activity. Without efficient business/IT alignment, the companies face the risk not to be able to deliver their business services satisfactorily and that their image is seriously altered and jeopardized. Among the many challenges of business/IT alignment is the access rights management which should be conducted considering the rising governance needs, such as taking into account the business actors' responsibility. Unfortunately, in this domain, we have observed that no solution, model and method, fully considers and integrates the new needs yet. Therefore, the paper proposes firstly to define an expressive Responsibility metamodel, named ReMMo, which allows representing the existing responsibilities at the business layer and, thereby, allows engineering the access rights required to perform these responsibilities, at the application layer. Secondly, the Responsibility metamodel has been integrated with ArchiMate® to enhance its usability and benefits from the enterprise architecture formalism. Finally, a method has been proposed to define the access rights more accurately, considering the alignment of ReMMo and RBAC. The research was realized following a design science and action design based research method and the results have been evaluated through an extended proof of concept at the Hospital Center in Luxembourg.

In this paper, we describe an innovative approach for aligning the business layer and the application layer of ArchiMate to ensure that applications manage access rights consistently with enterprise goals and risk tolerances. The alignment is realized by using the responsibility of the employees, which we model using ReMoLa. The main focus of the alignment targets the definition and the assignment of the access rights needed by the employees according to business specification. The approach is illustrated and validated with a case study in a municipal hospital in Luxembourg.

Nowadays critical IT infrastructures constitute the pillars of our economy. Being able to react quickly and in real time is a crucial challenge for the security officers in charge of maintaining those infrastructures operationally. Our state of the art in this field has highlighted that many architectures exist to dynamically support the reaction after the detection of an incident infrastructure. Those architectures are mostly elaborated based on a multi-agent system approach that offers the possibility to work in a decentralized and heterogeneous environment. However, in the meantime, we have observed that those architectures are based on a static assignment of functions to agents and that, as a consequence, isolating an agent or breaking the communication channel between two of them could create serious damage on the management of the crisis. In this paper, we propose an innovative approach for making the assignment of functions to agents in the critical architecture dynamic. Our approach exploits the concept of agent responsibility that we assign dynamically to those agents depending on the crisis type and severity. Simultaneously we explain the dynamic assignment of the access rights necessary to perform the obligation linked to these new responsibilities. This dynamic assignment of responsibilities is illustrated based on the architecture defined in the ReD project.

Access controls is an important IT security issue and has accordingly been a huge research topic for the last decade. Many models and role engineering methods have been provided since then, and RBAC has appeared to be one of the most significant contributions. In parallel to those developments, new requirements have appeared in the field of IT governance and they provide new constraints for the elicitation of access control policies. One of those requirements is to have access rights strictly aligned with the business process and to have the responsibility of the employees involved in those processes strictly defined and suitably assigned to the employee. RBAC doesn't permit to integrate these new requirements. In this paper we propose a responsibility modeling language to align access rights with business processes requirements. To achieve that, our approach uses the concept of employees' responsibility as a means to bridge the gap through frameworks from the business layer down to frameworks from the technical layer.

Business strategy is aimed to support the vision of an enterprise, by paving the way to achieve it through goals that direct the strategy's execution. However, there is a lack of means to establish and assess the alignment of business strategy and goal oriented requirements engineering. The objective of our ongoing research is to model business strategy in order to establish well-defined and traceable links with system requirements. In this paper, we propose a business strategy meta-model for Strategy maps and Balanced Scorecards. The validity of the meta-model is tested through a case scenario using OWL and Telos.

This paper aims at building a responsibility model based on the concepts of accountability, capability and commitment. The model's objectives are firstly to help organizations for verifying the organizational structure and detecting policy problems and inconsistency. Secondly, the paper brings up a conceptual framework to support organization for defining their corporate, security and access control policies. Our work provides a preliminary review of the researches performed in that field and proposes, based on the analyses, an UML responsibility model and a definition of all its concepts. Thereafter, to propose a formal representation of the model, we have selected the suitable language and logic system. The analyze highlights that an important variable is whether the responsibility is perceived at a user or at a company level.

This paper aims at building a responsibility model based on the concepts of accountability, capability and commitment. This model's objective is, firstly, to help organizations verify the organization structure and detect policy problems and inconsistencies, and secondly, to provide a conceptual framework to support them in defining their corporate, security and access control policies. Our work provides a preliminary review of the research performed in that field and proposes, based on the observations, an UML responsibility model and a definition for all its components. Thereafter, we suggest and explain a deontological logic formalization of the most significant concepts. To achieve that, our innovation stands in the adaptation of the traditional threefold classification from the alethic logic to an adapted threefold classification that targets ldquoresponsibilityrdquo and based upon which commitment is somewhat refined.

While it is generally acknowledged that domain ontologies can significantly improve knowledge management systems (KMS) within organizations and among distributed web communities, we have little evidence of operational ontology-based KMS and their practical utility in real settings in the literature. We describe here the INTEROP KMap, a fully implemented, semantically indexed, competency management system, used to facilitate research collaboration and coordination of a Network of Excellence (NoE) on Enterprise Interoperability. Since the main highlighted advantages of ontologies are improved information access and interoperability, our aim in this paper is to give experimental support to these claims. We provide a summary description and usage data on the KMap, as well as experiments to quantify the added value of semantic search wrt traditional document ranking measures.

The need to extract and manage domain-specific taxonomies has become increasingly relevant in recent years. A taxonomy is a form of business intelligence used to integrate information, reduce semantic heterogeneity, describe emergent communities and interest groups, and facilitate communication between information systems. We present a semiautomated strategy to extract domain-specific taxonomies from Web documents and its application to model a network of excellence in the emerging research field of enterprise interoperability

In goal-oriented requirements engineering (GORE), one usually proceeds from a goal analysis to a requirements specification, usually of IT systems. In contrast, we consider the use of GORE for the design of IT-enabled value constellations, which are collections of enterprises that jointly satisfy a consumer need using information technology. The requirements analysis needed to do such a cross-organizational design not only consists of a goal analysis, in which the relevant strategic goals of the participating companies are aligned, but also of a value analysis, in which the commercial sustainability of the constellation is explored. In this paper we investigate the relation between strategic goal- and value modeling. We use theories about business strategy such as those by Porter to identify strategic goals of a value constellation, and operationalize these goals using value models. We show how value modeling allows us to find more detailed goals, and to analyze conflicts among goals