Domains: conflicting and risk activities

A domain is a set of data that is subject to conflict analysis.

Domains are used to separate an enterprise into logically separate business areas.

It can coincide with the entire set of model data or with a single subset.

The data domain is used by the ARC module to implement a "correlation" between the activities a conflict analysis is required for.

Consider for example, the case of the two activities A1 and A2:

• A1: Payment of suppliers
• A2: Quality control of goods that are purchased by suppliers

To avoid a potential conflict of interest, these activities must not be completed by the same user.

Assume that activity A1 is performed by a user in relation to stationary goods in a certain OU within the company. The same user is authorized to complete activity A2 relating to raw materials used for the production processes of the OU. For example, PVC sheets that are used to produce molded plastic utensils.

The analysis of conflicts is performed where it is logical to perform it, where the two activities can occur on the same data domain.

You must contextualize the meaning of activities A1 and A2 by introducing two different domains, stationary goods and raw materials. Using two domains neutralizes the conflict between activities A1 and A2 for the user.

In the ARC model, a data domain is identified as a set of data on which various applications can operate. A domain can be identified by a set of applications. However, an application can be contained in various domains. Suppose that each application has only one corresponding permission. By using the ARC module, it is possible to aggregate applications with domains by using the link between applications and permissions. Permissions are in turn related to the domains.

The following figure shows a qualitative example of the description:

Assume that two risks exist: Risk1 and Risk2.

Risk1 arises if a generic user runs all of the three activities: Act 1, Act 2, and Act 3.

The same occurs for Risk 2 joined to activities: Act 4 and Act 5.

In this example, the five activities are linked to the five permissions P1, P2, P3, P4, and P5. These five permissions are linked 1:1 to five applications A1, A2, A3, A4, and A5.

The red arrows indicate that activities Act 1, Act 2, and Act 3 need permissions P1, P2, and P3 that link to application A1, A2, and A3. These three applications are hosted on Domain D2.

Risk1 falls into D2 and any user that performs Act1, Act2 and Act3 is considered as a risk user in that domain.

A user who performs activities Act 4 and Act 5 is not considered a risk user because those permissions and applications are linked to different domains D1 and D3. Risk 2 is neutralized.