Abstract: In an example embodiment, roles within a job based security model are refactored to roles within a task oriented security model. The task oriented security model comprises task roles, which allow access to functionality and data, and enabler roles, which provide limits on the scope of the task roles. Data such as user assignment data, role to functionality mapping, functionality authorization objects, user identity and organizational data may be combined and normalized to create a mapping of users to functionality and organizational data. A refactoring engine may then examine the map to identify new candidate roles using contiguous regions of the map. Tuning parameters and constraints allow tuning of the candidate roles, and statistical metrics allow evaluation of the candidate roles. Candidate roles may be tested and applied in the new system.

Abstract: Embodiments dynamically manage privileged access to a computer system according to policies enforced by rule engine. User input to the rule engine may determine an extent of system access, as well as other features such as intensity of user activity logging (including logging supplemental to a system activity log). Certain embodiments may provide access based upon user selection of a pre-configured ID at a dashboard, while other embodiments may rely upon direct user input to the rule engine to generate an ID at a policy enforcement point. Embodiments of methods and apparatuses may be particularly useful in granting and/or logging broad temporary access rights allowed based upon emergency conditions.

Abstract: Embodiments dynamically manage privileged access to a computer system according to policies enforced by rule engine. User input to the rule engine may determine an extent of system access, as well as other features such as intensity of user activity logging (including logging supplemental to a system activity log). Certain embodiments may provide access based upon user selection of a pre-configured ID at a dashboard, while other embodiments may rely upon direct user input to the rule engine to generate an ID at a policy enforcement point. Embodiments of methods and apparatuses may be particularly useful in granting and/or logging broad temporary access rights allowed based upon emergency conditions.

Abstract: A system and method of authorizing access in a computer system. The method includes receiving a request to use the computer system, reading authorization data associated with the user, and denying the request according to the authorization data. The method further includes determining a business process risk associated with the request and comparing a characteristic of the request and the business process risk. The method further includes authorizing the request to use the computer system by the user when the business process risk exceeds the characteristic. In this manner, the delay involved in performing the normal access provisioning process is avoided for situations in which the business risk exceeds the cost of the delay.