On the Prevention of Fraud and Privacy Exposure in Process Information Flow

  • Authors:

  • Xue Bai;Ram Gopal;Manuel Nunez;Dmitry Zhdanov

  • Affiliations:

  • Department of Operations and Information Management, School of Business, University of Connecticut, Storrs, Connecticut 06269;Department of Operations and Information Management, School of Business, University of Connecticut, Storrs, Connecticut 06269;Department of Operations and Information Management, School of Business, University of Connecticut, Storrs, Connecticut 06269;Department of Operations and Information Management, School of Business, University of Connecticut, Storrs, Connecticut 06269

  • Venue:
  • INFORMS Journal on Computing
  • Year:
  • 2012

Quantified Score

Hi-index 0.00

Visualization

Abstract

Our work addresses internal information breaches that emanate from organizational workflows. Information breaches are particularly piquant in organizational workflows, as the underlying tasks constitute natural points where private information on individuals is accessed to execute the workflows. Our work builds on and extends the widely used role-based access controls by considering processwide security considerations to both optimize the efficiency of workflow staffing and minimize data exposure in complex workflows. We employ a Jackson queueing network modeling framework, which allows both predictable and stochastic variability as well as varied employee skill sets. This framework enables the modeling of internal security threats that emanate from cross-task and cross-personnel assignments and the development of optimal staffing strategies that meet security requirements at minimum operational costs. Our detailed implementation analysis reveals that the model developed is not demanding in terms of required parameters and that the proposed approach is practical and adaptable to evolving business, regulatory, and workforce conditions. Our model is applicable to any digital transformation that involves confidential data sequences that carry security vulnerability, as is often the case in many settings such as health care, online banking, electronic payment systems, and interorganizational data interchange.