Secure collaboration in onboarding

The process of onboarding a company is characterized by inter-enterprise collaboration between the acquiring and the acquired companies. Multiple cross-functional teams are formed to assimilate and integrate the processes, products, data, customers, and partners of the company under acquisition. Dynamic access control management in such inter-enterprise collaboration is the subject of this thesis. A problem in inter-enterprise collaboration in onboarding is that information assets shared by collaborating teams are not adequately protected. As a result, there is potential for accidental or malicious leakage of sensitive business information like the intellectual property, product roadmaps and strategy, customer lists etc. Also, the statically defined access control policies are not sufficient to address access control requirements of dynamic collaboration where there is a constant change in people, processes, and information assets in collaboration repository. This research proposes a new approach and model to integrate security in onboarding collaboration process. Research methods such as, literature review, field studies including direct experiential projects in onboarding and interviews with experts in Mergers and Acquisitions, and detailed data collection and analysis through surveys are used to identify the issues that need to be addressed in the onboarding process. Literature review enabled the identification of access control requirements from the perspective of statically defined policies and the need to determine access dynamically. From the field studies, it was deciphered that there is a need for a well-defined onboarding collaboration process. The data analysis and interpretation from the survey results provided insights into the needs for integrating security in all phases of onboarding collaboration. All these research methods essentially enabled identification of two key issues that this research addresses: 1) well-defined onboarding collaboration process and 2) building security in all phases of onboarding collaboration. A new approach and model called SCODA is developed to integrate security in all phases of onboarding collaboration. Onboarding collaboration process consists of four phases: create, operate, dissolve, and archive. These phases provide the basis for systematically addressing security and access control when the collaboration team is formed, while it is operating, when the team is dissolved after completing its tasks, and when shared information assets are archived. The research adapts role based access control (RBAC) and formally defines the enterprise, functional, and collaboration roles for making access control management decisions. New ideas are developed in trustbased access control management in dynamic collaboration. The change management aspects are also discussed. The SCODA model is validated and the refinements incorporated accordingly. This research contributed to both theory and practice of information security in general and access control in particular in the context of dynamic collaboration. It proposed a new approach of building security in, i.e. to integrate security in all phases of collaboration. In order to build security in, a new onboarding collaboration process is developed that is adaptable and customizable. It has also developed a new approach for trust based dynamic access control based on the new concepts of strong and weak trust relationships. These trust relationships are also adaptable and customizable. Finally, this research has potential for future research work in the design and implementation of multi-paradigm based enterprise security frameworks and interenterprise collaboration.