Embedded module for real time risk analysis and treatment

• US 20110066562A1
• Filed: 05/22/2006
• Published: 03/17/2011
• Est. Priority Date: 05/23/2005
• Status: Abandoned Application

• Current Assignee: SAP SE
• Original Assignee: SAP SE
• Inventors: Kakkera, Srinivasa, Stapleton, Susan
• Application Number:
  US11/919,926
• Publication Number:
  US 20110066562A1
• Time in Patent Office: Days
• US Class Current: 705/317
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 30/018 Certifying business or products
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security
• CPC Class Codes: Y10T 156/1028 by bending, drawing or stretch forming sheet to assume shape of configured lamina while in contact therewith

Abstract

A computer-based business application (CBBA) management system includes multiple real time agents (RTAs) embedded with local CBBA software in order to permit cross-application functions and/or real-time functions such as local monitoring, reporting, or prevention.

Claims

1. A computer-driven system for real-time monitoring one or more computer based business application (CBBA) subsystems operated on behalf of a client for compliance with prescribed guidelines, the system comprising:

embedded in programming of each CBBA subsystem, a real-time agent (RTA) comprising programming to perform operations including monitoring activity occurring in the CBBA subsystem, utilizing a map of client data and configuration settings local to the CBBA subsystem to gather information including client data and configuration settings from the CBBA subsystem, and transmitting reports substantially in real time of the activity and gathered information to a CBBA manager;

the CBBA manager, coupled to each RTA and programmed to perform operations comprising;

utilizing the reports to provide representative output in human readable format;

based upon the reports, analyzing the CBBA subsystems to detect conditions posing a potential to violate the prescribed guidelines.

2. The system of claim 1, where the CBBA subsystems comprise at least one of:

enterprise resource planning (ERP) software, government regulatory compliance software, physical provisioning software.

3. The system of claim 1, where the prescribed guidelines regulate activity of the client, the prescribed guidelines comprising one or more of the following:

company policies, government regulations, law, professional rules, accounting rules, a statement of good business practices, conditions imposed by contract or grant, corporate articles of incorporation or charter, a combination of some or all of the foregoing, other guidelines.

4. The system of claim 1, where each RTA comprises:

modules including a sense module, a gather module, a do module, and a report module;

condition-action programming responsive to predetermined input including conditions occurring in the host CBBA subsystem or input from the CBBA manager or both to trigger action by one or more of the modules corresponding to the predetermined input.

5. The system of claim 1, where the CBBA manager is further programmed to perform operations comprising:

responsive to receiving notification of actions proposed by users of a given CBBA subsystem, where said actions would violate the prescribed guidelines, directing the RTA of the given CBBA subsystem to prevent the actions from being carried out.

6. The system of claim 1, where the CBBA manager is further programmed to perform operations comprising:

responsive to receiving notification of actions proposed by users of a given CBBA subsystem, where said actions would violate the prescribed guidelines, performing operations comprising;

posing various machine-implemented remediation operations to the user, and executing the remediation operations upon user selection;

where the remediation operations include;

(1) removing features of the proposed actions sufficient to avoid violating the guidelines, (2) permitting the actions as proposed but invalidating future performance of the proposed actions at a given time, (3) permitting the actions as proposed but automatically generating reports on status of the proposed actions.

7. The system of claim 1, where the CBBA manager is further programmed to perform operations comprising:

querying the RTA for configuration settings pertinent to known vulnerabilities in the CBBA subsystems;

outputting a compliance report indicating substantially real time status of the configuration settings.

8. The system of claim 1, where the CBBA manager is further programmed to perform operations comprising:

receiving user definition of conditions to be monitored in the CBBA subsystems, the conditions including user activity or configuration settings or both;

receiving user definition of actions to be completed when the conditions occur, the actions including one or more of the following;

(1) generating reports of desired content to designated recipients, (2) logging occurrence of the conditions, (3) invoking human workflow responsive to occurrence of certain of the conditions, (4) invoking native software of the CBBA subsystems to stop or prevent specified events from occurring;

querying the RTAs for occurrence of the conditions;

responsive to occurrence of any of the conditions, performing one or more of the defined actions.

9. The system of claim 1, where the CBBA manager is further programmed to perform operations comprising:

querying the RTAs for occurrence of the pre-defined conditions including user activity or configuration settings or both, where the conditions represent known system vulnerabilities, risk prone activities, or deficiencies with undesirable severe consequences;

responsive to occurrence of any of the conditions, performing actions including one or more of the following;

(1) generating reports of desired content to designated recipients, (2) logging occurrence of the conditions, (3) invoking human workflow responsive to occurrence of certain of the conditions, (4) invoking native software of the CBBA subsystems to stop or prevent specified events from occurring.

10. The system of claim 1, where the RTAs are programmed such that the operation of monitoring activity comprises monitoring the CBBA subsystem for occurrence of user activity violating the prescribed guidelines.

11. The system of claim 10, where the CBBA manager is programmed to respond to reports of occurrence of user activity violating the prescribed guidelines from one or more RTAs by performing operations comprising:

directing a human designee to conduct predetermined follow up action.

12. The system of claim 10, where the CBBA manager is programmed to respond to reports of occurrence of user activity violating the prescribed guidelines from one or more RTAs by performing at least one of the following operations:

facilitating user redefinition of a role or assignment, where roles define collections of permitted tasks and the assignments associate roles with people;

facilitating user performance of acts to mitigate the violation.

13. The system of claim 10, where the CBBA manager is programmed to respond to reports of occurrence of user activity violating the prescribed guidelines from one or more RTAs by performing operations comprising:

directing one or more RTAs to cause native software of the CBBA subsystem to stop or prevent specified events from occurring.

14. The system of claim 1, where:

the CBBA manager is further programmed to perform simulation operations including analyzing user-proposed hypotheticals to detect conditions with potential to violate the prescribed guidelines;

where the analysis includes directing the RTAs to obtain from the CBBA subsystems data relevant to conducting the simulation operations.

15. The system of claim 14, where the CBBA manager is programmed to perform simulation operations including analyzing user-proposed hypotheticals to detect conditions occurring within and across the CBBA subsystems.

16. The system of claim 1, where the CBBA manager is further programmed to perform operations comprising:

as to one or more given actions that violate the prescribed guidelines, permitting the actions to occur only upon implementation of one of the following mitigation measures;

(1) directing the RTAs to work with native software of the CBBA subsystems to dishonor the given actions after a specified time period, (2) directing the RTAs to automatically gather information as to status of the given actions, and thereafter transmitting reports of information gathered by the RTAs to a designee.

17. The system of claim 1, where the CBBA manager is further programmed to perform operations comprising:

as to one or more given actions that violates the prescribed guidelines, permitting the action to occur only upon user-selection and system implementation of at least one of the following mitigation measures;

(1) expiring the given actions after a time period, (2) automatically gathering information as to status of the given actions and reporting the status to a designee;

recruiting the RTA in carrying out the user-selected mitigation measures in the CBBA subsystem.

18. The system of claim 1, where:

the CBBA subsystems include specifications of roles and assignments, where roles define collections of permitted tasks and assignments associate roles with people;

the CBBA manager is further programmed to perform operations comprising;

as to a given user-proposed role representing a change or addition, where the proposed role poses posing a potential to violate the prescribed guidelines, permitting the proposal to occur only upon user-selection and system implementation of at least one of the following mitigation measures;

(1) automatically expiring the proposed role after a time period, (2) throughout duration of the proposed role, repeatedly gathering information as to status of the given proposed role and reporting the status to a designee;

recruiting the RTA in carrying out the user-selected mitigation measures in the CBBA subsystem.

19. The system of claim 18, further comprising the operation of automatically triggering the user-selection of mitigation measures responsive to detecting that a given proposed role poses a potential to violate the prescribed guidelines.

20. The system of claim 1, where the CBBA manager is further programmed to perform operations comprising:

as to one or more given actions that violate the prescribed guidelines, permitting the actions to occur and taking additional protective measures including;

directing the RTAs to detect and report substantially in real time whenever a person exercises the given actions;

responsive to reporting that a person has executed the given actions, issuing an alert to a designee substantially in real time with receiving the report.

21. The system of claim 1, where:

the CBBA subsystems include specifications of roles and assignments, where roles define collections of permitted tasks and assignments associate roles with people;

the CBBA manager is further programmed to perform operations comprising, as to a given proposed role representing a change or addition posing a potential to violate the prescribed guidelines, accepting the proposed role and taking addition protective measures including;

directing the RTAs to detect and report substantially in real time whenever a person exercises abilities of the proposed role;

responsive to receiving a report that a person has exercised abilities of the proposed role, issuing an alert to a designee substantially in real time with receiving the report.

22. The system of claim 1, where:

the CBBA subsystems include specifications of roles and assignments, where roles define collections of permitted tasks and assignments associate roles with people;

the CBBA manager is further programmed to perform operations comprising, as to a given proposed role representing a change or addition posing a potential to violate the prescribed guidelines, accepting the proposed role and taking addition protective measures including;

directing the RTAs to detect and report substantially in real time whenever an incident occurs where person actually violates the prescribed guidelines;

responsive to receiving a report that a person has violated the prescribed guidelines, issuing an alert to a designee substantially in real time with receiving the report.

23. The system of claim 1, where:

the CBBA subsystems include respective specifications of roles and assignments, where roles define collections of permitted tasks and assignments associate roles with people;

the CBBA manager is further programmed to perform operations comprising, responsive to user input specifying changed conditions, directing the RTAs to identify all roles with common elements subject to modification due to the changed conditions, displaying identified roles to one or more human users, and facilitating user choice in changing the roles en masse.

24. A computer-driven system for real-time monitoring one or more computer based business application (CBBA) subsystems operated on behalf of a client for compliance with prescribed guidelines, the system comprising:

embedded in programming of each CBBA subsystem, real-time agent (RTA) means for monitoring activity occurring in the CBBA subsystem, utilizing a map of client data and configuration settings stored in the CBBA subsystem to gather prescribed data from the CBBA subsystem, and transmitting reports substantially in real time of the activity and gathered data to a CBBA manager means;

CBBA manager means, coupled to each RTA, for utilizing the reports to provide a representative output in human readable format substantially in real time, and also using the reports to analyze the CBBA subsystems to detect conditions posing a potential to violate the prescribed guidelines.

25. Computer readable storage media tangibly embodying programs of machine-readable instructions executable by digital processing equipment to perform real-time monitoring of one or more computer based business application (CBBA) subsystems operated on behalf of a client for compliance with prescribed guidelines, the programs comprising:

embedded in programming of each CBBA subsystem, a real-time agent (RTA) program performing operations comprising;

monitoring activity occurring in the CBBA subsystem, utilizing a map of client data and configuration settings stored in the CBBA subsystem to gather prescribed data from the CBBA subsystem, and transmitting reports substantially in real time of the activity and gathered data to a CBBA manager program;

the CBBA manager program to perform operations including utilizing the reports to provide a representative output in human readable format substantially in real time, and based upon the reports, analyzing the CBBA subsystems to detect conditions posing a potential to violate the prescribed guidelines.

26. (canceled)

27. A computer-driven system for real-time monitoring of at least one computer based business application (CBBA) subsystem operated on behalf of a client for compliance with prescribed guidelines, where each CBBA subsystem includes a record of roles and assignments, each role including a collection of permitted tasks, the assignments associating roles with people, the system comprising:

embedded in programming of each CBBA system, a real-time agent (RTA) comprising programming to perform operations including monitoring activity in the CBBA subsystem, utilizing a map of client data and configuration settings local to the CBBA subsystem to gather data from the CBBA subsystem, and transmitting reports substantially in real time of the activity and gathered data to a CBBA manager;

a risk framework identifying different possible configurations of the roles and assignments with potential to violate the prescribed guidelines;

the CBBA manager, coupled to each RTA and the risk framework, and programmed to perform operations comprising;

recruiting the RTAs to provide substantially real time notification of users proposals for modifying the record of roles and assignments;

responsive to notifications of such proposals, employing the risk framework to determine whether the proposals have potential to violate the prescribed guidelines, and if so, performing at least one of the following;

directing one or more RTAs to act in substantially real time to prevent the CBBA subsystems from carrying out the proposals;

allowing the CBBA subsystems to carry out the proposals, and transmitting substantially real time notification of one of the following to a designee;

(1) the proposals, (2) activity carried out by one or more users with authority provided by roles and assignments changed by the proposal.

28. A computer-driven system for real-time monitoring of at least one computer based business application (CBBA) subsystem operated on behalf of a client for compliance with prescribed guidelines, where the CBBA subsystem includes a record of roles and assignments, each role including a collection of permitted tasks, the assignments associating roles with people, the system comprising:

embedded in programming of each CBBA system, real-time agent (RTA) means for performing operations including monitoring activity in the CBBA subsystem, utilizing a map of client data and configuration settings local to the CBBA subsystem to gather data from the CBBA subsystem, and transmitting reports substantially in real time of the activity and gathered data to a CBBA manager means;

risk framework means for identifying different possible configurations of the roles and assignments with potential to violate the prescribed guidelines;

CBBA manager means, coupled to the RTA means and the risk framework means, for performing operations including;

recruiting the RTA means to provide substantially real time notification of users'"'"' proposals for modifying the record of roles and assignments;

responsive to notifications of such proposals, employing the risk framework means to determine whether the proposals have potential to violate the prescribed guidelines, and if so, performing at least one of the following;

directing one or more of the RTA means to act in substantially real time to prevent the CBBA subsystems from carrying out the proposals;

allowing the CBBA subsystem to carry out the proposals, and transmitting substantially real time notification of one of the following to a designee;

(1) the proposals, (2) activity carried out by one or more users with authority provided by roles and assignments changed by the proposal.

29. Computer readable storage media tangibly embodying programs of machine-readable instructions executable by digital processing equipment to perform real-time monitoring of at least one computer based business application (CBBA) subsystem operated on behalf of a client for compliance with prescribed guidelines, where the CBBA subsystem includes a record of roles and assignments, each role including a collection of permitted tasks, the assignments associating roles with people, the programs comprising:

embedded in programming of each CBBA system, a real-time agent (RTA) program to perform operations including monitoring activity in the CBBA subsystem, utilizing a map of client data and configuration settings local to the CBBA subsystem to gather data from the CBBA subsystem, and transmitting reports substantially in real time of the activity and gathered data to a CBBA manage program;

the CBBA manager program, coupled to each RTA program and a risk framework identifying different possible configurations of the roles and assignments with potential to violate the prescribed guidelines, to perform operations comprising;

recruiting the RTA programs to provide substantially real time notification of users'"'"' proposals for modifying the record of roles and assignments;

responsive to notifications of such proposals, employing the risk framework to determine whether the proposals have potential to violate the prescribed guidelines, and if so, performing at least one of the following;

directing one or more RTA programs to act in substantially real time to prevent the CBBA subsystems from carrying out the proposals;

allowing the CBBA subsystems to carry out the proposals, and transmitting substantially real time notification of one of the following to a designee;

(1) the proposals, (2) activity carried out by one or more users with authority provided by roles and assignments changed by the proposal.

30. A computer readable storage medium tangibly embodying a program of machine-readable instructions executable by a digital processing apparatus to install target programs of machine-readable instructions on a computer, where the target programs are executable to perform real-time monitoring of one or more computer based business application (CBBA) subsystems operated on behalf of a client for compliance with prescribed guidelines, the target programs comprising:

embedded in programming of each CBBA system, a real-time agent (RTA) program to perform operations including monitoring activity in the CBBA subsystem, utilizing a map of client data and configuration settings local to the CBBA subsystem to gather data from the CBBA subsystem, and transmitting reports substantially in real time of the activity and gathered data to a CBBA manage program;

the CBBA manager program, coupled to each RTA program and a risk framework identifying different possible configurations of the roles and assignments with potential to violate the prescribed guidelines, to perform operations comprising;

recruiting the RTA programs to provide substantially real time notification of users'"'"' proposals for modifying the record of roles and assignments;

responsive to notifications of such proposals, employing the risk framework to determine whether the proposals have potential to violate the prescribed guidelines, and if so, performing at least one of the following;

directing one or more RTA programs to act in substantially real time to prevent the CBBA subsystems from carrying out the proposals;

allowing the CBBA subsystems to carry out the proposals, and transmitting substantially real time notification of one of the following to a designee;

(1) the proposals, (2) activity carried out by one or more users with authority provided by roles and assignments changed by the proposal.

31. A computer-driven system for real-time monitoring of at least one computer based business application (CBBA) subsystem operated on behalf of a client for compliance with prescribed guidelines, where the CBBA subsystem includes a record of roles and assignments, each role including a collection of permitted tasks, the assignments associating roles with people, the system comprising:

embedded in programming of each CBBA system, a real-time agent (RTA) performing operations including monitoring activity in the CBBA subsystem, utilizing a map of client data and configuration settings stored in the CBBA subsystem to gather data from the CBBA subsystem, and

transmitting reports substantially in real time of the activity and gathered data to a CBBA manager;

a risk framework identifying different possible activities with potential to violate the prescribed guidelines;

the CBBA manager, coupled to each RTA and the risk framework, and programmed to perform operations comprising;

recruiting the RTAs to receive substantially real time notification of users'"'"' requests to perform tasks in the CBBA subsystem;

responsive to the notifications, employing the risk framework to determine the following conditions;

(1) the requested tasks have potential to violate the guidelines, (2) the requested tasks are outside the requesting users'"'"' roles;

responsive to any of the conditions being true, performing at least one of the following risk treatment operations;

directing the RTA to act in substantially real time to prevent the CBBA subsystem from carrying out the requested tasks;

allowing the CBBA subsystem to carry out the tasks, and transmitting substantially real time notification of the tasks to a designee.

32. A computer-driven system for real-time monitoring of at least one computer based business application (CBBA) subsystem operated on behalf of a client for compliance with prescribed guidelines, where the CBBA subsystem includes a record of roles and assignments, each role including a collection of permitted tasks, the assignments associating roles with people, the system comprising:

embedded in programming of each CBBA system, real-time agent (RTA) means for performing operations including monitoring activity in the CBBA subsystem, utilizing a map of client data and configuration settings stored in the CBBA subsystem to gather data from the CBBA subsystem, and transmitting reports substantially in real time of the activity and gathered data to a CBBA manager means;

risk framework means for identifying different possible activities with potential to violate the prescribed guidelines;

CBBA manager means, coupled to each RTA and the risk framework means, for performing operations comprising;

recruiting the RTA means to receive substantially real time notification of users'"'"' requests to perform tasks in the CBBA subsystem;

responsive to the notifications, employing the risk framework means to determine the following conditions;

(1) the requested tasks have potential to violate the guidelines, (2) the requested tasks are outside the requesting users'"'"' roles;

responsive to any of the conditions being true, performing at least one of the following risk treatment operations;

directing the RTA means to act in substantially real time to prevent the CBBA subsystem from carrying out the requested tasks;

allowing the CBBA subsystem to carry out the tasks, and transmitting substantially real time notification of the tasks to a designee.

33. Computer readable storage media tangibly embodying programs of machine-readable instructions executable by digital processing equipment to perform real-time monitoring of at least one computer based business application (CBBA) subsystem operated on behalf of a client for compliance with prescribed guidelines, where the CBBA subsystem includes a record of roles and assignments, each role including a collection of permitted tasks, the assignments associating roles with people, the programs comprising:

embedded in programming of each CBBA system, a real-time agent (RTA) program performing operations including monitoring activity in the CBBA subsystem, utilizing a map of client data and configuration settings stored in the CBBA subsystem to gather data from the CBBA subsystem, and transmitting reports substantially in real time of the activity and gathered data to a CBBA manager program;

CBBA manager program, coupled to each RTA and a risk framework identifying different possible activities with potential to violate the prescribed guidelines, performing operations comprising;

recruiting the RTA programs to receive substantially real time notification of users'"'"' requests to perform tasks in the CBBA subsystem;

responsive to the notifications, employing the risk framework to determine the following conditions;

(1) the requested tasks have potential to violate the guidelines, (2) the requested tasks are outside the requesting users'"'"' roles;

responsive to any of the conditions being true, performing at least one of the following risk treatment operations;

directing the RTA programs to act in substantially real time to prevent the CBBA subsystem from carrying out the requested tasks;

allowing the CBBA subsystem to carry out the tasks, and transmitting substantially real time notification of the tasks to a designee.

34. A computer readable storage medium tangibly embodying a program of machine-readable instructions executable by a digital processing apparatus to install target programs of machine-readable instructions on a computer, where the target programs are executable to perform real-time monitoring of one or more computer based business application (CBBA) subsystems operated on behalf of a client for compliance with prescribed guidelines, the target programs comprising:

embedded in programming of each CBBA system, a real-time agent (RTA) program performing operations including monitoring activity in the CBBA subsystem, utilizing a map of client data and configuration settings stored in the CBBA subsystem to gather data from the CBBA subsystem, and transmitting reports substantially in real time of the activity and gathered data to a CBBA manager program;

CBBA manager program, coupled to each RTA and a risk framework identifying different possible activities with potential to violate the prescribed guidelines, performing operations comprising;

recruiting the RTA programs to receive substantially real time notification of users'"'"' requests to perform tasks in the CBBA subsystem;

responsive to the notifications, employing the risk framework to determine the following conditions;

(1) the requested tasks have potential to violate the guidelines, (2) the requested tasks are outside the requesting users'"'"' roles;

responsive to any of the conditions being true, performing at least one of the following risk treatment operations;

directing the RTA programs to act in substantially real time to prevent the CBBA subsystem from carrying out the requested tasks;

allowing the CBBA subsystem to carry out the tasks, and transmitting substantially real time notification of the tasks to a designee.

35. A computer-driven system for real-time monitoring of multiple computer based business application (CBBA) subsystems operated on behalf of a client for compliance with prescribed guidelines, the system comprising:

multiple real-time agents (RTA) each embedded in programming of a different CBBA subsystem, each RTA comprising programming to perform operations including monitoring activity occurring in the CBBA subsystem, utilizing a map of client data and configuration settings local to the CBBA subsystem to gather prescribed data from the CBBA subsystem, and transmitting reports substantially in real time of the activity and gathered data to a CBBA manager;

the CBBA manager, coupled to the RTAs and programmed to perform operations comprising collecting reports of the RTAs and analyzing the collected reports to detect conditions occurring within and across the CBBA subsystems that pose a potential to violate the prescribed guidelines.

36. A computer-driven system for real-time monitoring of multiple computer based business application (CBBA) subsystems operated on behalf of a client for compliance with prescribed guidelines, the system comprising:

embedded in programming of each CBBA subsystem, real-time agent (RTA) means for monitoring activity occurring in the CBBA subsystem, utilizing a map of client data and configuration settings local to the CBBA subsystem to gather prescribed data from the CBBA subsystem, and transmitting reports substantially in real time of the activity and gathered data to a CBBA manager;

CBBA manager means, coupled to the RTA means, for collecting reports of the RTA means and analyzing the collected reports to detect conditions occurring within and across the CBBA subsystems that pose a potential to violate the prescribed guidelines.

37. Computer readable storage media tangibly embodying programs of machine-readable instructions executable by digital processing equipment to perform real-time monitoring of multiple computer based business application (CBBA) subsystems operated on behalf of a client for compliance with prescribed guidelines, the programs comprising:

embedded in programming of each CBBA subsystem, real-time agent (RTA) program monitoring activity occurring in the CBBA subsystem, utilizing a map of client data and configuration settings local to the CBBA subsystem to gather prescribed data from the CBBA subsystem, and transmitting reports substantially in real time of the activity and gathered data to a CBBA manager;

a CBBA manager program, coupled to the RTA programs, collecting reports of the RTAs and analyzing the collected reports to detect conditions

occurring within and across the CBBA subsystems that pose a potential to violate the prescribed guidelines.

38. A computer readable storage medium tangibly embodying a program of machine-readable instructions executable by a digital processing apparatus to install target programs of machine-readable instructions on a computer, where the target programs are executable to perform real-time monitoring of one or more computer based business application (CBBA) subsystems operated on behalf of a client for compliance with prescribed guidelines, the target programs comprising:

embedded in programming of each CBBA subsystem, real-time agent (RTA) program monitoring activity occurring in the CBBA subsystem, utilizing a map of client data and configuration settings local to the CBBA subsystem to gather prescribed data from the CBBA subsystem, and transmitting reports substantially in real time of the activity and gathered data to a CBBA manager program;

a CBBA manager program, coupled to the RTA programs, collecting reports of the RTAs and analyzing the collected reports to detect conditions occurring within and across the CBBA subsystems that pose a potential to violate the prescribed guidelines.

39. In a computing system that includes one or more modules of computer based business application (CBBA) software that serves an exclusive mechanism to perform various predefined tasks on request of networked users, each module also defining which of the users is permitted to perform tasks of that module, a CBBA management system comprising:

embedded in each module, an agent programmed to perform operations including;

retrieving client data and configuration settings from the module and reporting retrieved data and configuration settings to a CBBA manager substantially in real time;

preventing prescribed activity in the module;

automatically sensing activity in the module and reporting sensed activity to the CBBA manager substantially in real time;

external of the CBBA software modules, the CBBA manager programmed to perform operations comprising;

operating the agents to extract prescribed client data and configuration settings substantially in real time;

conducting predetermined risk analysis operations upon the extracted data and configuration settings and the reports of sensed activity.

40. The CBBA management system of claim 39, where the CBBA software comprises at least one of:

enterprise resource planning (ERP) software, government regulatory compliance software, physical provisioning software.

41. A method for constructing a set of rules to monitor activity in one or more computer-based business applications (CBBA) subsystems, where each CBBA subsystem includes a record of roles and assignments, each role including a collection of permitted tasks, the assignments associating roles with people, the method comprising operations of:

establishing a library of business activities;

providing a technical interpretation of the business activities including how each business activity may be carried out in each CBBA subsystem, the interpretation including, for each CBBA subsystem, a listing of CBBA subsystem-specific machine-implemented tasks capable of carrying out the business activity;

establishing a risk framework identifying combinations of business activities that, if entrusted to an individual, enable that individual to violate a prescribed set of operating guidelines for an entity on whose behalf the CBBA subsystems are operated;

for each identified combination of business activities, performing computer-driven operations of utilizing the technical interpretations of the combination of business activities to generate all possible combinations of CBBA subsystem-specific tasks capable of carrying out the identified combination of business activities;

implementing machine-enforced rules regulating roles and assignments to proscribe any individual from being capable of performing any of the generated combinations of CBBA subsystem-specific tasks.

42. The method of claim 41, where the prescribed set of operating guidelines comprise one or more of the following:

company policies, government regulations, penal law, accounting rules, good business practices, conditions imposed by contract, corporate articles of incorporation or charter, or other guidelines.

43. The method of claim 41, the implementing operation comprising programming the CBBA subsystems to implement the rules.

44. The method of claim 41, the implementing operation comprising programming a CBBA manager remote from the CBBA subsystems to regulate the CBBA subsystems causing the CBBA subsystems to implement the rules.

45. The method of claim 41, the implementing operation comprising programming a CBBA manager remote from the CBBA subsystems to operate embedded code within the CBBA subsystems to cause the CBBA subsystems to implement the rules.

46. The method of claim 41, the implementing operation performed such that the rules comprise at least one of:

rules preventing any individual from being capable of performing any of the generated combinations of CBBA subsystem-specific tasks;

rules causing notification upon any individual being capable of performing any of the generated combinations of CBBA subsystem-specific tasks.

47. A method for constructing a set of rules to monitor activity in one or more computer-based business applications (CBBA) subsystems, where each CBBA subsystem includes a record of roles and assignments, each role including a collection of permitted tasks, the assignments associating roles with people, the method comprising the steps of:

a step for establishing a library of business activities;

a step for providing a technical interpretation of the business activities including how each business activity may be carried out in each CBBA subsystem, the interpretation including, for each CBBA subsystem, a listing of CBBA subsystem-specific machine-implemented tasks capable of carrying out the business activity;

a step for establishing a risk framework identifying combinations of business activities that, if entrusted to an individual, enable that individual to violate a prescribed set of operating guidelines for an entity on whose behalf the CBBA subsystems are operated;

a step for each identified combination of business activities, performing computer-driven operations of utilizing the technical interpretations of the combination of business activities to generate all possible combinations of CBBA subsystem-specific tasks capable of carrying out the identified combination of business activities;

a step for implementing machine-enforced rules regulating roles and assignments to proscribe any individual from being capable of performing any of the generated combinations of CBBA subsystem-specific tasks.

48. A method for building rules to monitor predefined business activities carried out by one or more computer-based business applications (CBBA) subsystems, comprising operations of:

for each CBBA subsystem, preparing a listing of all CBBA subsystem-specific tasks capable of carrying out each of the predefined business activities;

performing computer-driven operations including;

referencing sources including the listing and a risk framework identifying combinations of business activities that, if entrusted to an individual, enables the individual to violate a prescribed set of operating guidelines for an entity on whose behalf the CBBA subsystems are operated, and utilizing the sources to generate all combinations of CBBA subsystem-specific tasks capable of carrying out each identified combination of business activities;

providing a machine-accessible risk framework embodying the combinations of CBBA subsystem-specific tasks capable of carrying out each identified combination of business activities for use in regulating assignment of any of the generated combinations of CBBA subsystem-specific tasks to any individual or role.

49. A computer readable storage medium tangibly embodying a program of machine-readable instructions executable by a digital processing apparatus to perform operations to build rules to monitor business activities carried out by one or more computer-based business applications (CBBA) subsystems, the operations comprising:

for each CBBA subsystem, receiving access to a listing identifying all CBBA subsystem-specific tasks capable of carrying out each of the business activities;

receiving access to a risk framework identifying each combination of business activities that, if entrusted to an individual, enable the individual to violate a prescribed set of operating guidelines for an entity on whose behalf the CBBA subsystems are operated;

utilizing the listing and the risk framework as input to generate all combinations of CBBA subsystem-specific tasks capable of carrying out each identified combination of business activities;

generating a set of rules proscribing assignment of any of the generated combinations of CBBA subsystem-specific tasks to any individual or role.

50. A computer readable storage medium tangibly embodying a program of machine-readable instructions executable by a digital processing apparatus to install target programs of machine-readable instructions on a computer, where the target programs are executable to perform operations for building rules to monitor business activities carried out by one or more computer-based business applications (CBBA) subsystems, the operations comprising:

for each CBBA subsystem, receiving access to a listing identifying all CBBA subsystem-specific tasks capable of carrying out each of the business activities;

receiving access to a risk framework identifying each combination of business activities that, if entrusted to an individual, enable the individual to violate a prescribed set of operating guidelines for an entity on whose behalf the CBBA subsystems are operated;

utilizing the listing and the risk framework as input to generate all combinations of CBBA subsystem-specific tasks capable of carrying out each identified combination of business activities;

generating a set of rules proscribing assignment of any of the generated combinations of CBBA subsystem-specific tasks to any individual or role.

51. A security system, comprising:

a record of roles and assignments, each role including a collection of permitted tasks, the assignments associating roles with people;

one or more subsystems programmed to perform tasks including authenticating users and selectively providing authenticated users with access to physical facilities only if permitted by roles assigned to the user;

a manager, coupled to the subsystems and programmed to perform operations comprising;

receiving notification of users'"'"' proposed changes to the record of roles and assignments;

responsive to the notifications, analyzing the proposed changes to identify potential for a person to violate prescribed segregation of duties guidelines due to that person having concurrent abilities to access to particular physical facilities;

permitting the proposed changes only if the analyzing operation does not identify any potential to violate the prescribed segregation of duties guidelines.

52. The system of claim 51, where the physical facilities include at least one of:

(1) remotely operated facility security components of a group including;

door locks, alarm systems, access zones, controllers, boom gates, elevators, card readers, biometric readers, radio frequency identification (RFID) readers, positive ID readers, (2) equipment of a group including;

photocopiers, point-of-sale systems, transportation access points, heating ventilation and air conditioning (HVAC) systems and components.

53. The system of claim 51, the manager further programmed to perform additional operations including:

applying prescribed criteria to peoples'"'"' ability to access physical facilities, and issuing an alert whenever the criteria are satisfied.

54. The system of claim 51, the manager further programmed to perform additional operations including:

issuing an alert whenever a person is found to have been at one site for at least a given minimum time period.

55. The system of claim 51, the manager further programmed to perform additional operations including:

issuing an alert whenever a person'"'"'s time away from a given work site fails to meet a given minimum time period.

56. The system of claim 51, the manager further programmed to perform additional operations including:

issuing an alert whenever a person is found to have met a designated exposure limit to designated substances due to the person'"'"'s presence in a physical space allocated for storing such substances.

57. A computer-driven system for monitoring configuration client subsystems for compliance with prescribed guidelines, where the client subsystems include (1) one or more computer based business application (CBBA) subsystems selectively carrying out user-requested business activities permitted by predefined roles and assignments, and (2) one or more security subsystems selectively providing access to physical facilities permitted by predefined roles and assignments, and where each subsystem includes a record of roles and assignment, where each role includes a collection of permitted tasks and each assignments associates one or more roles with one or more people, the system comprising:

a machine-readable risk framework;

a manager, coupled to the risk framework and the subsystems, and programmed to perform operations comprising;

receiving notification of users'"'"' proposed changes to the records of roles and assignments;

responsive to the notifications, analyzing the proposed changes against the risk framework to identify any potential for people to violate prescribed guidelines by having any of the following concurrent abilities;

(1) to access multiple designated physical facilities, (2) to perform multiple designated computer-performed business processes, (3) to access one or more designated physical facilities and to perform one or more designated computer-performed business processes;

permitting the proposed changes only if the proposed changes do not present any potential violations of the prescribed guidelines.

58. The system of claim 57, where the risk framework prescribes that a person has potential to violate the prescribed guidelines if the roles and assignments provide the person with concurrent abilities to physically access an inventory storage area and to perform a computer-based business process of performing inventory write-offs.

59. A system, comprising:

one or more computer based business application (CBBA) subsystems;

a real-time agent (RTA) embedded in programming of each CBBA subsystem to gather CBBA data corresponding to each respective CBBA subsystem, and to communicate in substantially real-time the CBBA data to a CBBA manager; and

the CBBA manager to receive and process the CBBA data from each respective RTA, and to compare the CBBA data to prescribed guidelines to detect a violation of the prescribed guidelines.

60. The system of claim 59, wherein the RTA to gather the CBBA data is to cross-reference an information map to provide the RTA with a storage location of the CBBA data associated with its respective CBBA subsystem.

61. The system of claim 59, wherein the RTA to gather the CBBA data is to receive a request for the CBBA data from the CBBA manager.

62. A system, comprising:

a real-time agent (RTA) embedded in programming of each of one or more CBBA subsystems to receive a request from a CBBA manager for CBBA data, each RTA including;

a do module to determine where in the CBBA subsystem the requested CBBA data is stored;

a gather module to retrieve the requested CBBA data based on the determination of the do module; and

a report module to communicate the gathered CBBA data to the CBBA manager.

63. The system of claim 62, wherein the do module to determine where the CBBA data is stored is further to cross-reference an information map to provide the gather module with a storage location of the requested CBBA data associated with CBBA subsystem.