{"id":87793,"date":"2020-07-10T13:41:57","date_gmt":"2020-07-10T11:41:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/stroim-rolevuyu-model-upravleniya-dostupom-chast-pervaya-podgotovitelnaya"},"modified":"2020-07-10T13:41:57","modified_gmt":"2020-07-10T11:41:57","slug":"stroim-rolevuyu-model-upravleniya-dostupom-chast-pervaya-podgotovitelnaya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/stroim-rolevuyu-model-upravleniya-dostupom-chast-pervaya-podgotovitelnaya","title":{"rendered":"Po nd\u00ebrtojm\u00eb nj\u00eb model roli p\u00ebr menaxhimin e aksesit. Pjesa e par\u00eb, p\u00ebrgatitore.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Aktualisht po punoj n\u00eb nj\u00eb kompani ofruese t\u00eb softuerit, ve\u00e7an\u00ebrisht n\u00eb zgjidhjet p\u00ebr menaxhimin e qasjes. P\u00ebrvoja ime \"nga jeta e kaluar\" lidhet me an\u00ebn e bler\u00ebsit - nj\u00eb organizat\u00eb financiare t\u00eb madhe. At\u00ebher\u00eb, grupi yn\u00eb i kontrollit t\u00eb qasjes n\u00eb departamentin e siguris\u00eb kibernetike nuk mund t\u00eb krenoheshim me kompetenca t\u00eb m\u00ebdha n\u00eb IdM. M\u00ebsuam shum\u00eb gjat\u00eb procesit, na duhej t\u00eb p\u00ebrballeshim me shum\u00eb sfida p\u00ebr t\u00eb nd\u00ebrtuar nj\u00eb mekaniz\u00ebm funksional t\u00eb menaxhimit t\u00eb t\u00eb drejtave t\u00eb p\u00ebrdoruesve n\u00eb sistemet informative t\u00eb kompanis\u00eb.
\n\"Po
\nDuke bashkuar p\u00ebrvoj\u00ebn time t\u00eb fituar n\u00eb an\u00ebn e bler\u00ebsit me njohurit\u00eb dhe kompetencat e ofruesit, d\u00ebshiroj t\u00eb ndaj me ju nj\u00eb udh\u00ebzues hap pas hapi: si t\u00eb krijoni nj\u00eb model rol p\u00ebr menaxhimin e qasjes n\u00eb nj\u00eb kompani t\u00eb madhe, dhe \u00e7far\u00eb do t\u00eb sjell\u00eb kjo n\u00eb fund. Udh\u00ebzimi im p\u00ebrb\u00ebhet nga dy pjes\u00eb: pjesa e pare \u2013 p\u00ebrgatitemi p\u00ebr t\u00eb nd\u00ebrtuar modelin, e dyta \u2013 n\u00eb t\u00eb v\u00ebrtet\u00eb e nd\u00ebrtojm\u00eb. Para jush \u00ebsht\u00eb pjesa e par\u00eb, p\u00ebrgatitore.
\n<\/a><\/noindex>
\nSh\u00ebn.<\/b> Nd\u00ebrtimi i modelit t\u00eb rolit \u2013 p\u00ebr fat t\u00eb keq, nuk \u00ebsht\u00eb nj\u00eb rezultat, por nj\u00eb proces. N\u00eb fakt, \u00ebsht\u00eb edhe nj\u00eb pjes\u00eb e procesit t\u00eb krijimit t\u00eb nj\u00eb ekosistemi t\u00eb menaxhimit t\u00eb qasjes n\u00eb kompani. Prandaj, p\u00ebrgatituni p\u00ebr nj\u00eb loj\u00eb afatgjat\u00eb.
\n<\/i>
\nN\u00eb fillim le t\u00eb sqarojm\u00eb \u2013 \u00e7far\u00eb \u00ebsht\u00eb menaxhimi i aksesit t\u00eb bazuar n\u00eb role? Supozoni se keni nj\u00eb bank\u00eb t\u00eb madhe me dhjet\u00ebra, madje edhe qindra mij\u00ebra punonj\u00ebs (subjekte), secili prej t\u00eb cil\u00ebve ka dhjet\u00ebra t\u00eb drejta akses n\u00eb qindra sisteme informacioni brenda bank\u00ebs (objekte). Tani shum\u00ebzoni numrin e objekteve me numrin e subjekteve \u2013 aq shum\u00eb lidhje minimale duhet t\u00eb krijoni e m\u00eb pas t\u00eb kontrolloni. A \u00ebsht\u00eb e mundur ta b\u00ebni k\u00ebt\u00eb manualisht? Sigurisht q\u00eb jo \u2013 p\u00ebr zgjidhjen e k\u00ebsaj sfide u krijuan rolet.<\/p>\n

Rol \u00ebsht\u00eb nj\u00eb grup fuqish q\u00eb nevojitet p\u00ebr nj\u00eb p\u00ebrdorues ose grup p\u00ebrdoruesish p\u00ebr t\u00eb p\u00ebrfunduar detyra t\u00eb caktuara pune. \u00c7do punonj\u00ebs mund t\u00eb ket\u00eb nj\u00eb ose m\u00eb shum\u00eb role, dhe \u00e7do rol mund t\u00eb p\u00ebrmbaj\u00eb nga nj\u00eb deri n\u00eb shum\u00eb fuqish, t\u00eb cilat i jan\u00eb lejuar p\u00ebrdoruesit brenda k\u00ebtij roli. Rolis mund t\u00eb lidhen me pozita t\u00eb caktuara, departamente ose detyra funksionale t\u00eb punonj\u00ebsve.<\/p>\n

\"Po
\n
\nRolat zakonisht krijohen nga fuqit\u00eb e ve\u00e7anta t\u00eb punonj\u00ebsve n\u00eb \u00e7do sistem informacioni. M\u00eb pas, nga rolet e secilit sistem formohen rolet globale t\u00eb biznesit. p\u00ebr shembull, roli i biznesit \"menaxher i kredis\u00eb\" do t\u00eb p\u00ebrfshij\u00eb disa role t\u00eb ve\u00e7anta n\u00eb sistemet informacioni q\u00eb p\u00ebrdoren n\u00eb zyr\u00ebn e klient\u00ebve t\u00eb bank\u00ebs. Le t\u00eb themi, n\u00eb sisteme t\u00eb tilla si sistemi kryesor automatizuar bankar, moduli i ark\u00ebs, sistemi i menaxhimit t\u00eb dokumenteve elektronike, menaxheri i sh\u00ebrbimit dhe t\u00eb tjer\u00ebt. Rolat e biznesit, zakonisht, lidhen me struktur\u00ebn organizative dhe t\u00eb stafit \u2013 thjesht, me grupin e nj\u00ebsive t\u00eb kompanis\u00eb dhe pozitat n\u00eb to. K\u00ebshtu formohet matrica globale e rolave (shembulli jepet n\u00eb tabel\u00ebn m\u00eb posht\u00eb).<\/p>\n

\"Po
\n
\nDuhet theksuar se nd\u00ebrtimi i nj\u00eb modeli roler 100% t\u00eb plot\u00eb, duke siguruar t\u00eb gjitha t\u00eb drejtat e nevojshme p\u00ebr punonj\u00ebsit e \u00e7do pozite n\u00eb nj\u00eb struktur\u00eb komerciale, \u00ebsht\u00eb thjesht e pamundur. Madje, kjo as nuk \u00ebsht\u00eb e nevojshme. Nj\u00eb model roler nuk mund t\u00eb jet\u00eb statik, sepse varet nga mjedisi q\u00eb ndryshon vazhdimisht. Gjithashtu, ndryshimet n\u00eb aktivitetin e biznesit t\u00eb kompanis\u00eb ndikojn\u00eb p\u00ebrkat\u00ebsisht n\u00eb ndryshimin e struktur\u00ebs organizative dhe funksionalitetit. Mungesa e mb\u00ebshtetjes s\u00eb plot\u00eb me burime, mosrespektimi i udh\u00ebzimeve t\u00eb detyr\u00ebs, d\u00ebshira p\u00ebr fitim n\u00eb d\u00ebm t\u00eb siguris\u00eb dhe shum\u00eb faktor\u00eb t\u00eb tjer\u00eb jan\u00eb gjithashtu t\u00eb r\u00ebnd\u00ebsish\u00ebm. Prandaj, duhet nd\u00ebrtuar nj\u00eb model roler q\u00eb mund t\u00eb mbuloj\u00eb deri n\u00eb 80% t\u00eb nevojave t\u00eb p\u00ebrdoruesve p\u00ebr t\u00eb drejtat bazike t\u00eb nevojshme kur em\u00ebrohen n\u00eb nj\u00eb pozit\u00eb. Nd\u00ebrsa 20% e tjera ata mund t'i k\u00ebrkojn\u00eb m\u00eb von\u00eb n\u00ebp\u00ebrmjet aplikimeve t\u00eb ve\u00e7anta, n\u00ebse \u00ebsht\u00eb e nevojshme.<\/p>\n

Sigurisht, mund t\u00eb pyesni: \u201cA ekzistojn\u00eb modele 100% rolesh?\u201d Po, ka raste t\u00eb tilla, p\u00ebr shembull, n\u00eb organizatat jofitimprur\u00ebse q\u00eb nuk p\u00ebrballen me ndryshime t\u00eb shpeshta, si n\u00eb ndonj\u00eb institut k\u00ebrkues. Ose n\u00eb organizatat e industris\u00eb s\u00eb mbrojtjes me nivel t\u00eb lart\u00eb sigurie, ku siguria ka prioritet. Ka raste edhe n\u00eb strukturat tregtare, por brenda nj\u00eb nj\u00ebsi specifike, ku puna \u00ebsht\u00eb nj\u00eb proces mjaft statik dhe parashikues.<\/p>\n

Avantazhi kryesor i menaxhimit t\u00eb rolit \u00ebsht\u00eb thjeshtimi i dh\u00ebnies s\u00eb t\u00eb drejtave, pasi numri i roleve \u00ebsht\u00eb ndjesh\u00ebm m\u00eb i vog\u00ebl se ai i p\u00ebrdoruesve t\u00eb sistemit informatik. Kjo \u00ebsht\u00eb e v\u00ebrtet\u00eb p\u00ebr \u00e7do sektor.<\/p>\n

Le t\u00eb marrim nj\u00eb kompani shitjesh me pakic\u00eb: n\u00eb t\u00eb punojn\u00eb mij\u00ebra shit\u00ebs, por niveli i t\u00eb drejtave n\u00eb sistemin N \u00ebsht\u00eb i nj\u00ebjt\u00eb p\u00ebr ta, dhe p\u00ebr ta do t\u00eb krijohet vet\u00ebm nj\u00eb rol. N\u00ebse nj\u00eb shit\u00ebs i ri hyn n\u00eb kompani, automatikisht i caktohet roli i nevojsh\u00ebm n\u00eb sistem, ku tashm\u00eb jan\u00eb t\u00eb gjitha autoritetet e nevojshme. Gjithashtu, me nj\u00eb klik, mund t\u00eb ndryshoni t\u00eb drejtat p\u00ebr mij\u00ebra shit\u00ebs nj\u00ebher\u00ebsh, p\u00ebr shembull, t\u00eb shtoni nj\u00eb opsion t\u00eb ri p\u00ebr krijimin e raportit. Nuk \u00ebsht\u00eb nevoja t\u00eb b\u00ebni mij\u00ebra operacione, duke lidhur t\u00eb drejtat e reja me \u00e7do llogari \u2013 mjafton t\u00eb shtoni k\u00ebt\u00eb opsion n\u00eb rol, dhe ai do t\u00eb shfaqet p\u00ebr t\u00eb gjith\u00eb shit\u00ebsit nj\u00ebkoh\u00ebsisht.<\/p>\n

Nj\u00eb p\u00ebrfitim tjet\u00ebr i menaxhimit t\u00eb rolit \u00ebsht\u00eb p\u00ebrjashtimi i dh\u00ebnies s\u00eb autoriteteve t\u00eb papajtueshme. Kjo do t\u00eb thot\u00eb se punonj\u00ebsi, i cili ka nj\u00eb rol t\u00eb caktuar n\u00eb sistem, nuk mund t\u00eb ket\u00eb n\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb nj\u00eb rol tjet\u00ebr, t\u00eb cilat t\u00eb drejtat e t\u00eb cilit nuk duhet t\u00eb p\u00ebrputhen me t\u00eb drejtat e rolit t\u00eb par\u00eb. Nj\u00eb shembull i qart\u00eb \u00ebsht\u00eb ndalimi i kombinimit t\u00eb funksioneve t\u00eb futjes dhe kontrollit t\u00eb operacioneve financiare.<\/p>\n

T\u00eb gjith\u00eb ata q\u00eb jan\u00eb t\u00eb interesuar se si ka lindur menaxhimi i rolit t\u00eb qasjes, mund
\n t\u00eb hedhin nj\u00eb v\u00ebshtrim n\u00eb historin\u00eb e tij<\/b>
\n N\u00ebse i kthehemi historis\u00eb, IT-komuniteti filloi t\u00eb mendoj\u00eb p\u00ebr metodat e menaxhimit t\u00eb aksesit q\u00eb n\u00eb vitet '70 t\u00eb shekullit XX. Edhe pse aplikacionet ishin mjaft t\u00eb thjeshta at\u00ebher\u00eb, ashtu si sot, gjithkush d\u00ebshironte nj\u00eb menaxhim t\u00eb leht\u00eb t\u00eb aksesit n\u00eb to. T\u00eb ofronte, t\u00eb ndryshonte dhe t\u00eb kontrollonte t\u00eb drejtat e p\u00ebrdoruesve \u2013 thjesht p\u00ebr t\u00eb kuptuar m\u00eb leht\u00eb se \u00e7far\u00eb akses kan\u00eb secili prej tyre. Por n\u00eb at\u00eb koh\u00eb nuk kishte asnj\u00eb standard t\u00eb p\u00ebrbashk\u00ebt, po zhvilloheshin sistemet e para t\u00eb menaxhimit t\u00eb aksesit, dhe \u00e7do kompani bazohej n\u00eb p\u00ebrfytyrimet dhe rregullat e saj.<\/p>\n

Sot dihen shum\u00eb modele t\u00eb ndryshme t\u00eb menaxhimit t\u00eb aksesit, por ato nuk appeared menj\u00ebher\u00eb. Le t\u00eb ndalemi te ato q\u00eb kan\u00eb kontribuar n\u00eb m\u00ebnyr\u00eb t\u00eb ndjeshme n\u00eb zhvillimin e k\u00ebsaj fushe.<\/p>\n

Modeli i par\u00eb dhe, ndoshta, m\u00eb i thjeshti \u2013 Menaxhimi i aksesit diskrecion (selekto)<\/b> (DAC \u2013 Kontroll i aksesit n\u00eb form\u00eb diskrecionale). Ky model parashikon ndarjen e t\u00eb drejtave nd\u00ebrmjet t\u00eb gjith\u00eb pjes\u00ebmarr\u00ebsve n\u00eb procesin e aksesit. \u00c7do p\u00ebrdorues merr qasje n\u00eb objekte ose operacione t\u00eb caktuara. N\u00eb thelb, k\u00ebtu shum\u00eb subjekte t\u00eb t\u00eb drejtave korrespondojn\u00eb me shum\u00eb objekte. Ky model ishte njohur si shum\u00eb fleksib\u00ebl dhe shum\u00eb kompleks p\u00ebr t'u mbajtur: listat e aksesit me kalimin e koh\u00ebs b\u00ebhen t\u00eb m\u00ebdha dhe t\u00eb v\u00ebshtira p\u00ebr t'u kontrolluar.<\/p>\n

Modeli i dyt\u00eb \u00ebsht\u00eb Kontrolli i obliguar i aksesit (MAC \u2013 Mandatory access control)<\/b>. Sipas k\u00ebtij modeli, \u00e7do p\u00ebrdorues merr qasje n\u00eb nj\u00eb objekt n\u00eb p\u00ebrputhje me lejen e dh\u00ebn\u00eb p\u00ebr nivelin e caktuar t\u00eb konfidencialitetit t\u00eb t\u00eb dh\u00ebnave. P\u00ebr pasoj\u00eb, objektet duhet t\u00eb kategorizohen sipas niveleve t\u00eb konfidencialitetit. Ndryshe nga modeli i par\u00eb fleksib\u00ebl, ky, p\u00ebrkundrazi, ka rezultuar t\u00eb jet\u00eb shum\u00eb i ashp\u00ebr dhe kufizues. P\u00ebrdorimi i tij nuk justifikohet kur kompania ka shum\u00eb burime informacioni t\u00eb ndryshme: p\u00ebr t\u00eb ndar\u00eb qasjen n\u00eb burime t\u00eb ndryshme, do t\u00eb duhet t\u00eb krijohen shum\u00eb kategori q\u00eb nuk do t\u00eb mbivendosen.<\/p>\n

P\u00ebr shkak t\u00eb pap\u00ebrsosm\u00ebris\u00eb evidente t\u00eb k\u00ebtyre dy metodave, komuniteti IT vazhdoi t\u00eb zhvillonte modele m\u00eb fleksib\u00ebl dhe m\u00eb p\u00ebrpjek\u00ebsisht universale p\u00ebr t\u00eb mb\u00ebshtetur lloje t\u00eb ndryshme t\u00eb politikave organizative p\u00ebr kontrollin e aksesit. K\u00ebshtu lindi modeli i tret\u00eb i menaxhimit t\u00eb aksesit t\u00eb bazuar n\u00eb role!<\/b> Ky qasje u tregua m\u00eb e suksesshme, pasi k\u00ebrkon jo vet\u00ebm autentifikimin e identitetit t\u00eb p\u00ebrdoruesit, por edhe funksionet e tij t\u00eb pun\u00ebs n\u00eb sisteme.<\/p>\n

Struktura e par\u00eb e p\u00ebrshkruar qart\u00eb e modelit t\u00eb roleve u propozua nga shkenc\u00ebtar\u00ebt amerikan\u00eb David Ferraiolo dhe Richard Kuhn nga Instituti Komb\u00ebtar i Standardeve dhe Teknologjis\u00eb i SHBA-s\u00eb n\u00eb vitin 1992. At\u00ebher\u00eb u paraqit p\u00ebr her\u00eb t\u00eb par\u00eb termi RBAC (Kontrolli i Aksesit t\u00eb BAZUAR n\u00eb ROLES). <\/b>K\u00ebto studime dhe p\u00ebrshkrime t\u00eb komponenteve themelore, si dhe nd\u00ebrveprimi i tyre, p\u00ebrb\u00ebn\u00eb baz\u00ebn e standardit aktual INCITS 359-2012, miratuar nga Komiteti Nd\u00ebrkomb\u00ebtar p\u00ebr Standardet e Teknologjive t\u00eb Informacionit (INCITS).<\/p>\n

Standarti p\u00ebrcakton rolin si \"nj\u00eb funksion detyrash brenda kontekstit t\u00eb organizat\u00ebs me nj\u00eb semantik\u00eb lidhur me fuqit\u00eb dhe p\u00ebrgjegj\u00ebsit\u00eb e ngarkuara me p\u00ebrdoruesin e em\u00ebruar n\u00eb rol\". Dokumenti p\u00ebrcakton elementet kryesore t\u00eb RBAC - p\u00ebrdoruesit, sesionet, rolet, lejet, operacionet dhe objektet, si dhe marr\u00ebdh\u00ebniet dhe lidhjet midis tyre.<\/p>\n

N\u00eb standard jepet struktura minimale e nevojshme p\u00ebr nd\u00ebrtimin e nj\u00eb modeli roli - bashkimi i t\u00eb drejtave n\u00eb role dhe pastaj dh\u00ebnia e aksesit p\u00ebrdoruesve n\u00ebp\u00ebrmjet k\u00ebtyre roleve. P\u00ebrcaktohen mekanizmat p\u00ebr nd\u00ebrtimin e roleve nga objektet dhe operacionet, punohet mbi hierarkin\u00eb e roleve dhe trash\u00ebgimin\u00eb e fuqive. N\u00eb \u00e7do kompani ka role q\u00eb bashkojn\u00eb fuqit\u00eb elementare, t\u00eb cilat jan\u00eb t\u00eb nevojshme p\u00ebr t\u00eb gjith\u00eb punonj\u00ebsit e kompanis\u00eb. Kjo mund t\u00eb jet\u00eb akses n\u00eb post\u00ebn elektronike, n\u00eb menaxhimin e dokumenteve, n\u00eb portalin korporativ dhe k\u00ebshtu me radh\u00eb. K\u00ebto fuqira mund t\u00eb p\u00ebrfshihen n\u00eb nj\u00eb rol t\u00eb p\u00ebrgjithsh\u00ebm me emrin \"punonj\u00ebs\", dhe nuk do t\u00eb jet\u00eb e nevojshme t\u00eb renditen t\u00eb gjitha t\u00eb drejtat elementare n\u00eb \u00e7do rol m\u00eb t\u00eb lart\u00eb, her\u00eb pas here. Mjafton t\u00eb tregoni ve\u00e7orin\u00eb e trash\u00ebgimis\u00eb s\u00eb rolit \"punonj\u00ebs\".<\/p>\n

\"Po
\n
\nM\u00eb von\u00eb, standardi u pasurua me atribute t\u00eb reja aksesit, t\u00eb lidhura me mjedisin n\u00eb ndryshim t\u00eb vazhduesh\u00ebm. U shtua mund\u00ebsia p\u00ebr t\u00eb vendosur kufizime statike dhe dinamike. Kufizimet statike n\u00ebnkuptojn\u00eb pamund\u00ebsin\u00eb e p\u00ebrputhjes s\u00eb roleve (ajo hyrje dhe kontroll operacionesh, e p\u00ebrmendur m\u00eb lart). Kufizimet dinamike mund t\u00eb p\u00ebrcaktohen nga parametra q\u00eb ndryshojn\u00eb, si p\u00ebr shembull, koha (or\u00ebt ose dit\u00ebt e pun\u00ebs \/ pushimit), vendndodhja (zyra \/ sht\u00ebpi) etj.<\/p>\n

N\u00eb ve\u00e7anti, duhet th\u00ebn\u00eb p\u00ebr menaxhimin e aksesit t\u00eb bazuar n\u00eb atribute (ABAC \u2014 Attribute-based access control).<\/b> Qasja nd\u00ebrtohet mbi ofrimin e aksesit p\u00ebrmes rregullave t\u00eb ndarjes s\u00eb atributeve. Kjo modeli mund t\u00eb p\u00ebrdoret ve\u00e7mas, por shpesh e plot\u00ebson aktiv modelin klasik t\u00eb rolit: p\u00ebr nj\u00eb rol t\u00eb caktuar mund t\u00eb shtohen atribute t\u00eb p\u00ebrdoruesve, burimeve dhe pajisjeve, si dhe koh\u00ebs ose vendndodhjes. Kjo lejon p\u00ebrdorimin e m\u00eb pak roleve, vendosjen e kufizimeve shtes\u00eb dhe t\u00eb siguroj\u00eb q\u00eb aksesit t\u00eb jet\u00eb minimalisht i mjaftuesh\u00ebm, duke rritur k\u00ebshtu sigurin\u00eb.<\/p>\n

P\u00ebr shembull, nj\u00eb kontabilist mund t'i jepet akses n\u00eb llogari n\u00ebse ai punon n\u00eb nj\u00eb rajon t\u00eb caktuar. N\u00eb k\u00ebt\u00eb rast, pozita e specialistit do t\u00eb krahasohet me nj\u00eb vler\u00eb referimi t\u00eb caktuar. Ose mund t\u00eb jepet akses n\u00eb llogari vet\u00ebm n\u00ebse p\u00ebrdoruesi autentikohet nga nj\u00eb pajisje e regjistruar n\u00eb list\u00ebn e atyre t\u00eb lejuar. Nj\u00eb shtes\u00eb e mir\u00eb p\u00ebr modelin e rolit, por p\u00ebrdoret rrall\u00eb vet\u00eb p\u00ebr shkak t\u00eb nevoj\u00ebs p\u00ebr t\u00eb krijuar shum\u00eb rregulla dhe tabela t\u00eb lejeve ose kufizimeve.<\/p>\n

Do t\u00eb jap nj\u00eb shembull t\u00eb p\u00ebrdorimit t\u00eb ABAC nga jeta ime e m\u00ebparshme. N\u00eb bank\u00ebn ton\u00eb kishte disa deg\u00eb. Punonj\u00ebsit e zyrave t\u00eb klient\u00ebve n\u00eb k\u00ebto dega kryenin operacione t\u00eb nj\u00ebjta, por duhej t\u00eb punonin n\u00eb sistemin kryesor vet\u00ebm me llogarit\u00eb e rajonit t\u00eb tyre. Fillimisht, filluam t\u00eb krijonim role t\u00eb ve\u00e7anta p\u00ebr \u00e7do rajon \u2013 dhe numri i k\u00ebtyre roleve me funksionalitet t\u00eb p\u00ebrs\u00ebritur, por me akses n\u00eb llogari t\u00eb ndryshme, u b\u00eb v\u00ebrtet shum\u00eb i madh! At\u00ebher\u00eb, duke p\u00ebrdorur atributin e vendndodhjes p\u00ebr p\u00ebrdoruesin dhe duke e lidhur at\u00eb me nj\u00eb gam\u00eb specifike llogarish p\u00ebr verifikim, ne e reduktuam ndjesh\u00ebm numrin e roleve n\u00eb sistem. Si rezultat, mbet\u00ebn vet\u00ebm rolet p\u00ebr nj\u00eb deg\u00eb, t\u00eb cilat u kopjuan p\u00ebr pozitat p\u00ebrkat\u00ebse n\u00eb t\u00eb gjitha nj\u00ebsit\u00eb territoriale t\u00eb tjera t\u00eb bank\u00ebs.<\/p>\n

Tani le t\u00eb flasim p\u00ebr hapat e nevojsh\u00ebm p\u00ebrgatitor\u00eb, pa t\u00eb cil\u00ebt \u00ebsht\u00eb thjesht e pamundur t\u00eb nd\u00ebrtohet nj\u00eb model rol\u00ebsh funksional.<\/p>\n

Hapi 1. Krijojm\u00eb modelin funksional<\/h2>\n

\nDuhet t\u00eb filloni me krijimin e nj\u00eb modeli funksional \u2013 nj\u00eb dokument t\u00eb nivelit t\u00eb lart\u00eb, n\u00eb t\u00eb cilin p\u00ebrshkruhen n\u00eb detaje funksionalitetet e \u00e7do n\u00ebndivizioni dhe \u00e7do pozite. N\u00eb p\u00ebrgjith\u00ebsi, informacioni p\u00ebrmbushet nga dokumente t\u00eb ndryshme: direktivat e pun\u00ebs dhe rregulloret p\u00ebr n\u00ebndivizione t\u00eb ve\u00e7anta \u2013 departamente, menaxhimente, drejtorit\u00eb. Modeli funksional duhet t\u00eb miratohet nga t\u00eb gjitha n\u00ebndivisionet e interesuara (biznesi, kontrolli t\u00eb brendsh\u00ebm, siguria) dhe t\u00eb miratohet nga menaxhmenti i kompanis\u00eb. P\u00ebr \u00e7far\u00eb nevojitet ky dokument? Q\u00eb modeli i rol\u00ebve t\u00eb mund t\u00eb referohet n\u00eb t\u00eb. P\u00ebr shembull, n\u00ebse po planifikoni t\u00eb nd\u00ebrtoni nj\u00eb model roli mbi baza t\u00eb t\u00eb drejtave ekzistuese t\u00eb punonj\u00ebsve \u2013 t\u00eb nxjerra nga sistemi dhe \u201et\u00eb sjell\u00eb n\u00eb nj\u00eb standard t\u00eb p\u00ebrbashk\u00ebt\u201c. At\u00ebher\u00eb, gjat\u00eb miratimit t\u00eb rol\u00ebve t\u00eb marra me pronarin e sistemit t\u00eb biznesit, mund t\u00eb referoheni n\u00eb nj\u00eb pik\u00eb specifike t\u00eb modelit funksional, mbi t\u00eb cilin p\u00ebrfshihet nj\u00eb t\u00eb drejt\u00eb e caktuar n\u00eb rol.<\/p>\n

Hapi 2. Auditojm\u00eb sistemet IT dhe hartojm\u00eb nj\u00eb plan p\u00ebr prioritetizimin<\/h2>\n

\nN\u00eb faz\u00ebn e dyt\u00eb, duhet t\u00eb kryhet nj\u00eb auditim i sistem\u00ebve IT p\u00ebr t\u00eb kuptuar si \u00ebsht\u00eb organizuar qasja n\u00eb to. P\u00ebr shembull, n\u00eb kompanin\u00eb time financiare, eksistuan disa qindra sisteme informative. N\u00eb t\u00eb gjitha sistemet kishte disa elemente t\u00eb menaxhimit t\u00eb rolit, n\u00eb shumic\u00ebn e rasteve ndonj\u00eb rol, por kryesisht n\u00eb let\u00ebr ose n\u00eb manualin e sistemit - ato ishin shum\u00eb t\u00eb vjetra, dhe qasja n\u00eb to u jepnin sipas k\u00ebrkesave faktike t\u00eb p\u00ebrdoruesve. Natyrisht, nd\u00ebrtimi i nj\u00eb modeli roli menj\u00ebher\u00eb n\u00eb disa qindra sisteme \u00ebsht\u00eb thjesht e pamundur, duhet t\u00eb fillohet nga di\u00e7ka. Ne kryem nj\u00eb analiz\u00eb t\u00eb thell\u00eb t\u00eb procesit t\u00eb menaxhimit t\u00eb qasjes p\u00ebr t\u00eb p\u00ebrcaktuar nivelin e saj t\u00eb pjekuris\u00eb. Gjat\u00eb analiz\u00ebs, zhvilluam kritere p\u00ebr priorizimin e sistemeve informative - kriticiteti, gatishm\u00ebria, planet p\u00ebr daljen nga funksionimi etj. Me ndihm\u00ebn e tyre, organizuam renditjen p\u00ebr zhvillimin\/aktualizimin e modeleve t\u00eb rolit p\u00ebr k\u00ebto sisteme. Pastaj, p\u00ebrfshim\u00eb modelet e rolit n\u00eb planin p\u00ebr integrimin me zgjidhjen e Menaxhimit t\u00eb Identitetit, p\u00ebr t\u00eb automatizuar menaxhimin e qasjes.<\/p>\n

Pra, si mund t\u00eb p\u00ebrcaktoni kriticitetin e sistemit? Jepni vetes k\u00ebto pyetje:<\/p>\n