Business Process-Based Resource Importance Determination

Abstract

Abstract. Information security risk management (ISRM) heavily depends on realistic impact values representing the resources' importance in the overall organizational context. Although a variety of ISRM approaches have been proposed, well-founded methods that provide an answer to the following question are still missing: How can business processes be used to determine resources' importance in the overall organizational context? We answer this question by measuring the actual importance level of resources based on business processes. Therefore, this paper presents our novel business process-based resource importance determination method which provides ISRM with an efficient and powerful tool for deriving realistic resource importance figures solely from existing business processes. The conducted evaluation has shown that the calculation results of the developed method comply to the results gained in traditional workshop-based assessments.Classification: Static process analysis.

Information Security Risk Management: In Which Security Solutions Is It Worth Investing?

“…Due to the identified shortcomings of existing approaches, and the recurring nature of this step, we developed a methodology [cf. Fenz, Ekelhart and Neubauer, 2009] to automatically determine asset importance values through business process analysis. The following paragraph briefly outlines how we use the method in the context of information security risk management.…”

“…The advantages of this asset importance determination approach are: (1) the necessary input data is restricted to machine-interpretable business process representations including required resources and the importance of the business process, and (2) assuming that the required input data is already available, our approach provides ISRM with fast results for resource importance, which are based on the business processes' structure and resource involvement. Details on this approach can be found in Fenz, Ekelhart and Neubauer [2009]. At the moment, the automatic importance determination addresses only the security attribute availability.…”

Risk-Aware Business Process Management—Establishing the Link Between Business and Security

“…AURUM is a framework for automated information security risk management [6,10,7]. As basis for their research, the authors identify the following questions which have to be addressed by organizations: (1) What are potential threats for my organization?, (2) How probable are these threats?, (3) Which vulnerabilities could be exploited by such threats?, (4) Which controls are required to most effectively mitigate these vulnerabilities?, (5) What is the potential impact of a particular threat?, (6) What is the value of security investments?, and finally (7) In which security solutions is it worth investing?…”

A roadmap to risk-aware business process management

“…AURUM: A Framework for Automated Information Security Risk Management [15], [16], [17]. As basis for their research, the authors identify the following questions which have to be addressed by organizations: (1) What are potential threats for my organization?, (2) How probable are these threats?, (3) Which vulnerabilities could be exploited by such threats?, (4) Which controls are required to most effectively mitigate these vulnerabilities?, (5) What is the potential impact of a particular threat?, (6) What is the value of security investments?, and finally (7) In which security solutions is it worth investing?…”