Security Requirements Engineering Framework with BPMN 2.0.2 Extension Model for Development of Information Systems

Abstract

With recent advancements of technologies such as Internet of Things and cloud computing, security of information systems has emerged as a critical issue. This has created a need for elicitation and analysis of the security requirements at an early stage of system development. These requirements should also be expressed using visual notations that can encapsulate the vision of different stakeholders related to security. While business process management notation (version 2.0.2) is a widely used graphical representation for business requirements and makes it easier to define and communicate business processes between different stakeholders of the system. Moreover, extension mechanisms are available to model the specific needs of an organization. Due to its flexible structure for defining new extensions, it can be adapted to model security requirements in the information system (IS). Towards this, we propose a threat profile security framework to define the security requirements of manufacturing systems for businesses, which are at a stage of infancy to adapt or evolve the IS with the changing needs of a business environment. In particular, the framework is modeled by extending Business Process Management Notation and is applied in a manufacturing industry process at the shop floor level. We show through a case study example that the threat goal-based framework is broader and, hence, covers a majority of security concerns of organizations.

Towards Automated Attack Simulations of BPMN-based Processes

“…Essentially, we found that (a) most of the current approaches require meta-model extensions that add a considerable number of security-related BPMN components, of which many are (b) excessively verbose, and thus difficult to manage (e. g., [21], [27], [32]) or fail to express security concepts in a format that is fully comprehensible to business experts, others propose only a theoretical or descriptive extension (e. g., [16], [18]). Threat modeling A threat profile security framework was proposed as a BPMN extension by Zareen et al in [32]. The authors leveraged the extension mechanism provided in BPMN 2.0 to model threat-based security requirements and introduced several graphical components for BPMN diagrams.…”

“…Different ways to enrich the standardized BPMN with new concepts that reflect various security aspects already exist (e. g., [15], [18], [21], [27], [32]). However, if organizations have a large set of productive processes, adding supplementary information is often an unfeasible effort.…”

SENSE: A Flow-Down Semantics-Based Requirements Engineering Framework

“…Semantics, namely the meaning of the requirements, allows the enhancement of accuracy and completeness, leading to a better understanding of hidden connections [8,10,[25][26][27]. In the literature, however, there are even domain-specific approaches, such as in [28], that deal with a specific case, and such as with security requirements that propose visual notations in order to express requirements. In [28], the authors propose the use of business process management notation (BPMN), a graphical representation for business requirements to define business processes.…”

Identity Governance Framework for Privileged Users

“…Since security is the main concern of any organization, the level of security features available with the access management scheme should be well organized and arranged according to the time requirements. Previous authors [3][4][5][6] are mainly concerned with the analysis of information security components and risk analysis. This research focuses on managing privileged access using Active Directory services to provide an authentic and improved way of identity management for any organization.…”