A Model-Driven Engineering approach with Diagnosis of Non-Conformance of Security Objectives in Business Process Models

摘要

Several reports indicate that the highest businesspriorities include: business improvement, security, and IT management.The importance of security and risk management isgaining that even government statements in some cases haveimposed the inclusion of security and risk management withinbusiness management. Risk assessment has become an essentialmechanism for business security analysts, since it allows theidentification and evaluation of any threats, vulnerabilities, andrisks to which organizations maybe be exposed. In this work, aframework based on the concepts of Model-Driven Developmenthas been proposed. The framework provides different stageswhich range from a high abstraction level to an executable level.The main contribution lie in the presentation of an extension ofa business process meta-model which includes risk informationbased on standard approaches. The meta-model provides necessarycharacteristics for the risk assessment of business processmodels at an abstract level of the approach. The framework hasbeen equipped with specific stages for the automatic validation ofbusiness processes using model-based diagnosis which permits thedetection of the non-conformance of security objectives specified.The validation stages ensure that business processes are correctwith regard to the objectives specified by the customer beforethey are transformed into executable processes.