NAVED AHMED Deriving Security Requirements from Business Process Models

110 Pages·2014·3.07 MB·English

DISSERTATIONES
MATHEMATICAE
N UNIVERSITATIS
A
V TARTUENSIS
E
D 92
A
H
M
E
D

D NAVED AHMED
e
r
iv
in
g

S Deriving Security Requirements from
e
c
u
rit Business Process Models
y

R
e
q
u
ir
e
m
e
n
t
s

fr
o
m

B
u
s
in
e
s
s

P
r
o
c
e
s
s

M
o
d
e
ls
Tartu 2014
ISSN 1024-4212
ISBN 978-9949-32-716-4
DISSERTATIONES MATHEMATICAE UNIVERSITATIS TARTUENSIS
92
DISSERTATIONES MATHEMATICAE UNIVERSITATIS TARTUENSIS
92

NAVED AHMED

Deriving Security Requirements from
Business Process Models
Institute of Computer Science, Faculty of Mathematics and Computer Sci-
ence, University of Tartu, Estonia.
Dissertation has been accepted for the commencement of the degree of
Doctor of Philosophy (Ph.D.) on October 31, 2014, by the Council of the
Institute of Computer Science, University of Tartu.
Supervisors:
Assoc. Prof. PhD. Raimundas Matuleviˇcius
Institute of Computer Science
University of Tartu, Tartu, Estonia
Prof. PhD. Marlon Dumas
Institute of Computer Science
University of Tartu, Tartu, Estonia
Opponents:
Prof. PhD. Andreas L. Opdahl
Department of Information Science and Media Studies
University of Bergen, Bergen, Norway
Assoc. Prof. PhD. Rafael Accorsi
Department of Telematics
University of Freiburg, Freiburg, Germany
The public defense will take place on December 16, 2014, at 16.15 in Liivi
2-404.
The publication of this dissertation was financed by Institute of Computer
Science, University of Tartu.
ISSN 1024-4212
ISBN 978-9949-32-716-4 (print)
ISBN 978-9949-32-717-1 (pdf)
Copyright: Naved Ahmed, 2014
University of Tartu Press
www.tyk.ee
Abstract
The past couple of decades have seen enterprises deploy increasingly so-
phisticated methods for supporting their business processes by means of
information systems. Moreover, given the dynamic business environment
that the digital economy has brought about, enterprises need to continu-
ously evolve their business processes and supporting information systems
in order to cope with market changes and to take advantage of technology
innovations. This confluence of factors has heightened the need for e�-
cient and reliable approaches to identify security objectives for information
systems and to map these objectives into security requirements.
Existing methods for security requirements analysis in information sys-
tems focus on eliciting security objectives and requirements at the level of
individual functions. However, the complexity and rate of change of mod-
ern business processes requires a more holistic approach, wherein security
objectivesandrequirementsareelicitedatthelevelofend-to-endprocesses.
In this setting, this thesis presents and evaluates a method for deriving
security objectives and requirements from business process models. The
thesisstartsbyproposinganalignmentbetweenconceptsfromsecurityrisk
managementandbusinessprocessmodelingconcepts. Fromthisanalysis, a
setofsecurityrisk-orientedpatternsisdevelopedtofacilitatetheelicitation
ofsecurityobjectivesfrombusinessprocessmodels. Thesesecuritypatterns
are classified via a taxonomy that helps analysts to apply these patterns in
business process models.
5
These contributions form a foundation for a method called SREBP
Security Requirements Elicitation from Business Processes. The method
facilitates early security analysis by eliciting the security objectives from
business process models and their systematic translation to security re-
quirements. The SREBP method is validated on a case study within the
Estonian Genome Centre. The results show that the SREBP method im-
proves security requirements elicitation from business process models.
6
Acknowledgements
These past four years have greatly enriched my experiences, both within
the field of my research and my life experience. This would not have been
possible without the support and encouragement of family, friends and
co-workers. I am grateful to my supervisor Raimundas Matuleviˇcius for
introducing me to the topic of security risk management, and for guiding
me towards my first publications. Without his guidance and support, this
thesis would not have been completed. I would also like to extend my
warmest gratitude to Marlon Dumas for providing insightful criticism to
removethelacunaeduringthisworkandmadesurethatmyresearchstayed
focused and constructive. I would specially like to thank Fredrik Milani for
the wonderful collaboration, all the discussions (scientific and social) and
valuablesuggestionsheo↵ered. IwouldalsoliketothankRafikChaabouni,
who played a key role in balancing work and fun for the past three and half
years. I am also grateful to the reviewers of my thesis, for their feedback
and comments that have noticeably improved my thesis.
I wish to extend a special thanks to my parents, brothers and friends
for their continuous support. Their repeated enquiries encouraged me to
continue with my research, even when (and especially) at times when my
morale was getting low. Finally, I wish to express my deepest gratitude to
Maria,forbearingwithme,forherappreciationwhenthingsweregoodand
her unfailing encouragement and support when I faced challenges during
my research.
7
This research was supported by European Social Fund via DoRa Pro-
gramme and Estonian Research Council via grant ETF8704.
8
Publications Included in this
Thesis
The publications included in thesis are listed below.
1 Ahmed,N.,Matuleviˇcius,R.(2014). SecuringBusinessProcessesusingSecurity
Risk-oriented Patterns. Computer Standards and Interfaces, 36(4), 723-733.
2 Ahmed, N., Matuleviˇcius, R. (2013). A Taxonomy for Assessing Security in
Business Process Modelling. In: 2013 IEEE Seventh International Conference
on Research Challenges in Information Science (RCIS): 2013 IEEE Seventh In-
ternational Conference on Research Challenges in Information Science (RCIS).
IEEE, 1-10.
3 Matuleviˇcius, R., Ahmed, N. (2013). Eliciting Security Requirements from the
Business Process Using Security Risk-oriented Patterns. it - Information Tech-
nology, 55(6), 225-230.
4 Ahmed,N.,Matuleviˇcius,R.,Milani,F.SecurityRequirementsElicitationfrom
Business Processes (SREBP). Submitted to Requirement Engineering Journal.
9
Contents
List of Figures 13
Acronyms 14
I Overview 17
1 Introduction 19
1.1 Problem Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
1.2 Scope of the work. . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
1.2.1 Business Processes . . . . . . . . . . . . . . . . . . . . . . . 21
1.2.2 Security Risk Management . . . . . . . . . . . . . . . . . . 21
1.3 Contribution and Research Questions . . . . . . . . . . . . . . . . 22
1.4 Publications and Contributions . . . . . . . . . . . . . . . . . . . . 23
1.5 Structure of the Thesis . . . . . . . . . . . . . . . . . . . . . . . . . 25
2 Background 27
2.1 Business Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
2.1.1 Hierarchical Abstraction . . . . . . . . . . . . . . . . . . . . 29
2.1.2 Modelling Perspectives . . . . . . . . . . . . . . . . . . . . . 29
2.2 Security Risk Management . . . . . . . . . . . . . . . . . . . . . . 30
2.2.1 Domain Model for Security Risk Management . . . . . . . . 30
2.2.2 Security Criteria . . . . . . . . . . . . . . . . . . . . . . . . 32
2.2.3 Security Standards and Methods . . . . . . . . . . . . . . . 33
2.3 Model Driven Security . . . . . . . . . . . . . . . . . . . . . . . . . 38
2.3.1 Security Modelling Languages . . . . . . . . . . . . . . . . . 38
2.3.2 Security-Risk Modelling in Business Processes . . . . . . . . 42
2.4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
10