Volume 55, Issue 6 - Business Process Security Analysis – Design Time, Run Time, Audit Time

This paper reports on approaches and tool support for security and compliance analysis of executable business processes, so-called workflows, employed in the GESINE project. Specifically, focusing on the business layer and the corresponding workflow entities along the business process management lifecycle (i. e., workflow model, instance and event log), the techniques reported on in this paper cover the design time, run time and audit time analysis. Their goal is to verify the adherence to security requirements, such as the four-eyes principle and separation and binding of duties. Altogether, the complementary techniques described in this paper enable a holistic approach to ensure the security of workflows.

Although importance of aligning modelling of business processes and security is growing, there is rather limited research performed on elicitation of security requirements from the business processes. In this paper we discuss how security risk-oriented patterns could help solving the above problem. Using the illustrative example, we present a two-step method for (i) pattern occurrence discovery in, and (ii) for security requirements definition from the business process model. We hope that our proposal could help elicit security requirements at the early system development stages, however, we still need to validate it empirically.

In this paper we propose an abstract framework to model the deontic notions relevant for business process compliance. In particular, we provide a comprehensive classification of the obligation types relevant for modelling whether a process is compliant, and we describe their semantics in terms of execution traces.

Modern enterprise systems are often process-driven and, thus, rely heavily on process-aware information systems. In such systems, high-level process-models play an important role both for communicating business requirements between domain experts and system experts as well as basis for the system implementation. Since several years, enterprise system need to fulfil an increasing number of the security and compliance requirements. Thus, there is an increasing demand for integrating high-level security and compliance requirements into process models, i. e. a common language for domain experts, system experts, and security experts. We present a security modelling language, called SecureBPMN, that can easily be integrated into business process modelling languages. In this paper, we exemplary integrate SecureBPMN into BPMN and, thus, present a common language for describing business process models together with their security and compliance requirements.

In this paper, we motivate the need to perform a posteriori analyzes for process-related security properties. In particular, we first discuss the relation of security engineering and a-posteriori techniques. Subsequently, we give an overview of different a-posteriori techniques for analyzing organizational structures and access control policies. Finally, we provide a discussion on application scenarios for different a-posteriori techniques.

Privacy is becoming a urgent issue in information systems nowadays because of the stringent requirements imposed by data protection regulations. Traditional security approaches based on access control and authorization are not adequate to address these requirements. The underlying fundamental problem is that those approaches are preventive and thus they are not able to deal with exceptions. In this paper, we present a practical privacy framework that shifts the problem of preventing infringements into a problem of detecting infringements. The framework is based on systematic log auditing, use of patterns and privacy metrics to detect and quantify infringements.