A Survey of Scientific Approaches Considering the Integration of Security and Risk Aspects into Business Process Management
---
paper_title: Towards a UML 2.0 extension for the modeling of security requirements in business processes

paper_content:

Security is a crucial issue for business performance, but usually, it is considered after the business processes definition. Many security requirements can be expressed at the business process level. A business process model is important for software developers, since they can capture from it the necessary requirements for software design and creation. Besides, business process modeling is the center for conducting and improving how the business is operated. This paper contains a description of our UML 2.0 extension for modeling secure business process through activity diagrams. We will apply this approach to a typical health-care business process.
---
paper_title: Process Mining and Security: Detecting Anomalous Process Executions and Checking Process Conformance

paper_content:

One approach to secure systems is through the analysis of audit trails. An audit trail is a record of all events that take place in a system and across a network, i.e., it provides a trace of user/system actions so that security events can be related to the actions of a specific individual or system component. Audit trails can be inspected for the presence or absence of certain patterns. This paper advocates the use of process mining techniques to analyze audit trails for security violations. It is shown how a specific algorithm, called the @a-algorithm, can be used to support security efforts at various levels ranging from low-level intrusion detection to high-level fraud prevention.
---
paper_title: Modeling Business Process Availability

paper_content:

In the world where on-demand and trustworthy service delivery is one of the main preconditions for successful business, availability of the services and business processes is of the paramount importance and cannot be compromised. We present a framework for modeling business process availability that takes into account services, the underlying ICT-infrastructure and people. Based on a fault model, we develop the methodology to map dependencies between ICT-components, services and business processes. The mapping enables us to model and analytically assess steady-state, interval and user perceived availability at all levels, up to the level of the business process.
---
paper_title: A REFERENCE MODEL FOR PROCESS-ORIENTED IT RISK MANAGEMENT

paper_content:

The economic relevance of IT risks is increasing due to various operational, technical as well as regulatory reasons. Increasing flexibility of business processes and increasing dependability on IT require continuous risk assessment, challenging current methods for risk management. Extending IT risk management by a business process-oriented view is a promising approach for taking the occurring dynamics and interlinks into consideration. In this contribution, a systematic modeling of relations between causes (threats) and effects (direct and indirect loss) is pursued, bringing together the economic, process-oriented view with the technical, threat-oriented view of IT risks. It is discussed how the integration of cause and effect relations into the risk management process can improve the data basis for continuous risk assessment.
---
paper_title: Enhancing Business Impact Analysis and Risk Assessment Applying a Risk-Aware Business Process Modeling and Simulation Methodology

paper_content:

Driven by the steadily growing number of natural disasters, the threat of terrorist and other criminal attacks as well as changed legislation and regulations, companies are increasingly forced to prepare against threats that endanger the survivability of crucial business activities. As a consequence, management has to pay more attention to business continuity issues including serious management commitment and more appropriate funding. Business impact analysis and risk assessment concepts enable adequate business continuity planning as they deliver essential information about the impact of resources' disruption on business. In this paper we present how these concepts can be enhanced through the application of the ROPE (Risk-Oriented Process Evaluation) methodology enabling risk-aware business process management and simulation. Moreover, we present essential extensions of the ROPE simulation capabilities leading to a more efficient and effective business continuity planning.
---
paper_title: DERIVING RESOURCE REQUIREMENTS APPLYING RISK- AWARE BUSINESS PROCESS MODELING AND SIMULATION

paper_content:

Today, companies face the challenge to effectively and efficiently perform their business processes as well as to guarantee their continuous operation. To meet the economic requirements, companies often consult business process management experts. The robustness and continuity of operations is separately considered in other domains such as business continuity management and risk management. The shortcoming of this separation is that in most cases a common reasoning and information basis is missing. With the risk-aware process modeling and simulation methodology named ROPE we fill this gap and combine the strengths of the aforementioned domains. In this paper, we present new ROPE simulation capabilities focusing on the determination of resource requirements considering the impact of occurring threats on business processes. Furthermore, we introduce an example scenario to clarify how a company can benefit from applying these extensions.
---
paper_title: Process Mining and Security: Detecting Anomalous Process Executions and Checking Process Conformance

paper_content:

One approach to secure systems is through the analysis of audit trails. An audit trail is a record of all events that take place in a system and across a network, i.e., it provides a trace of user/system actions so that security events can be related to the actions of a specific individual or system component. Audit trails can be inspected for the presence or absence of certain patterns. This paper advocates the use of process mining techniques to analyze audit trails for security violations. It is shown how a specific algorithm, called the @a-algorithm, can be used to support security efforts at various levels ranging from low-level intrusion detection to high-level fraud prevention.
---

Title: A Survey of Scientific Approaches Considering the Integration of Security and Risk Aspects into Business Process Management

Section 1: Introduction
Description 1: Provide an overview of the paper's purpose, importance, and structure.

Section 2: Scientific Approaches and Results
Description 2: Describe selected approaches and methods as a starting point for discussing open research topics.

Section 3: Process Oriented Security Model (POSeM)
Description 3: Explain the POSeM approach, including its objectives, key concepts, and steps.

Section 4: Towards a UML 2.0 Extension for the Modeling of Security Requirements in Business Processes
Description 4: Discuss the extension of UML 2.0 for defining security requirements in business processes.

Section 5: Process Mining and Security: Detecting Anomalous Process Executions and Checking Process Conformance
Description 5: Detail the use of process mining to infer workflow representations and checking process conformance.

Section 6: Integrating Risks in Business Process Models
Description 6: Introduce and discuss a taxonomy of process-related risks and its applications in business process management.

Section 7: Integrating Risks in Business Process
Description 7: Focus on a holistic business view of risk management using value-focused process engineering principles.

Section 8: Modeling Business Process Availability
Description 8: Present a framework for modeling business process availability considering services, ICT infrastructure, and human resources.

Section 9: IT Risk Reference Model
Description 9: Describe a business process-oriented IT risk reference model bridging economic and technical layers.

Section 10: Risk-Oriented Business Process Evaluation (ROPE)
Description 10: Explain the ROPE methodology, focusing on the simulation-based evaluation of threats' impact on business processes.

Section 11: Business Process-based Valuation of IT-Security
Description 11: Propose an IT-Security Valuation Framework linking core business processes, IT processes, and security levels.

Section 12: Discussion and Conclusion
Description 12: Summarize the survey's findings, categorize introduced approaches, and highlight potential research challenges in business process security.