Süsteemi turvalisuse arendamine kasutades äriprotsesside modelleerimist
Date
2011
Authors
Journal Title
Journal ISSN
Volume Title
Publisher
Tartu Ülikool
Abstract
Äriprotsesside arusaam ja modeleerimine on üks olulisematest aspektidest iga tänapäevase süsteemi arendamisel. Infosüsteemide modeleerimise jaoks on loodud erinevad käsitlused ning üks nendest on äriprotsesside modeleerimisnotatsioon. BPMN aitab äriprotsesse kirjeldama, modelleerima ja optimeerima, kuid väiksemal määral aitab arusaama kuidas saab selle käsitluse raames juhtida äriprotsesside turvalisust ning analüüüsida infosüsteemi turvariske. See aspekt muutub kaasaegsetes infosüsteemides veel komplitseeritumaks kuna turvatud süsteemi loomiseks peavad nii äriprotsessid kui ka turvalisuse küsimused olema
vaadeldud parallellselt - koostoimes. Selle uurimistöö eesmärgiks on analüüsida BPMN ja infosüsteemi turvariskide juhtimise vastastikus kaasmõju. BPMN’i võtmeaspektide väljaselgitamiseks ja antud modelleri turvanäitajate, riskide ja riskide juhtimise aru saamiseks antud töös on rakendatud struktureeritud lähenemine. Töös uuritakse kuidas modeller saab BPMN’i abil väljundada turvatud süsteemi komponente, riske või riskide juhtimist. Töös ühtlustatakse BPMN keele põhikonstruktsioonid ISSRM mudeli kontseptiga. Antud uurimistöös BPMN-i käsitluse rakendatavus on vaadeldatud interneti kaupluse näitel. Meie uurimistöö pakkub infosüsteemi analüütikule või arhitektile võimalust mõistma äriprotsesse ja turvakomponente ühe modeleerimiskeele abil, ja analüüs on tehtud ainult esimesel keele tasemel vaadeldes Descriptive modelling. Sellega avatakse ka uurijal võimalus tulevikus tuua paralelle erinevate modeleerimise keelte vahel et uurida ISSRM perekonda kuuluvate mudelite loomises patterne.
Business process understanding and modelling is one of the major aspects in the modern information system (IS) development. Thus, there exist several modelling approaches to support this activity, and one on them is the business process modelling notations (BPMN). Although BPMN is a good approach to understand business processes, there is a limited work to understand how this language could deal with business security and security risk management for IS. This is a problem, since both business processes and security concerns should be understood in parallel to support a development of the secure IS. In this paper we analyse BPMN with respect to the domain model of the IS security risk management (ISSRM). We apply a structured approach to understand key aspects of BPMN and how modeller could express secured assets, risks and risk treatment using BPMN. Thus we align the main constructs of the BPMN language with the key concepts of the ISSRM domain model. We show applicability of our approach on a running example related to the Internet store. We believe that our proposal would allow system analysts to understand both business processes and security concerns using the same modelling language (thus, removing the necessity of learning several modelling languages). In addition we open a possibility for the business and security model interoperability and the model transformation between several modelling approaches (if these both are aligned to the ISSRM domain model).
Business process understanding and modelling is one of the major aspects in the modern information system (IS) development. Thus, there exist several modelling approaches to support this activity, and one on them is the business process modelling notations (BPMN). Although BPMN is a good approach to understand business processes, there is a limited work to understand how this language could deal with business security and security risk management for IS. This is a problem, since both business processes and security concerns should be understood in parallel to support a development of the secure IS. In this paper we analyse BPMN with respect to the domain model of the IS security risk management (ISSRM). We apply a structured approach to understand key aspects of BPMN and how modeller could express secured assets, risks and risk treatment using BPMN. Thus we align the main constructs of the BPMN language with the key concepts of the ISSRM domain model. We show applicability of our approach on a running example related to the Internet store. We believe that our proposal would allow system analysts to understand both business processes and security concerns using the same modelling language (thus, removing the necessity of learning several modelling languages). In addition we open a possibility for the business and security model interoperability and the model transformation between several modelling approaches (if these both are aligned to the ISSRM domain model).