Software Engineering Security Based on Business Process Modeling

Abstract

Security requirements must be tackled early in software design and embedded in corresponding business process models. As a blueprint for software design, business process models complemented with security requirements will prevent many security breaches. To accomplish secure business process modeling, the underlying method must adhere to certain capabilities and capture actions, actor roles, and interactions. The resultant models should lend themselves to automatic analysis (simulation) to ensure captured security requirements are correctly aligned with the process flow. Thus, the tradeoff between the level of security and business performance can be studied before actual software design. Since unauthorized actions cause security breaches, the software the system’s social setting could be a cradle for defining security requirements. Security requirements can be identified based on the roles, authorities, and obligations of the social actors using the system. This paper introduces a method for security embedded business process modeling. The proposed method draws on two well-tested theoretical foundations—enterprise ontology and organizational semiotics.