Participative Design of a Security Risk Reference Model: an Experience in the Healthcare Sector

In this paper, we propose a participative method to design a security risk reference model, composed of a domain model and a security risk model. We relate the application of the method to our attempt for a design of a national reference model of the medical laboratories in Luxembourg, for which we ran five participative workshops with domain experts to gather their knowledge. We validated the designed models with both the participating experts and nonparticipating experts. The design method and the structure of the participative workshops are described and results obtained are discussed.