Eliciting Security Requirements from the Business Processes Using Security Risk-Oriented Patterns

Although importance of aligning modelling of business processes and security is growing, there is rather limited research performed on elicitation of security requirements from the business processes. In this paper we discuss how security risk-oriented patterns could help solving the above problem. Using the illustrative example, we present a twostep method for (i) pattern occurrence discovery in, and (ii) for security requirements definition from the business process model. We hope that our proposal could help elicit security requirements at the early system development stages, however, we still need to validate it empirically. !!! Zusammenfassung Dieser Beitrag fokussiert auf die Nutzung von riskorientierter Muster zur Erhebung von Sicherheitsanforderungen. Er stellt ein zweistufiges Verfahren für (i) die Entdeckung risk-orientierter Muster in Geschäftsprozessen und (ii) ihre Definition vor.