...Information Assurance ...


Secure*BPMN - a graphical extension for BPMN 2.0 based on a Reference Model of Information Assurance & Security


ABSTRACT


Information Assurance \& Security (IAS) is now recognised as a complex managerial and organisational issue which requires knowledge of such disciplines as sociology, psychology, economics, management, computer science etc. The knowledge of experts with different, often non-technical, backgrounds which relates to various aspects of IAS must be captured in order to produce an holistic picture of IAS in an organisation. Experts need to discuss IAS issues in an effective manner in order for well-informed security decisions to be made.

It is demonstrated by previous research that business process models are suitable for representing security issues in a form comprehensible by non-technical and non-security experts. The representation of security concerns in business process models helps to identify security requirements at the early stage of the information system design and to involve non-security experts in security decision making.

This thesis presents Secure*BPMN, a graphical security modelling extension for the de-facto industry standard business process modelling language BPMN 2.0. Secure*BPMN is intended to facilitate the discussion of IAS issues in a multi-disciplinary team of experts. Secure*BPMN is an ontologically expressive, cognitively effective, easy to learn and useful modelling technique, which allows representation of security concepts in inter- and cross-organisational business process models.

It was not possible to develop a robust security modelling technique without a solid foundational basis for its semantics. The semantics of Secure*BPMN is based on a Reference Model of Information Assurance \& Security (RMIAS), which was developed and evaluated within the scope of this research project. The RMIAS is a synthesis of the existing knowledge of the IAS domain. It was yielded as a result of a thorough literature review. The RMIAS helps to build an agreed-upon understating of the IAS domain (its main concepts and the interrelationships between them), which a multidisciplinary team requires before experts may proceed with the discussion of security issues. The development process of the RMIAS, which was made explicit, and the multiphase evaluation confirmed the plausibility and completeness of the RMIAS. The RMIAS evaluation involved analytical analysis of the model, semi-structured interviews with twenty-six IAS experts and workshops with two groups of MSc students at Cardiff and Cranfield Universities.

The syntax of Secure*BPMN complies with the BPMN extensibility rules and with the scientific principles underlying the design of cognitively effective modelling notations. The cognitive effectiveness of Secure*BPMN is critical because it is destined for humans and is not machine-oriented.

Secure*BPMN was analytically evaluated in terms of ontological completeness and cognitive effectiveness using well-established evaluation frameworks. In this work, a strong emphasis was placed on the empirical evaluation of the Secure*BPMN effectiveness. The pragmatic value of Secure*BPMN, which is characterised by ease of use, usefulness and intention to use, was empirically evaluated via a series of workshops with business and security professionals, and MSc students. During the evaluation workshops the participants received training on Secure*BPMN, made use of the modelling technique in several tasks and then expressed their opinion about Secure*BPMN in a post-task survey. The evaluation results confirmed the pragmatic value of Secure*BPMN.

The main contribution of this thesis is Secure*BPMN, a graphical security extension for BPMN 2.0. Secure*BPMN enables effective representation of security concerns in business process models, and facilitates the engagement of non-security and non-technical experts in the discussion of security concerns and security decision making. The strength and novelty of Secure*BPMN lie in its cognitively effective syntax and, primarily, in its comprehensive semantics based on the RMIAS, a secondary contribution of this thesis. The RMIAS is a comprehensive model of the IAS domain in its contemporary state. The RMIAS, which has multiple implications for research, education and practice, is a contribution to the IAS domain in its own right.



The full text of the thesis is available at ORCA: http://orca.cf.ac.uk/74432.

NOTE: This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.