Abstract
In this paper, we propose an approach of security risk-driven contextual model for software systems development. The approach is model-driven using enterprise business architecture as the basis for the contextual models definition, associating security risk concerns. Enterprise Architecture (EA) enables the description of an organisation’s structure, its business and its underlying Information System. By using a Model-Driven Engineering (MDE) approach such as Model-Driven Architecture (MDA), we dene an architecture for models, and we provide a set of guidelines for structuring specications expressed as (EA) contextual models. Then these models are enhanced to integrate security aspects in the overall development process. The proposal aims to analyse enterprise security from a business-oriented view and define security requirements inherited by the lower architectures, particularly IS architecture. The approach provides a meta-model of business contextual risk with a security management process, consisting on a systematic method, guiding to risk modelling and risk treatment strategies.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Selic, B.: MDA manifestations. Eur. J. Inform. Prof. 9(2), 12–16 (2008)
Kleppe, A., Warmer, J., Bast, W.: MDA Explained the Model-Driven Architecture: Practice and Promise. Addison-Wesley, Boston (2003)
Davies, J., Gibbons, J., Milward, D., Welch, J.: Compositionality and refinement in model-driven engineering. In: Gheyi, R., Naumann, D. (eds.) SBMF 2012. LNCS, vol. 7498, pp. 99–114. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-33296-8_9
Simonin, J., Puentes, J.: Automatized integration of a contextual model into a process with data variability. Comput. Lang. Syst. Structures 54, 156–182 (2018)
Innerhofer-OBerperfler, F., Breu, R.: Using an enterprise architecture for IT risk management. In: ISSA, pp. 1–12 (2006)
Open Group Guide: Integrating Risk and Security within a TOGAF® Enterprise Architecture ISBN: 1-937218-66-9 Document Number: G152 Published by The Open Group, January 2016
Kleppe, A.G., Warmer, J., Warmer, J.B., et al.: MDA explained: The Model Driven Architecture: Practice and Promise. AddisonWesley Professional, Boston (2003)
Asnar, Y., Giorgini, P., Massacci, F., et al.: From trust to dependability through risk analysis. In: The 2nd International Conference on Availability, Reliability and Security (ARES 2007), pp. 19–26. IEEE (2007)
Zachman, J.A.: A framework for information systems architecture. IBM Syst. J. 38(2/3), 454–470 (1999)
Department of Defense Architecture Framework Working Group: DoD Architecture Framework, version 1.5. Department of Defense, USA (2007)
The Open Group: TOGAF 2007 edition, Van Haren Publishing, Zaltbommel, Netherlands (2008)
Grandry, E., Feltus, C., et Dubois, E.: Conceptual integration of enterprise architecture management and security risk management. In: 17th IEEE International Enterprise Distributed Object Computing Conference Workshops, vol. 2013, pp. 114–123. IEEE (2013)
Dubois, É., Heymans, P., Mayer, N., et al.: A systematic approach to define the domain of information system security risk management. In: Intentional Perspectives on Information Systems Engineering, pp. 289–306. Springer, Berlin, Heidelberg (2010)
Hervé S.: Consultants ISO/IEC 27005:2011 Information technology - Security techniques - Information security risk management (2010)
Lucio, L., Zhang, Q., Nguyen, P.H., et al.: Advances in model-driven security. In: Advances in Computers, pp. 103–152. Elsevier (2014)
threat-Glossary — CSRC, Arpil 2020. https://csrc.nist.gov/glossary/term/threat
Chowdhury, M.J.M.: Security risk modelling using SecureUML. In: 16th International Conference Computer and Information Technology, pp. 420–425. IEEE (2014)
Jonkers, H., Lankhorst, M.M., Ter Doest, H.W.L., et al.: Enterprise architecture: management tool and blueprint for the organisation. Inf. Syst. Front. 8(2), 63–66 (2006)
Myagmar, S., Lee, A.J., et Yurcik, W.: Threat modeling as a basis for security requirements. In: Symposium on Requirements Engineering for Information Security (SREIS), pp. 1–8 (2005)
Shostack, A.: Threat Modeling: Designing for Security. John Wiley & Sons, Indianapolis (2014)
https://www.omg.org/mda/mda_files/09-03-WP_Mapping_MDA_to_Zachman_Framework1.pdf
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2021 Springer Nature Switzerland AG
About this paper
Cite this paper
Kamagaté, Z., Simonin, J., Kermarrec, Y. (2021). Enhancement of a Business Model with a Business Contextual Risk Model. In: Garcia-Alfaro, J., Leneutre, J., Cuppens, N., Yaich, R. (eds) Risks and Security of Internet and Systems. CRiSIS 2020. Lecture Notes in Computer Science(), vol 12528. Springer, Cham. https://doi.org/10.1007/978-3-030-68887-5_20
Download citation
DOI: https://doi.org/10.1007/978-3-030-68887-5_20
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-68886-8
Online ISBN: 978-3-030-68887-5
eBook Packages: Computer ScienceComputer Science (R0)