A Security Pattern-Driven Approach toward the Automation of Risk Treatment in Business Processes

Abstract

Risk management has become an essential mechanism for business and security analysts, since it enable the identification, evalu ation and treatment of any threats, vulnerabilities, and risks to which organizations maybe be exposed. In this paper, we discuss the need to provide a standard representation of security countermeasures in order to automate the selection of countermeasures for business processes. The main contribution lies in the specification of security pattern as standard representation for countermeasures. Classical security pattern structure is extended to incorporate new features that enable the automatic selec tion of security patterns. Furthermore, a prototype has been developed which support the specification of security patterns in a graphical way.