Formalization of security patterns as a means to infer security controls in business processes
Year: 2014
Type: article
Abstract: The growing trend towards the automation and externalization of business processes by means of Technology Infrastructure (TI), such as Business Process Management Systems, has increased the security risks in the organizations. In the majority of cases, the issue of security is overlooked by default in these systems. Therefore, the early selection and implementation of security controls that mitigate risks is a real and crucial need. Nevertheless, there exists an enormous range of IT security controls and their configuration is a human, manual, time-consuming and error-prone task. In addition, security controls are implemented out separately from the organization perspective and involve many stakeholders. This separation makes difficult to ensure the effectiveness of these controls with regard to organizational requirements. In this article, we propose a formalization of security controls based on security pattern templates and feature models. This formalization allows applying feature domain-oriented analysis and constraint programming techniques for the automatic inference, selection and generation of optimal security controls with regard to single and multiple business objectives.
Source: Logic Journal of IGPL
Authors: A. J. Varela-Vaca, R. M. Gasca
Institution: Universidad de Sevilla
Language: English
Subfield: Management Information Systems
Domain: Social Sciences
Open Access status: green
OpenAlex ID: W2089575183