A Method for Eliciting Security Requirements from the Business Process Models

Abstract. In recent years, the business process modelling is matured towards expressing enterprise’s organisational behaviour (i.e., business values and stakeholder interests). This shows potential to perform early security analysis to capture enterprise security needs. Traditionally, se-curity in business processes is addressed either by representing security concepts graphically or by enforcing these security constraints. However, these approaches miss the elicitation of security needs and their trans-lation to security requirements for system-to-be. This paper proposes a method to elicit security objectives from business process models and translate them to security requirements. The method enables early secu-rity analysis and allows developers not only to understand how to protect secure business assets, but it also contributes to alignment of the busi-ness processes with the technology that supports the execution of the business processes