A Valid BPMN Extension for Supporting Security Requirements Based on Cyber Security Ontology

Business Process Model and Notation (BPMN) is the de facto standard for business process modeling. One of the most important aspect of business process models is security. Since most business processes revolve around the exchange of information, the security of such information assets becomes a critical factor for the success of the overall business process. Therefore, it is very important to capture the security requirements at conceptual level in order to identify the security needs in the first place. There is a need for an integrated tools and methodology that allows for specifying and enforcing compliance and security requirements for business process-driven enterprise systems. Furthermore, BPMN do not support the specification of security requirements along the business process modelling. This will increase the vulnerability of the system and make the future development of security for the system more difficult. In this paper, we extend the BPMN language to explicitly support the specification of security requirements derived from cyber security ontology. We incorporate visual constructs for modeling security requirements. In order to provide a commonly usable extension, these enhancements were implemented as a valid BPMN extension. An application example from the healthcare domain is used to demonstrate our approach. The experimentation denotes that the authors’ approach achieves better results in terms comprehensive understanding of incorporated security requirements.