Towards a BPMN Security Extension for the Visualization of Cyber Security Requirements

Abstract

Business process modeling notation (BPMN) is a widely used business model process. The importance of security is apparent, but traditionally, it is considered after the business processes definition. There is a need for integrated tools and a methodology that allows for specifying and enforcing compliance and security requirements for business process-driven enterprise systems. Therefore, it is very important to capture the security requirements at conceptual stage in order to identify the security needs. BPMN is lacking the ability to model and present security concepts. This will increase the vulnerability of the system and make the future development of security for the system more difficult. This article proposes a novel extension to BPMN notation based on cyber security ontologies. The authors incorporate visual constructs for modeling security requirements. In order to provide a commonly usable extension, these enhancements were implemented as BPMN metamodel extension. The authors illustrate capabilities and benefits of extension with a real-life example.