Paper Info
Title
Towards the automatic and optimal selection of risk treatments for business processes using a constraint programming approach
Abstract
Context: The use of Business Process Management Systems (BPMS) has emerged in the IT arena for the automation of business processes. In the majority of cases, the issue of security is overlooked by default in these systems, and hence the potential cost and consequences of the materialization of threats could produce catastrophic loss for organizations. Therefore, the early selection of security controls that mitigate risks is a real and important necessity. Nevertheless, there exists an enormous range of IT security controls and their configuration is a human, manual, time-consuming and error-prone task. Furthermore, configurations are carried out separately from the organization perspective and involve many security stakeholders. This separation makes difficult to ensure the effectiveness of the configuration with regard to organizational requirements. Objective: In this paper, we strive to provide security stakeholders with automated tools for the optimal selection of IT security configurations in accordance with a range of business process scenarios and organizational multi-criteria. Method: An approach based on feature model analysis and constraint programming techniques is presented, which enable the automated analysis and selection of optimal security configurations. Results: A catalogue of feature models is determined by analyzing typical IT security controls for BPMSs for the enforcement of the standard goals of security: integrity, confidentiality, availability, authorization, and authentication. These feature models have been implemented through constraint programs, and Constraint Programming techniques based on optimized and non-optimized searches are used to automate the selection and generation of configurations. In order to compare the results of the determination of configuration a comparative analysis is given. Conclusion: In this paper, we present innovative tools based on feature models, Constraint Programming and multi-objective techniques that enable the agile, adaptable and automatic selection and generation of security configurations in accordance with the needs of the organization.
Year
DOI
Venue
2013
10.1016/j.infsof.2013.05.007
Information & Software Technology
Keywords
Field
DocType
optimal security configuration,it security configuration,security configuration,security stakeholders,early selection,feature model,automatic selection,it security control,constraint programming approach,optimal selection,constraint programming technique,risk treatment,typical it security control,security,constraint programming,business process
ITIL security management,Business process management,Data mining,Security testing,Security controls,Software engineering,Business process,Computer science,Constraint programming,Security information and event management,Computer security model
Journal
Volume
Issue
ISSN
55
11
0950-5849
Citations 
PageRank 
References 
3
0.40
29
Authors
2
Name
Order
Citations
PageRank
Angel Jesus Varela-Vaca1146.09
Rafael M. Gasca213031.52