A reference model for risk-aware business process management

Post-Proceedings of the 4th International Conference on Risks and Security of Internet and Systems, CRiSIS 2009

Volumn , Issue , 2009, Pages 82-89

  Jakoubi, Stefan ^a   Tjoa, Simon ^a  

^a Secure Business Austria ^*  (Austria)

Author keywords

Business process management; Reference model; Risk management; Security enablement methods and tools

Indexed keywords

BUSINESS PROCESS; BUSINESS PROCESS MANAGEMENT; MODELING LANGUAGES; REFERENCE MODEL; REFERENCE MODELS; RESEARCH CHALLENGES; RISK ASPECTS; RISK-AWARE BUSINESS PROCESS SIMULATION; SIMULATION-BASED;

ENTERPRISE RESOURCE MANAGEMENT; INTERNET; RISK MANAGEMENT;

MODELS;

EID: 77951431545     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CRISIS.2009.5411973     Document Type: Conference Paper

References (31)

1. S. Sackmann, A Reference Model for Processoriented IT Risk Management, in: Golden, W. et al. (Eds.): 16th European Conference on Information Systems (ECIS'08), Galway, Ireland, 2008
2. S. Sackmann, L. Lowis, K. Kittel, Selecting Services in Business Process Execution - A Risk-based Approach, in: H.R. Hansen et al. (Eds.), Business Services: Konzepte, Technologien, Anwendungen, Tagung Wirtschaftsinformatik (WI'09), Vienna, 2009
3. F. Braber, I. Hogganvik, M.S. Lund, K. Stolen, F. Vraalsen, Model-based security analysis in seven steps - a guided tour to the CORAS method, BT Technology Journal, Vol.25 No 1, 2007
4. British Standard Institute (BSI), British Standard - BS25999-1:2006: Business Continuity Management - Part 1 : Code of practice, available at http://www.bsigroup.com, accessed Apr. 2009
5. British Standard Institute (BSI), British Standard - BS25999-2:2007: Business Continuity Management - Part 2: Specification, available at http://www.bsigroup.com, accessed Apr. 2009
6. S. Jakoubi, S. Tjoa, and G. Quirchmayr, ROPE: A Methodology for Enabling the Risk-Aware Modelling and Simulation of Business Processes, in ECIS, 15th European Conference on Information Systems, 2007.
7. G. Goluch, A. Ekelhart, S. Fenz, S. Jakoubi, S. Tjoa, T. Mück, Integration of an ontological information security concept in risk aware business process management, in 41st Hawaii International Conference on System Sciences, HICSS2008, Waikoloa, HI, USA: IEEE, 2008
8. S. Tjoa, S. Jakoubi, G. Goluch, G. Quirchmayr, , Extension of a Methodology for Risk-Aware Business Process Modeling and Simulation Enabling Process-Oriented Incident Handling Support, in proceedings of the Advanced Information Networking and Applications (AINA), 2008
9. S. Jakoubi, G. Goluch, S. Tjoa, G. Quirchmayr, Deriving Resource Requirements Applying Risk-Aware Business Process Modeling and Simulation, Proceedings of the 16th European Conference on Information Systems (ECIS 2008), 2008.
10. S. Tjoa, S. Jakoubi, G. Quirchmayr, Enhancing Business Impact Analysis and Risk Assessment applying a Risk-Aware Business Process Modeling and Simulation Methodology, Proceedings of the 3rd International Conference on Availability, Reliability and Security (AReS 2008), IEEE, 2008.
11. th edition of DEXA, IEEE, 2009
12. ISO, the International Organization for Standardization / IEC, the International Electrotechnical Commission, ISO/IEC 13335-13341:2004, Information technology - Security techniques - Management of information and communications technology security - Part 1: Concepts and models for information and communications technology security management, available at http://www.iso.org/, accessed Apr. 2009
13. National Institute of Standards and Technology (NIST), NIST Special Publication 800-830, Risk Management Guide fir Information Technology Systems, 2002
14. ISO, the International Organization for Standardization / PAS, Publicly Available Specification, ISO/PAS 22399:2007: Societal security - Guideline for incident preparedness and operational continuity management, available at http://www.iso.org/, accessed Apr. 2009
15. The Business Continuity Institute (BCI), Good Practice Guidelines (GPG 2008-2), available at http://www.thebci.org/gpg.htm, accessed Apr. 2009
16. Gartner Inc., Gartner EXP Worldwide Survey of More than 1.500 CIOs Shows IT Spending to Be Flat in 2009, Available at http://www.gartner.com/it/page.jsp? id=855612, Accessed April 2009
17. D. Karagiannis, J. Mylopoulos, M. Schwab, Business Process-Based Regulation Compliance: The Case of the Sarbanes-Oxley Act, In Proceedings of the 15th IEEE International Requirements Engineering Conference, IEEE, 2007
18. ISO, the International Organization for Standardization / IEC, the International Electrotechnical Commission, ISO/IEC 27002:2005 Information technology - Security techniques - Code of practice for information security management, available at http://www.iso.org/, accessed Apr. 2009
19. Object Management Group (OMG), Business Process Modeling Notation (BPMN), available at: http://www.bpmn.org/, accessed: May, 2009
20. Object Management Group (OMG), Unified Modeling Language (UML), http://www.uml.org/, accessed: May, 2009
21. A. W. Scheer, G. Keller, M. Nüttgens, Semantische Prozeßmodellierung auf der Grundlage "Ereignisgesteuerter Prozeßketten (EPK), in: Scheer, A. W. (Eds.): Veröffentlichungen des Instituts für Wirtschaftsinformatik, Heft 89, Saarbrücken, 1992
22. A. W. Scheer, M. Nüttgens, ARIS Architecture and Reference Models for Business Process Management, in proceedings: Business Process Management (BPM 2000), Springer, 2000
23. BOC, ADONIS® standard modeling language, available at: http://www.boc-eu.com/, accessed: May, 2009
24. D. Karagiannis, S. Junginger, R. Strobl, Introduction to Business Process Management Systems Concepts, Appeared in: Scholz-Reiter, Bernd; Stickel, Eberhard (Eds.): Business Process Modeling. Springer, 1996
25. The Business Continuity Institute (BCI), Good Practice Guidelines (GPG 2008-2), available at http://www.thebci.org/gpg.htm, accessed Apr. 2009
26. rd edition, 2004
27. OGC (Office of Government Commerce), PRINCE2 - Managing Successful Projects with PRINCE2, Crown, 2005
28. One Hundred Seventh Congress of the United States of America. 2002. Sarbanes-Oxley Act., http://www.law.uc.edu/CCL/SOact/soact.pdf, accessed: May, 2009
29. European Commission, Directives, ec.europa.eu/internal-market/auditing/ directives/index-en.htm, accessed: May, 2009
30. J. Jürjens, UMLsec: Extending UML for Secure Systems Development, UML 2002, Dresden, Sept. 30 - Oct. 4, Springer, 2002
31. A. Avizienis, J.-C. Laprie, B. Randell, and C. E. Landwehr, Basic Concepts and Taxonomy of Dependable and Secure Computing, IEEE Trans. Dependable Sec. Comput., vol.1, no.1, pp. 11-33, 2004. (Pubitemid 40134576)