Risk-aware business process management-establishing the link between business and security

Springer Optimization and Its Applications

Volumn 41, Issue , 2010, Pages 109-135

  Jakoubi, Stefan ^a   Tjoa, Simon ^b   Goluch, Sigrun ^a   Kitzler, Gerhard ^a  

^a Secure Business Austria   (Austria)

^b St Poelten University of Applied Sciences   (Austria)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 84976485679     PISSN: 19316828     EISSN: 19316836     Source Type: Book Series    
DOI: 10.1007/978-1-4419-1636-5_6     Document Type: Article

References (35)

1. F. Braber, I. Hogganvik, M.S. Lund, K. Stølen, and F. Vraalsen. Model-based security analysis in seven steps-a guided tour to the CORAS method. BT Technology Journal, 25: 101-117, 2007.
2. British Standard Institute (BSI). British standard bs25999-1: 2006: Business continuity management-part 1: Code of practice, 2006.
3. British Standard Institute (BSI). British standard bs25999-2: 2007: Business continuity management-part 2: Specification, 2007.
4. BSI (German Federal Office for Information Security). IT-Grundschutz Manual (English version), 2004.
5. Business Continuity Institute. Good Practice Guidelines, 2008.
6. A. Ekelhart, S. Fenz, and T. Neubauer. Aurum: A framework for supporting information security risk management. In Proceedings of the 42nd Hawaii International Conference on System Sciences (HICCS 2009), pages 1-10, 2009a.
7. A. Ekelhart, S. Fenz, and T. Neubauer. Ontology-based decision support for information security risk management. In International Conference on Systems (ICONS 2009), pages 80-85, 2009b.
8. European Commission. Auditing directives. URL: http://ec.europa.eu/internal_market/auditing/ directives/index_en.htm, Accessed May 2010.
9. European Network and Information Security Agency (ENISA). Business and it continuity overview and implementation principles, 2008.
10. S. Fenz, A. Ekelhart, and T. Neubauer. Business process-based resource importance determination. In Proceedings of the 7th International Conference on Business Process Management (BPM2009), pages 113-127, 2009.
11. Gartner Inc. Gartner EXP worldwide survey of more than 1500 CIOS shows IT Spending to be flat in 2009, 2009.
12. G. Goluch, A. Ekelhart, S. Fenz, S. Jakoubi, S. Tjoa, and T. Mück. Integration of an ontological information security concept in risk aware business process management. In 41st Hawaii International Conference on Systems Science (HICSS-41 2008), page 377, 2008.
13. Gartner Inc. Misconceptions on process optimization and simulation. Gartner Blog, 2009.
14. International Organization for Standardization. Iso/iec 13335-1: 2004, information technology- security techniques-management of information and communications technology security, Part 1: Concepts and models for information and communications technology security management, 2004.
15. International Organization for Standardization. Iso/iec 24762: 2008 information technology- security techniques-guidelines for information and communications technology disaster recovery services, 2008.
16. S. Jakoubi and S. Tjoa. A reference model for risk-aware business process management. In International Conference on Risks and Security of Internet and Systems. IEEE, New York, 2009.
17. S. Jakoubi, S. Tjoa, and G. Quirchmayr. Rope: A methodology for enabling the risk-aware modelling and simulation of business processes. In Fifteenth European Conference on Information Systems, pages 1596-1607, 2007.
18. S. Jakoubi, G. Goluch, S. Tjoa, and G. Quirchmayr. Deriving resource requirements applying riskaware business process modeling and simulation. In 16th European Conference on Information Systems, pages 1542-1554, 2008.
19. S. Jakoubi, T. Neubauer, and S. Tjoa. A roadmap to risk-aware business process management. In Proceedings of the International Workshop on Secure Service Computing (SSC 2009), 2009.
20. A.K. Jallow, B. Majeed, K. Vergidis, A. Tiwari, and R.Roy. Operational risk analysis in business processes. BT Technology Journal, 25: 168-177, 2007.
21. D. Karagiannis, J. Mylopoulos, and M. Schwab. Business process-based regulation compliance: The case of the sarbanes-oxley act. In Proceedings of the 15th IEEE International Requirements Engineering Conference, pages 315-321, 2007.
22. N. Milanovic, B. Milic, and M. Malek. Modeling business process availability. In IEEE International Conference on Services Computing (SCC 2008), pages 315-321, 2008.
23. National Institute of Standards and Technology. NIST SP800-30, risk management guide fir information technology systems, 2002.
24. National Institute of Standards and Technology. NIST SP800-61: Computer security incident handling guide, 2004.
25. D. Neiger, L. Churilov, M. zur Muehlen, and M. Rosemann. Integrating risks in business process models with value focused process engineering. In European Conference on Information Systems (ECIS 2006), 2006.
26. One Hundred Seventh Congress of the United States of America. Sarbanes-Oxley Act, 2002.
27. A. Rodríguez, E. Fernández-Medina, and M. Piattini. Towards a UML 2.0 extension for the modeling of security requirements in business processes. In International Conference on Trust and Privacy in Digital Business (TrustBus 2006), pages 51-61, 2006.
28. S. Sackmann. A reference model for process-oriented IT risk management. In 16th European Conference on Information Systems, 2008.
29. S. Sackmann, L. Lowis, and K. Kittel. Selecting services in business process execution-a risk-based approach. In Business Services: Konzepte, Technologien, Anwendungen, Tagung Wirtschaftsinformatik (WI09), 2009.
30. S. Sadiq, G. Governatori, and K. Namiri. Modelling control objectives for business process compliance. In 5th International Conference on Business Process Management (BPM2007), pages 149-164, 2007.
31. The MathWorks. Simulink-simulation and model-based design, URL: http://www.mathworks. com/products/simulink/, Accessed May 2010.
32. S. Tjoa, S. Jakoubi, G. Goluch, and G. Quirchmayr. Extension of a methodology for risk-aware business process modeling and simulation enabling process-oriented incident handling support. In Advanced Information Networking and Applications, pages 48-55, 2008a.
33. S. Tjoa, S. Jakoubi, and G. Quirchmayr. Enhancing business impact analysis and risk assessment applying a risk-aware business process modeling and simulation methodology. In International Conference on Availability, Reliability and Security, pages 179-186, 2008b.
34. I. Weber, G. Governatori, and J. Hoffmann. Approximate compliance checking for annotated process models. In 1st International Workshop on Governance, Risk and Compliance-Applications in Information Systems (GRCIS’08), 2008.
35. M. zur Muehlen and M. Rosemann. Integrating risks in business process models. In Australasian Conference on Information Systems (ACIS 2005), 2005.