Management of Security Risks in the Enterprise Architecture using ArchiMate and Mal-activities

Turvalisuse tase on ettevõtte üks peamisi elemente, mida tuleb organisatsioonis kontrollida. Kui ettevõtte äri arengut modelleeritakse on eesmärgiks katkematu ettevõtlus, aga tihti ei võeta sellega arvesse turvanõudeid. Selliselt on aga infosüsteemi kõrget turvalisuse taset väga raske säilitada. Selles dokumendis käsitletakse lähenemisviisi, mis parandab julgeoleku vastumeetmeid, et selleläbi aidata ettevõtte arhitektuuri turvalisemaks muuta. Ettevõtte arhitektuurimudeli ja turvariski juhtimise vaheliste soeste leidmine toimub läbi Infosüsteemi turvariskide juhtimise domeeni mudeli (ISSRM). Ettevõtte arhitektuuri modelleerimiseks on kasutatud ArchiMate modelleerimiskeelt. Paljudest riskide kirjeldamise keeltest on sobilikum mal-activity (pahatahtlikute tegevuste) diagrammid, sest see aitab julgeoleku riskide juhtimist kõige paremini visualiseerida. Struktureeritud joondus aitab ülalnimetatud keelte vahelisi seoseid näidata ning annab informatsiooni kõige haavatavamate punktide kohta süsteemis. Turvalisuse taseme säilitamine aitab ettevõttel äritegevust viia sõltumatuks infosüsteemist. Selle dokumendi tulemuseks on ArchiMate ja Mal-activity diagrammide vahelised seostetabelid ja reeglid. Nende kahe keele vaheliseks seoseks on ISSRM. Kirjeldatud lähenemise valideerimine on läbi viidud ühe näite põhjal, mis on võetud CoCoME juhtumiuuringust. Näite põhjal on loodud mitmeid illustreerivaid pilte valideerimise kohta. Kõige viimasena on kirjeldatud meetodiga saadud tulemust võrreldud Grandy et.al. (2013) poolt arendatud lähenemisega. Võtmesõnad: Infosüsteem, Infosüsteemi turvariskide juhtimine, ettevõtte arhitektuur, ettevõtte arhitektuuri mudel, julgeoleku vastumeetmed, turvariskide juhtimine, riskidele orjenteeritud modelleerimiskeeled, ArchiMate, mal-activity diagrammid.Security level of the enterprise is one of the main elements that should be taken under control in the organization. It is difficult to maintain high security level of Information System. Since development of enterprise architecture is targeted on continues business flow modeling, it sometimes does not take into account security requirements. The paper provides an approach to improve security countermeasures to contribute with secure Enterprise Architecture. Filling the gap between Enterprise Architecture model and Security Risk Management is done through Information System Security Risk Management domain model (ISSRM). To build the Enterprise Architecture model, ArchiMate modelling language is being used. Among different risk-oriented languages, selection was done in favor of Mal-activity diagrams, which help to provide visual concept of Security Risk Management. Structured alignment can show the mapping between aforementioned terms and provide the information about most vulnerable points of the system. The maintenance of security level will help to make business flow independent from the state of Information System. The outcome of this paper is an alignment tables and rules between ArchiMate and Mal-activity diagrams. The mapping link between these two languages is ISSRM. Validation of our approach is done on the example, which is taken from CoCoME case study. It is shown on number of illustrative pictures. After getting the results, there is a comparison of the output between presented method and approach developed by Grandry et.al. (2013). Keywords: Information System, Information System Security Risk Management, Enterprise Architecture, Enterprise Architecture model, security countermeasures, Security Risk Management, risk-oriented modelling languages, ArchiMate, Mal-activity diagrams

Alignment of Misuse Cases to ISSRM

Digitaalse ja sotsiaalse elu vaheline piirjoon on hägunemas ning informatsiooni süsteemide turvalisuse ja informatsiooni per se turvalisus tekitab muret. Samuti pälvib tähelepanu süsteemide turvalisuse arendamine ja säilitamine. Olemasolevad uurimused viitavad mitmetele juhtumitele, kus turvalisuse aspekti võeti arvesse ainult süsteemi väljatöötamise protsessi lõpus, jättes välja süstemaatilise turvalisuse analüüsi süsteemi ja tarkvara nõuete ja kavandamise etappidel. Misuse case diagrams on üks võimalikke viise seostada turvalisuse analüüsi ja süsteemi funktusionaalsete nõuete definitsiooni. Nende peamine eesmärk on negatiivsete stsenaariumite modeleerimine, seoses defineeritud süsteemi funktsionaalsete nõuete esilekutsumise ja analüüsiga. Hoolimata sellest eelisest on väärkasutatud juhtumid üsna ebatäpsed; nad ei täida riskianalüüsi organiseerimise strateegiaid, ja seega võivad viia valetõlgendamiseni turvalisusega seotud konseptsioonides. Sellised limitatsioonid võivad potentsiaalselt viia puudulike lahendusteni turvalisuse alal. Sageli tuleb organisatsioonidel leida enda turvalisuse lahendused, et kaitsta oma ressursse ja varasid. Käesolevas töös rakendame süstemaatilist lähenemist, et mõista kuidas Misuse case diagrams aitavad organiseerida ettevõtete varasid, potentsiaalseid süsteemiriske ja turvalisuse nõudeid, et leevendada riske. Täpsemalt ühtlustame Misuse case konstruktsiooni domeeni mudeli kontseptiga, informatsiooni süsteemi turvalisusriski haldamiseks (Information Systems Security Risk Management; ISSRM). Lisaks, põhinedes ISSRM ja keelelisele ühtlustamisele, uurime ja arendame reeglid, et tõlkida Misuse cas diagrams Secure Tropos mudelile. Käesoleva uurimuse panusel on mitmeid eeliseid. Esmalt aitab potentsiaalselt mõista, kuidas Misuse case turvalisuse riski haldamisega tegeleb. Teiseks määratleb meetodi, mis toetab turvalisuse nõuete põhjendamist arendatud süsteemi kehtestamisel ja rakendamisel. Viimaseks, Secure Troposi transformeerumine aitab potentsiaalselt arendajatel (ja teistel süsteemi vahendajatel) mõista miks turvalisuse lahendused on olulised ning millised on erinevate huvigruppide kompromissid. Plaanime kinnitada saadud tulemused, kus mudeli kvaliteet seoses selle arusaadavusega on mõõdetud Misuse case diagram jaoks. Usume, et selline Misuse case seadistamine koos ISSRM ja Misuse case diagram transformeerumine eesmärgile orienteeritud modelleerumisele, on kasulik süsteemi ja tarkvara arendajatele. Esmalt aitab mõista turvalisusega seotud probleeme varajastes arendamise staadiumites. Teiseks aitab vaadata probleemi erinevatest vaatenurkadest, mõistes erinevaid turvalisuse arendamise perspektiive.As a line between digital and social life is diminishing, security concerns of information systems and information per se, also developing and maintaining system security are gaining a rising attention. Nevertheless, the existing practices report on numerous cases when security aspects were considered only at the end of the system development process, thus, missing the systematic security analysis during system and software requirements and design stages. Misuse case diagrams are one of the possible ways to relate security analysis and system functional requirements definition. Their main goal is to model negative scenarios with respect to the defined system functional requirement elicitation and analysis. Despite this fundamental advantage, misuse cases tend to be rather imprecise; they do not comply with security risk management strategies, and, thus, could lead to misinterpretation of the security-related concepts. Such limitations could potentially result in poor security solutions. Quite often, the organizations have to adopt their own security solutions to safeguard their resources and assets. In this thesis we will apply a systematic approach to understand how misuse case diagrams could help model organisational assets, potential system risks, and security requirements to mitigate these risks. More specifically we will align misuse case constructs with the concepts of the domain model for the information systems security risk management (ISSRM). In addition, based on such an ISSRM and language alignment we will investigate and develop rules to translate misuse case diagrams to the Secure Tropos model. The contribution of this research has several benefits. Firstly, it will potentially help understand how misuse case could deal with security risk management. Secondly, it will define method to support reasoning for the security requirements introduction and implementation in the developed system. Finally the transformation to the Secure Tropos would potentially help developers (and other system stakeholders) to understand why security solutions are important and what different stakeholder trade-offs are. We plan to validate our results where the quality model regarding its comprehensibility will be measured for the misuse case diagrams. We believe that such alignment of the misuse cases with ISSRM and misuse case diagram transformation to the goal-oriented modelling language will be beneficial to system and software developers. Firstly, it will allow understanding security concerns at the earlier stages of development. Secondly it will help to view security problems from different angles, understanding different security development perspectives

Revision of Security Risk-oriented Patterns for Distributed Systems

Turvariskide haldamine on oluline osa tarkvara arendusest. Arvestades, et enamik tänapäeva ettevõtetest sõltuvad suuresti infosüsteemidest, on turvalisusel oluline roll sujuvalt toimivate äriprotsesside tagamisel. Paljud inimesed kasutavad e-teenuseid, mida pakuvad näiteks pangad ja haigekassa. Ebapiisavatel turvameetmetel infosüsteemides võivad olla soovimatud tagajärjed nii ettevõtte mainele kui ka inimeste eludele.\n\rTarkvara turvalisusega tuleb tavaliselt tegeleda kogu tarkvara arendusperioodi ja tarkvara eluea jooksul. Uuringute andmetel tegeletakse tarkvara turvaküsimustega alles tarkvara arenduse ja hooldus etappidel. Kuna turvariskide vähendamine kaasneb tavaliselt muudatustena informatsioonisüsteemi spetsifikatsioonis, on turvaanalüüsi mõistlikum teha tarkvara väljatöötamise algusjärgus. See võimaldab varakult välistada ebasobivad lahendused. Lisaks aitab see vältida hilisemaid kulukaid muudatusi tarkvara arhitektuuris.\n\rKäesolevas töös käsitleme turvalise tarkvara arendamise probleemi, pakkudes lahendusena välja turvariskidele orienteeritud mustreid. Need mustrid aitavad leida turvariske äriprotsessides ja pakuvad välja turvariske vähendavaid lahendusi. Turvamustrid pakuvad analüütikutele vahendit turvanõuete koostamiseks äriprotsessidele. Samuti vähendavad nad riskianalüüsiks vajalikku töömahtu. Oma töös joondame me turvariskidele orienteeritud mustrid vastu hajussüsteemide turvaohtude mustreid. See võimaldab meil täiustada olemasolevaid turvariski mustreid ja võtta kasutusele täiendavaid mustreid turvariskide vähendamiseks hajussüsteemides.\n\rTurvariskidele orienteeritud mustrite kasutatavust on kontrollitud lennunduse äriprotsessides. Tulemused näitavad, et turvariskidele orienteeritud mustreid saab kasutada turvariskide vähendamiseks hajussüsteemides.Security risk management is an important part of software development. Given that majority of modern organizations rely heavily on information systems, security plays a big part in ensuring smooth operation of business processes. Many people rely on e-services offered by banks and medical establishments. Inadequate security measures in information systems could have unwanted effects on an organization’s reputation and on people’s lives. Security concerns usually need to be addressed throughout the development and lifetime of a software system. Literature reports however, that security is often considered during implementation and maintenance stages of software development. Since security risk mitigation usually results with changes to an IS’s specification, security analysis is best done at an early phase of the development process. This allows an early exclusion of inadequate system designs. Additionally, it helps prevent the need for fundamental and expensive design changes later in the development process. In this thesis, we target the secure system development problem by suggesting application of security risk-oriented patterns. These patterns help find security risk occurrences in business processes and present mitigations for these risks. They provide business analysts with means to elicit and introduce security requirements to business processes. At the same time, they reduce the efforts needed for risk analysis. We confront the security risk-oriented patterns against threat patterns for distributed systems. This allows us to refine the collection of existing patterns and introduce additional patterns to mitigate security risks in processes of distributed systems. The applicability of these security risk-oriented patterns is validated on business processes from aviation turnaround system. The validation results show that the security risk-oriented patterns can be used to mitigate security risks in distributed systems

Pattern Based Security Requirement Derivation with Security Risk-aware Secure Tropos

Informatsioonisüsteem (IS) toetab suurt hulka modernse ühiskonna jaoks olulisi funktsioone. IS sisaldab üha suurenevat hulka andmeid ja informatsiooni, sealhulgas per-sonaalseid pilte ja andmeid tervise või finantstehingute kohta. Üha suurenev küberrünna-kute arv on tinginud vajaduse turvaliste infosüsteemide kiiremaks loomiseks. Et arendada turvalist IS-i, tuleb tuvastada turbe-eesmärgid ning need vastavalt ellu viia. Tulemuspõhine arendus tagab turbe-eesmärkide tulemuslikkuse, pakkudes metodoloogiat, mis võimaldab turvalisuse nõuete induktsiooni läbi kogu informatsioonisüsteemi arenduse protsessi. See on saavutatav, kui võtta igat süsteemikomponenti kui eesmärgile orienteeritud osa. Olgugi, et tulemuspõhine modelleerimine on kasulikuks osutunud, on sellel ka mõningaid puudu-seid. Peamine puudus peitub detailsuses, mille tõttu see protsess võib lühikese ajaga muu-tuda komplekseks, tõstes ka kogu ülejäänut protsessi keerukusetaset. Seetõttu on oluline kasutada struktureeritud lähenemisviisi, mis võimaldab kogu protsessi jooksul samm-sammulist juhendit rakendada. Turvalisuse mustrid on korduvkasutatavadja võimaldavad lahendada tarkvaraarenduse protsessi käigus sagedasti ilmnevaid probleeme. Käesolevas magistritöös uuritakse mustripõhise turvanõuete kogumise protsessi integreerimist, tule-muspõhise IS-i arendamisel. Selle eesmärgiks on SRP’d (Security Risk-oriented Patterns) kasutades pakkuda protsessi, mis võimaldab turvanõuete induktsiooni RAST (Security Risk-aware Secure Tropos) mudelis. RAST on turvalisuse tulemuspõhise modelleerimise keel, mis on kohaldatav läbi kogu tarkvaraarenduse protsessi nii varasematele kui hilisema-tele nõudlustele, arhitektuurile, üksikasjalikule projekteerimisele kui ka lõplikule rakenda-misele. Käesoleva magistritöö panus on viie SRP avaldamine, kasutades selleks RAST mo-delleerimise keelt. Töös tuuakse välja sammud, mida väljapakutud turvalisuse mustrite ra-kendamiseks kasutada. Töö autor annab omapoolse panuse viies läbi juhtumiuuringu, mis kinnitab autori poolt pakutud mustrite üldise kasutamisest selle rakenduse protsessist. Juh-tumiuuringust selgus ka, et töös välja pakutud mustreid on võimalik kasutada süsteemi analüüsi alguspunktina, et kiirendada turvalisuse nõuete väljaselgitamisprotsessi ning seda efektiivsemaks muuta.Information systems (IS’s) support a multitude of functions vital to the modern society. IS’s carry an ever increasing volume of data and information, including personal pictures, health data or financial transactions. Continuously increasing rates of cyber-attacks have led to the subsequent need to rapidly develop secure IS. To develop secure IS’s, security goals need to be identified and fulfilled accordingly. Goal-oriented development fulfils the achievement of security goal by providing a methodology that enables security requirement elicitation throughout the entire development of an information system. This is achieved by considering every component of a system as an actor that is driven by goals that the actor strives to achieve. Nevertheless goal-oriented modeling has proven itself to be valid it maintains multiple shortcomings. The main disadvantage lays in the high granularity of the process making it complex very fast and subsequently raising the level of complexity of the overall process. Therefore a structured approach that would provide a step-by-step guide throughout the application of the process would be essential. Security patterns are proven to be reusable solutions that address recurring security problems which are commonly faced during the process of software development. In this master thesis we investigate the integration of a pattern based security requirement elicitation process in the goal-oriented IS development. By performing this integration we aim at providing a process that enables the elicitation of security requirements from Security Risk-aware Secure Tropos (RAST) models. RAST is a security goal-oriented modeling language that is applicable throughout the complete process of software development from early to late requirements, architecture, detailed design and final implementation. The contribution of this thesis are five Security Risk-aware Patterns expressed using RAST. The thesis outlines the steps to be executed to apply the proposed security patterns. We validated our contribution by performing a case study that confirmed the overall usability of our proposed patterns and the pattern application process. Additionally the case study determined that the provided patterns can be used as a starting point for a faster and more efficient in identifying security requirements

An Extension of Business Process Model and Notation for Security Risk Management

Kaasaegsed infosüsteemide arendamise metoodikad hõlmavad erinevaid tehnilisi äriprotsesside modelleerimise meetmeid. Äriprotsesside modelleerimiseks kasutatav keel (BPMN) on tänapäeval muutunud üheks standartseks meetmeks, mis edukalt rakendatakse infosüsteemide loomisel ning edasi arendamisel selleks, et ettevõtete äriprotsesse kirjeldada ja modelleerida.Vaatamata sellele, et BPMN on hea töörist, mille abil on võimalik ettevõtte äriprotsesse mõistma ja esitama, see ei võimalda äriprotsesside modelleerimisel adresseerida süsteemi turvalisuse aspekte. Autor leiab, et see on BPMN nõrk külg, selle pärast, et turvalise infosüsteemi arendamiseks on oluline nii äriprotsesse kui ka süsteemi turvalisust vaadeldada tervikuna. Käesolevas magistritöös autor töötab välja BPMN 2.0 keele jaoks uusi elemente, mis edaspidi peavad võimaldama adresseerima turvalisuse temaatika süsteemi modelleerimisel. Autori pakutud lahendus põhineb BPMN modelleerimiskeele seostamisel turvalisuse riski juhendamise metoodikaga (ISSRM). Antud magistritöös rakendatakse struktureeritud lähenemine BPMN peamiste aspektide analüüsimisel ja turvalisuse riskide juhtimiseks uute elementide väljatöötamisel, selleks ühildades BPMN ning ISSRM-i kontsepte. Magistritöös on demonstreeritud väljatöötatud lisaelementide kasutus, selgitatud kuidas antud elementidega laiendatud BPMN võimaldab väljendada ettevõtte varasid (assets), nendega seotuid riske (risks) ja riskide käsitlust (risk treatment). See on analüüsitud internetkaupluse varade konfidentsiaalsuse, terviklikkuse ja kättesaadavuse näitel. Autor on veendunud, et BPMN laienemine turvalisuse kontseptide osas ja antud töö raames tehtud konkreetsed ettepanekud aitavad infosüsteemide analüütikutele mõistma kuidas süsteemi turvalisust arendada nii, et läbi äriprotsessi tuvastatud olulisemate ettevõtte varade turvalisus oleks infosüsteemis käsitletud ning tagatud. Autori poolt antud käsitlus on vaadeldud ka laiemas mõttes, nimelt, BPMN keelele pakutud laienemisega avaneb perspektiiv äriprotsesside ja turvalisuse mudeleite koosvõimele ning BPMN-i teiste modelleerimise metoodikatega, nagu ISSRM või Secure Tropos, integreerimisele.Modern Information System (IS) development supports different techniques for business process modelling. Recently Business Process Model and Notation (BPMN) has become a standard that allows modelers to visualize organizational business processes. However, despite the fact that BPMN is a good approach to introduce and understand business processes, there is no opportunity to address security concerns while analysing the business needs. This is a problem, since both business processes and security concerns should be understood in parallel to support a development of the secure systems. In current thesis we introduce the extensions for BPMN 2.0 regarding security aspects. The following proposal is based on alignment of the modelling notation with IS security risk management (ISSRM).We apply a structured approach to understand major aspects of BPMN and propose extensions for security risk management based on the BPMN alignment to the ISSRM concepts. We demonstrate the use of extensions, illustrating how the extended BPMN could express assets, risks and risk treatment on few running examples related to the Internet store assets’ confidentiality, integrity and availability. We believe that our proposal would allow system analysts to understand how to develop security requirements to secure important assets defined through business processes. We also attempt to observe the following approach in the broader sense and we open a possibility for the business and security model interoperability and the model transformation between BPMN and another modelling approach also aligned to ISSRM, Secure Tropos

Extension and Application of Event-driven Process Chain for Information System Security Risk Management

Turvatehnika konstrueerimine on üks suuremaid murekohti süsteemi arenduses ja sellele tuleks tähelepanu pöörata kogu arendusprotsessi jooksul. Turvaliseks modelleerimiseks on mitmeid erinevaid keeli, mis aitavad hallata turvariske juba nõuete staadiumis. Käesolevas töös keskendutakse esmalt Event-driven Process Chain (EPC)-le, mida kasutatakse äriprotsesside modelleerimisel. Täpsemalt öeldes uuritakse, kuidas antud keel toetab infosüsteemi turberiskihaldust (ISSRM). Uurimuse eesmärk on välja selgitada EPC jaoks vajalikud turbenõuded. Nende tulemusena saame vastavustabeli EPC konstruktsioonide ja ISSRM domeeni mudeli kontseptide vahel. Järgnevalt laiendame EPC keelt ja selle konstruktsioone EPC ja ISSRM vastavustabeli seostega. Tekkinud laiendatud keelt kutsume “Security-Oriented EPC”. Laiendatud modelleerimiskeel sisaldab uut konstruktsioonide kogumikku, mis viitab ISSRM kontseptidele. Olles selgitanud turvanõuete olulisust varajases arendusstaadiumis, esitleme töötluse suunised, et viia ellu tõlked Security-Oriented EPC ja Mal-Activity Diagrams (MAD) vahel. Meie ettepanek põhineb EPC keele süstemaatiliste ja maandatud laiendustel ja selle vastastikusest sõltuvusest ISSRM domeeni mudelisse. Vastavuses olevad tulemused aitavad ärianalüütikutel mõista, kuidas modelleerida turvariske süsteemi nõuete ja disainimise staadiumites. Lisaks annavad töötluse tulemused võimaluse koostööks erinevate modelleerimiskeelte vahel, mida analüüsitakse kasutades sama kontseptuaalset raamistikku.Security engineering is one of the important concerns during the system development and it should be addressed throughout the whole system development process. Besides, there are several languages for security modeling that help dealing with security risk management at the requirements stage. In this thesis, first of all, we are focusing on Event-driven Process Chain (EPC), which is used during the business process modeling. More specifically, we investigate how this language supports information system security risk management (ISSRM). The purpose of this investigation is the problem of security requirements need of EPC. As a result, we obtain an alignment table between EPC constructs and ISSRM domain model concepts. Next, we extend the EPC language and its constructs with respect to the alignment table between EPC and ISSRM. As a consequence, we call the extended language as “Security-Oriented EPC”. The extended language contains new set of constructs which refer to ISSRM concepts. Lastly, after clarifying the importance of security requirements at the early system development, we present transformation guidelines to perform forward model translations from Security-Oriented EPC to Mal-Activity Diagrams (MAD). During the transformation, our proposal is based on the systematic and grounded extensions of EPC language and its interdependency to the domain model of ISSRM. Alignment results may help business analysts understand how to model security risks at the system requirement and design stages. Also, transformation results pave the way for interoperability between the modeling languages that are analysed using the same conceptual framework

A risk based approach for managing information technology security risk within a dynamic environment

Information technology (IT) security, which is concerned with protecting the confidentiality, integrity and availability of information technology assets, inherently possesses a significant amount of known and unknown risks. The need to manage IT security risk is regarded as an important aspect in the daily operations within organisations. IT security risk management has gained considerable attention over the past decade due to the collapse of some large organisations in the world. Previous investigative research in the field of IT security has indicated that despite the efforts that organisations use to reduce IT security risks, the trend of IT security attacks is still increasing. One of the contributing factors to poor management of IT security risk is attributed to the fact that IT security risk management is often left to the technical security technologists who do not necessarily employ formal risk management tools and reasoning. For this reason, organisations find themselves in a position where they do not have the correct approach to identify, assess and treat IT security risks. The IT security discipline is complex in nature and requires specialised skills. Organisations generally struggle to find a combination of IT security and risk management skills in corporate markets. The scarcity of skills leaves organisations with either IT security technologists who do not apply risk management principles to manage IT security risk or risk management specialists who do not understand IT security in order to manage IT security risk. Furthermore, IT is dynamic in nature and introduces new threats and vulnerabilities as it evolves. Taking a look at the development of personal computers over the past 20 years is indicative of how change has been constant in this field, from big desktop computers to small mobile computing devices found today. The requirement to protect IT against threats associated with desktops was far less than the requirement associated with protecting mobile devices. There is pressure for organisations to ensure that they stay abreast with the current technology and associated risks. Failure to understand and manage IT security risk is often cited as a major cause of concern within most organisations’ IT environments because comprehensive approaches to identify, assess and treat IT security risk are not consistently applied. This is due to the fact that the trend of IT security attacks across the globe is on the increase, resulting in gaps when managing IT security risk. Employing a formal risk based approach in managing IT security risk ensures that risks of importance to an organisation are accounted for and receive the correct level of attention. Defining an approach of how IT security risk is managed should be seen as a fundamental task and is the basis of this research. This study aims to contribute to the field of IT security by developing an approach that assists organisations in treating IT security risk more effectively. This is achieved through the use of a combination of existing best practice IT security frameworks and standards principles, basic risk management principles, as well as existing threat modelling processes. The approach developed in this study serves to encourage formal IT security risk management practices within organisations to ensure that IT security risk is accounted for by senior leadership. Furthermore, the approach is anticipated to be more proactive and iterative in nature to ensure that external factors that influence the increasing trend of IT security threats within the IT environment are acknowledged by organisations as technology evolves.ComputingM. Sc. (Computing

Designing Visually Effective and Intuitive Modelling Notations for Security Risk Management

Turvariski juhtimine on toimingute kogum, mille eesmärk on tuvastada ja vähendada turvariske tarkvaraarenduse varastest etappidest alates. Modelleerimisel võivad nii lõppkasutajad kui ka turvaanalüütikud kasutada turvariskidele orienteeritud modelleerimiskeeli. Siiski puudub olemasolevatel keeltel semantiline läbipaistvus, mis tekitab õppimiskõverale täiendavaid takistavaid barjääre ja sügavust. Veelgi enam, hetkel saadaolevad modelleerimiskeeled töötati välja ilma mingit kindlat disaini arvestamata ja nende intuitiivsus on vilets. Kuna modelleerimiskeele oluline tunnusjoon on kognitiivne efektiivsus, keskendub see uuring saadavalolevate turvariskidele orienteeritud modelleerimiskeelte (Secure BPMN, Secure Tropos, Misuse Cases, Mal-activity Diagrams) mõistmise parandamisele. Sellel eesmärgil pakutakse välja ikoonide komplekt, mille võiks integreerida olemasolevatesse modelleerimiskeeltesse. Ikoonide ühtlustatud komplekt suurendaks domeenikohaste kontseptide äratuntavust, mis on toodud infosüsteemide turvariskide juhtimise domeenimudelis, lühendaks õppimiskõverat ning parandaks olemasolevate teadete üldist intuitiivsust. Soovitatav ikoonide komplekt on koostatud mitme empiirilise uuringu põhjal, mis on tehtud kolmes kohas, mis asuvad eri geograafilistes piirkondades ja esindavad erinevaid kultuurilisi taustu. Teadete parandatud kognitiivset efektiivsust, täiendatuna soovitatud ikoonide komplektiga, on kontrollitud hindamisuuringuga, mis näitas olemasolevate teadetega võrreldes paremat mõistmistaset.Security risk management is a set of activities, aimed at identifying and mitigating security risks starting from the early stages of software development. A set of security risk-oriented modelling languages could be used by both end users and security analysts to perform modelling activities. However, existing languages lack semantical transparency, which re-sults in additional grasping barriers and steepness of learning curve. Moreover, presently available modelling languages were developed with no explicit design rationale in mind and perform poorly in terms of effectiveness and intuitiveness. Since the vital characteris-tic of modelling language is cognitive effectiveness, this research is focused on improving visual perception of the available security risk-oriented modelling languages (Secure BPMN, Secure Tropos, Misuse Cases, Mal-activity Diagrams). This goal is fulfilled by proposing a set of icons, which could be incorporated into existing modelling languages. Unified set of icons would enhance the recognizability of domain-specific concepts, out-lined in Information Systems Security Risk Management Domain Model, as well as reduce the learning curve and improve the overall cognitive efficiency of available notations. Pro-posed icon set is composed based on the outcomes of several empirical studies, performed in 3 distinct locations, belonging to various geographical areas and exhibiting a variety of cultural backgrounds. Improved cognitive effectiveness of notations, augmented with pro-posed icon set, is validated by the conducted evaluation study, which demonstrated in-creased level of comprehension as compared with existing notations