A survey on automation of security requirements in service-based business processes <s> Open challenges <s> Cloud computing enables the provisioning of dynamically scalable resources as a service. Next to cloud computing, the paradigm of Service-oriented Architectures emerged to facilitate the provisioning of functionality as services. While both concepts are complementary, their combination enables the flexible provisioning and consumption of independently scalable services. These approaches come along with new security risks that require the usage of identity and access management solutions and information protection. The requirements concerning security mechanisms, protocols and options are stated in security policies that configure the interaction between services and clients in a system. In this paper, we present our cloud-based Service Security Lab that supports the on-demand creation and orchestration of composed applications and services. Our cloud platform enables the testing, monitoring and analysis of Web Services regarding different security configurations, concepts and infrastructure components. Since security policies are hard to understand and even harder to codify, we foster a model-driven approach to simplify the creation of security configurations. Our model-driven approach enables the definition of security requirements at the modelling layer and facilitates a transformation based on security configuration patterns. <s> BIB001 </s> A survey on automation of security requirements in service-based business processes <s> Open challenges <s> Business processes have become important resources, both for an enterprise's performance and to enable it to maintain its competitiveness. The languages used for business process representation have, in recent years, been improved and new notations have appeared. However, despite the wide acceptance of the importance of business process security, to date the business analyst perspective in relation to security has hardly been dealt with. Moreover, security requirements cannot be represented in modern business process modeling notations. In this paper, we present an extension of UML 2.0 activity diagrams which will allow security requirements to be specified in business processes. Our proposal, denominated as BPSec (Business Process Security), is Model Driven Architecture compliant since it is possible to obtain a set of UML artifacts (Platform Independent Model-PIM) used in software development from a Secure Business Process model specification (Computation Independent Model-CIM). We also present the application of our approach to an example based on a typical health care institution, in which our M-BPSec method is employed as a framework for the use of our UML extension. <s> BIB002 </s> A survey on automation of security requirements in service-based business processes <s> Open challenges <s> Risk management has become an essential mechanism for business and security analysts, since it enable the identification, evaluation and treatment of any threats, vulnerabilities, and risks to which organizations maybe be exposed. In this paper, we discuss the need to provide a standard representation of security countermeasures in order to automate the selection of countermeasures for business processes. The main contribution lies in the specification of security pattern as standard representation for countermeasures. Classical security pattern structure is extended to incorporate new features that enable the automatic selection of security patterns. Furthermore, a prototype has been developed which support the specification of security patterns in a graphical way. <s> BIB003 </s> A survey on automation of security requirements in service-based business processes <s> Open challenges <s> Non-functional concerns such as security are essential in business process management and in service based realizations of business processes. Many works and efforts addressed these concerns on the service layer by developing a number of XML-based standards such as WS-Security and other WS-* standards. However, there are non-functional properties that are on the business process layer and need therefore to be specified in business process models. We notice nevertheless that current business process modeling languages lack appropriate means for specifying non-functional properties such as security for example. In this paper, we present a model driven approach for the development of service based business processes which supports both functional and non functional concerns. We also introduce the concept of profiles to BPMN in analogy to UML Profiles. Based on that, we present a BPMN profile to specify security properties in business process models and illustrate its usage through an example. <s> BIB004 </s> A survey on automation of security requirements in service-based business processes <s> Open challenges <s> Business process modelling and security engineering are two important concerns when developing information system. However current practices report that security is addressed at the later development stages (i.e. design and implementation). This raises a question whether the business processes are performed securely. In this paper, we propose a method to introduce security requirements to the business processes through the collaboration between business and security analysts. To support this collaboration we present a set of security risk-oriented patterns. We test our proposal in two industrial business models. The case findings characterise pattern performance when identifying business assets, risks, and countermeasures. <s> BIB005 </s> A survey on automation of security requirements in service-based business processes <s> Open challenges <s> The use of business process standards to model and execute business needs is growing rapidly. In addition, Service-oriented Computing has been adopted to realize business processes, which basically consists of executing the process activities using services available in the Internet. In this context, the importance of security is apparent, because sensitive data sent over the Internet may be accessed by unauthorized third-parties. To prevent security problems, users may associate security requirements that must be enforced in essential tasks of the business process. This fact leads to the need of automation, because both functional and security requirements should be modeled, at high-level, and enforced, at execution level. This work proposes a cloud-based solution named BPA-Sec4Cloud that supports all phases of the security-aware business process automation, from its modeling to its deployment. The use of a cloud-based solution facilitates the deployment process because all needed resources are available in the cloud and ready to be used. In addition, the cloud is also used as a platform in order to provide specific services, such as translators, to support the automation process. In order to evaluate the BPA-Sec4Cloud, the solution was compared against existing solutions through the use of metrics related to the quality of generated artifacts. <s> BIB006 </s> A survey on automation of security requirements in service-based business processes <s> Open challenges <s> Making today’s systems secure is an extremely difficult and challenging problem. Socio and technical issues interplay and contribute in creating vulnerabilities that cannot be easily prevented without a comprehensive engineering method. This paper presents a novel approach to support process-aware secure systems modeling and automated generation of secure artifact-centric implementations. It combines social and technical perspectives in developing secure systems. This work is the result of an academic and industrial collaboration, where SecBPMN2, a research prototype, has been integrated with SAP River, an industrial artifact-centric language. <s> BIB007
Next, we present a set of open challenges on modelling of business processes regarding security issues: • Implementation of web-based and collaborative versions of BPMN business modelling tools with security extensions. Currently, a considerable number of BPMN modelling tools and security extensions works on a desktop setup. An interesting capability should be the collaborative modelling. For example, BIB005 proposes a collaborative framework in which business and security analysts contribute to the security enrichment. The proposition of a collaborative BPMN tool can make viable the online collaboration, e.g., in a virtual meeting. • Standard BPMN security extension. Existing BPMN extensions BIB006 BIB002 BIB003 BIB004 address security concerns in BPMN diagrams. However, each initiative proposes its notation, which creates a barrier to their adoption as they make inviable the collaboration between security analysts from different companies using different modelling strategies. In addition, by analysing the initiatives described in this section, it is possible to observe that some of them propose graphical notations that model specific security requirements, e.g., non-repudiation BIB007 . Other initiatives introduced a small number of graphical elements, in which they can represent a significant number of security requirements. It is important to investigate a generic approach that can offer an attractive level of detail without compromising the notation overload. Despite the recent advances in the translation of security requirements, some research opportunities are still open: • Formalisation of translation rules. Works on the translation of security requirements into security mechanisms describe the translation rules in an informal way, e.g., BIB006 BIB007 . In some cases, the rules are not even clearly defined. Hence, the formal specification of these rules should allow their systematic use, facilitate the reuse, validation and analysis of conflicts. • Causal relationship. Runtime information can subside users in deciding on web service, business process or security requirements changes. Meanwhile, these changes should happen without completely stopping the whole system. A causal relationship between high-level requirements and their respective security mechanisms can guarantee that changes to the security requirements reflect directly on their runtime enforcements. • Intermediate platform-independent notation standardisation. As in the case of BPMN security requirements modelling, in which many possibilities can be chosen, there is not a standard manner to specify security requirements in a platform-independent context. The existence of a standard platform-independent notation can help not only the collaborative modelling between distinct BPMN security extensions but also can serve as a basis for the enforcement of security requirements for external tools. By observing the current state of the art in the enforcement of security requirements, some open challenges can be identified: • Support to enforcement of multiple security requirements. Existing works focus either on a set or a single security requirement (e.g., BIB001 BIB006 . However, complex systems may require a significant number of security enforcement resources, which are not provided by existing solutions. For example, BIB007 focuses on more than ten security requirements, but the enforcement is only to a particular environment, the SAP River. Hence, it is important to provide a holistic framework, which can both provide support to a considerable number of security requirements enforcements and can also be used in other environments. • Monitor security requirements. The monitoring of security requirements and service partners may generate valuable information to redesign business processes. Based on that, one interesting emerging trend is the development of accurate monitoring approaches, which can act in conjunction with orchestration engines. In this case, when a particular security requirement is violated, the execution environment can provide warning messages and possibly perform recommendations to the business expert. • Enforcement of security requirements in the cloud and containers. Considering the significant interest on cloud computing and containers by companies is viable to have versions of business process automation tools taking into consideration such environments. For example, BIB006 proposes an environment to automate security-aware business processes in the cloud. However, specific points must be addressed to accomplish this task. For example, to move the solution to the cloud can bring other security issues to the environment, which must be analysed by the business and security analysts. Another relevant point is the compatibility of current translation mechanisms with the security resources available in these environments.