Eliciting Security Requirements for Business Processes of Legacy Systems

Nikolaos Argyropoulos (1) , Luis Márquez Alcañiz (2) , Haralambos Mouratidis (1) , Andrew Fish (1) , David G. Rosado (3) , Ignacio De Guzmán (3) , Eduardo Fernández-Medina (3)

1 University of Brighton
2 CNMC - National Authority for Markets and Competition [Madrid]
3 UCLM - Universidad de Castilla-La Mancha = University of Castilla-La Mancha

The modernisation of enterprise legacy systems, without compromises in their functionality, is a demanding and time consuming endeavour. To retain the underlying business behaviour during their modernisation, the MARBLETM framework has been developed for the extraction of business process models from their source code. Building on top of that work, in this paper we propose an integrated approach for transforming the extracted legacy process models into Secure Tropos goal models. Such models facilitate the elicitation of security requirements in a high level of abstraction, which are then incorporated back into the process models of the modernised systems as security features. Therefore high level models can be derived from legacy source code with minimal manual intervention, where security can be elaborated by nontechnical stakeholders in alignment with organisational objectives.

Mots clés: Legacy systems; Business process modelling; Goal-oriented security requirements; Secure Tropos; BPMN; MARBLE

Domaines: Informatique [cs]; Sciences de l'information et de la communication

Nikolaos Argyropoulos, Luis Márquez Alcañiz, Haralambos Mouratidis, Andrew Fish, David G. Rosado, et al.. Eliciting Security Requirements for Business Processes of Legacy Systems. 8th Practice of Enterprise Modelling (P0EM), Nov 2015, Valencia, Spain. pp.91-107, ⟨10.1007/978-3-319-25897-3_7⟩. ⟨hal-01442267⟩