Secure and Compliant Implementation of Business Process-driven Systems

By Achim D. Brucker and Isabelle Hang.

Today’s businesses are inherently process-driven. Consequently, the use of business-process driven systems, usually implemented on top of service-oriented or cloud-based infrastructures, is increasing. At the same time, the demand on the security, privacy, and compliance of such systems is increasing as well. As a result, the costs—with respect to computational effort at runtime as well as financial costs—for operating business-process driven systems increase steadily.

In this paper, we present a method for statically checking the security and conformance of the system implementation, e.g., on the source code level, to requirements specified on the business process level. As the compliance is statically guaranteed—already at design-time—this method reduces the number of run-time checks for ensuring the security and compliance and, thus, improves the runtime performances. Moreover, it reduces the costs of system audits, as there is no need for analyzing the generated log files for validating the compliance to the properties that are already statically guaranteed.

Further Reading:
This presentation is based on the following publication:
A. D. Brucker and I. Hang, “Secure and compliant implementation of business process-driven systems,” in Joint workshop on security in business processes (SBP), 2012, vol. 132, pp. 662–674. doi: 10.1007/978-3-642-36285-9_66. Author copy: https://logicalhacking.com/publications/brucker.ea-secure-2012/

Please cite this work as follows:
A. D. Brucker and I. Hang, “Secure and compliant implementation of business process-driven systems,” presented at the Joint workshop on security in business processe (SBP 2012), Tallinn, Estonia, Sep. 03, 2012. Author copy: https://logicalhacking.com/publications/talk-brucker.ea-secure-2012/

BibTeX
@Unpublished{ talk:brucker.ea:secure:2012,
  date       = {2012-09-03},
  title      = {Secure and Compliant Implementation of Business
                Process-driven Systems},
  author     = {Achim D. Brucker and Isabelle Hang},
  venue      = {Tallinn, Estonia},
  eventtitle = {Joint Workshop on Security in Business Processe ({SBP}
                2012)},
  areas      = {software, security},
  abstract   = {Today's businesses are inherently process-driven.
                Consequently, the use of business-process driven systems,
                usually implemented on top of \emph{service-oriented} or
                \emph{cloud-based} infrastructures, is increasing. At the same
                time, the demand on the security, privacy, and compliance of
                such systems is increasing as well. As a result, the
                costs---with respect to computational effort at runtime as
                well as financial costs---for operating business-process
                driven systems increase steadily.
                
                In this paper, we present a method for statically checking the
                security and conformance of the system implementation, e.g.,
                on the source code level, to requirements specified on the
                business process level. As the compliance is statically
                guaranteed---already at design-time---this method reduces the
                number of run-time checks for ensuring the security and
                compliance and, thus, improves the runtime performances.
                Moreover, it reduces the costs of system audits, as there is
                no need for analyzing the generated log files for validating
                the compliance to the properties that are already statically
                guaranteed.},
  note       = {Author copy: \url{https://logicalhacking.com/publications/talk-brucker.ea-secure-2012/}},
  pdf        = {https://logicalhacking.com/publications/talk-brucker.ea-secure-2012/talk-brucker.ea-secure-2012.pdf},
}