Abstract:Enterprise Risk Management involves the process of identification, evaluation, treatment, and communication regarding risks throughout the enterprise. To support the tasks associated with this process, several frameworks and modeling languages have been proposed, such as the Risk and Security Overlay (RSO) of ArchiMate. An ontological investigation of this artifact would reveal its adequacy, capabilities, and limitations w.r.t. the domain of risk and security. Based on that, a language redesign can be proposed as a refinement. Such analysis and redesign have been executed for the risk elements of the RSO grounded in the Common Ontology of Value and Risk . The next step along this line of research is to address the following research problems: What would be the outcome of an ontological analysis of security-related elements of the RSO? That is, can we identify other semantic deficiencies in the RSO through an ontological analysis? Once such an analysis is provided, can we redesign the security elements of the RSO accordingly, in order to produce an improved artifact? Here, with the aid of the Reference Ontology for Security Engineering (ROSE) and the ontological theory of prevention behind it, we address the remaining gap by proceeding with an ontological analysis of the security-related constructs of the RSO. The outcome of this assessment is an ontology-based redesign of the ArchiMate language regarding security modeling. In a nutshell, we report the following contributions: (1) an ontological analysis of the RSO that identifies six limitations concerning security modeling; (2) because of the key role of the notion of prevention in security modeling, the introduction of the ontological theory of prevention in ArchiMate; (3) a well-founded redesign of security elements of ArchiMate; and (4) ontology-based security modeling patterns that are logical consequences of our proposal of redesign due to its underlying ontology of security. As a form of evaluation, we show that our proposal can describe risk treatment options, according to ISO 31000. Finally, besides presenting multiple examples, we proceed with a real-world illustrative application taken from the cybersecurity domain.

Towards Ontological Approach to Eliciting Risk-Based Security Requirements

Towards an Ontological Approach to Information System Security and Safety Requirement Modeling and Reuse

Performance requirement elicitation for financial information system based on ontology

Towards Ontological Approach to Security Risk Analysis of Information System: Model and Architecture

A Kind of Safety Requirements Description Method of the Embedded Software Based on Ontology

A Unified Use-Misuse Case Model for Capturing and Analysing Safety and Security Requirements

Towards a Semantic Web-enabled Knowledge Base to Elicit Security Requirements for Misuse Cases.

Ontology for Safety Risk Identification in Metro Construction.

Ontology-Based Requirements Generation for Credibility Validation of Safety-Critical System.

Ontology-Based Requirements Elicitation

Researches On The Multi-Ontology Based Safety Requirements Elicitation Method Of Military Aircraft Systems Software

Aligning social concerns with information system security: A fundamental ontology for social engineering

Eliciting security requirements and tracing them to design: an integration of Common Criteria, heuristics, and UMLsec

Ontology-based security modeling in ArchiMate

An Ontology-Based Approach for Domain Requirements Elicitation and Analysis

Security Requirements Engineering in the Wild: A Survey of Common Practices

TOWARDS AN ONTOLOGY MAPPING APPROACH FOR SECURITY MANAGEMENT

Capturing Requirements from Expected Interactions Between Software and Its Interactive Environment: an Ontology Based Approach.

Security Ontology in a Virtual University

An Engineerable Ontology Based Approach for Requirements Elicitation in Process Centered Problem Domain

Research on Ontological Information Modeling for the Integration of Cyber and Physical Security in Power Systems