Monitoring Security Compliance of Critical Processes
| Title | Monitoring Security Compliance of Critical Processes |
| Publication Type | Conference Paper |
| Year of Publication | 2014 |
| Authors | Rieke, R., Repp, J., Zhdanova, M., Eichler, J. |
| Conference Name | Parallel, Distributed and Network-Based Processing (PDP), 2014 22nd Euromicro International Conference on |
| Date Published | Feb |
| Keywords | Automata, Business, Computational modeling, critical infrastructures, critical processes, hydroelectric power plant, hydroelectric power stations, model-based support, Monitoring, operational formal models, power system security, Predictive models, predictive security analysis, process behavior analysis, process behavior model, process specifications, process-aware information systems, Runtime, security, security compliance, security information and event management, security modeling and simulation, security monitoring, security policies |
| Abstract | Enforcing security in process-aware information systems at runtime requires the monitoring of systems' operation using process information. Analysis of this information with respect to security and compliance aspects is growing in complexity with the increase in functionality, connectivity, and dynamics of process evolution. To tackle this complexity, the application of models is becoming standard practice. Considering today's frequent changes to processes, model-based support for security and compliance analysis is not only needed in pre-operational phases but also at runtime. This paper presents an approach to support evaluation of the security status of processes at runtime. The approach is based on operational formal models derived from process specifications and security policies comprising technical, organizational, regulatory and cross-layer aspects. A process behavior model is synchronized by events from the running process and utilizes prediction of expected close-future states to find possible security violations and allow early decisions on countermeasures. The applicability of the approach is exemplified by a misuse case scenario from a hydroelectric power plant. |
| URL | https://ieeexplore.ieee.org/document/6787328/ |
| DOI | 10.1109/PDP.2014.106 |
| Citation Key | 6787328 |
- predictive security analysis
- security policies
- security monitoring
- security modeling and simulation
- security information and event management
- security compliance
- security
- Runtime
- process-aware information systems
- process specifications
- process behavior model
- process behavior analysis
- automata
- Predictive models
- power system security
- operational formal models
- Monitoring
- model-based support
- hydroelectric power stations
- hydroelectric power plant
- critical processes
- critical infrastructures
- Computational modeling
- Business