Adding a Third Dimension to BPMN as a Means of Representing Cyber Security Requirements

Every so often a paper is published presenting a new extension for modelling cyber security requirements in Business Process Model and Notation (BPMN). The frequent production of new extensions by experts belies the need for a richer and more usable representation of security requirements in BPMN processes. In this paper, we present our work considering an analysis of existing extensions and identify the notational issues present within each of them. We discuss how there is as yet no single extension which represents a comprehensive range of cyber security concepts. Consequently there is no adequate solution for accurately specifying cyber security requirements within BPMN. In order to address this, we investigate a new approach to modelling security and propose a solution which aims to overcome current issues whilst still providing functionality to include all concepts potentially modellable in BPMN related to cyber security. We explain how our solution takes a novel approach to current challenges that is both effective and with adequate coverage of the cyber security domain.