�ݺ�ߣ

An Open-Source Proactive Security
Infrastructure for Business Process
Management
Dr. Ángel Jesús Varela Vaca
María Teresa Gómez-López, David Jiménez Vargas, Rafael Martínez Gasca,
Antonio J. Suárez, Pedro J. Abad
IDEA Research Group,
ETS. Ingeniería Informática -
Department of Computer Languages and Systems
University of Seville

Outline
• Background
• Security Challenges
• Infrastructure / Case study
• Conclusions and future works

Background
3
Internet
BPMS
T1
T2
T3
...
...
Customers
Execute/ Enact
Data Bases
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
SMEs moving on Internet-driven market:
• Externalization and automation
• Mechanisms for data analysis

Background
4
Internet
BPMS
T1
T2
T3
...
...
Customers
Execute/ Enact
Data Bases
‘Malcious’ Customer
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
SECURITY
• Regulation & Law compliance
• Tech. lack of security awareness
• Small budgets

Security challenges
5
Internet
BPMS
T1
T2
T3
...
...
Customers
Execute/ Enact
Data Bases
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
Wolter et al. (2011) Menzel et al. (2012)
• Mechanisms to represent security requirements at process level
Leitner et al. (2015)
• Extension to represent security in processes aware systems

Security challenges
6
Internet
BPMS
T1
T2
T3
...
...
Customers
Execute/ Enact
Data Bases
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
Weske et al. (2007)
• Monitoring: state of the process and log data.
• Business Activity Monitoring: analyze logs trails to identify problems.
Gonzalez et al. (2011)
• Active monitoring: state process execution information at real-time
• Passive monitoring: upon request information

Research statements:
• How to monitor security requirements?
• How monitoring/analyze security requirements externally?
• How check compliance of security requirements externally?
• How to be security proactive?
Security challenges
7
Internet
BPMS
T1
T2
T3
...
...
Customers
Execute/ Enact
Data Bases
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...
T1
T2
T3
...
...

Infrastructure – Case Study
8
Network
Bonita BPM
(Apache + Tomcat)
T1
T2
T3
...
...
Events log
Customers
Execute/ Enact
API REST
Generate
1
2

9
Network
Bonita BPM
(Apache + Tomcat)
T1
T2
T3
...
...
Events log
Customers
Execute/ Enact
API REST
Generate
1
2

10
Network
Bonita BPM
(Apache + Tomcat)
T1
T2
T3
...
...
Events log
Customers
Execute/ Enact
API REST
Generate
1
2

11
Network
Bonita BPM
(Apache + Tomcat)
T1
T2
T3
...
...
Events log
Customers
Execute/ Enact
API REST
Generate
1
2
Groovy Connectors

12
Network
Bonita BPM
(Apache + Tomcat)
T1
T2
T3
...
...
Events log
Customers
Execute/ Enact
API REST
Generate
1
2

13
Network
Bonita BPM
(Apache + Tomcat)
T1
T2
T3
...
...
Events log
Customers
Execute/ Enact
API REST
Generate
1
2
Logs
Agent
Log Colector
OSSIM
(AlienVault)
Continuous
Monitoring
3

Logs
Agent
Log Colector
14
Network
Bonita BPM
(Apache + Tomcat)
T1
T2
T3
...
...
Events log
Customers
Execute/ Enact
API REST
Generate
1
2
OSSIM
(AlienVault)
Continuous
Monitoring
3

Infrastructure
15
Network
Bonita BPM
(Apache + Tomcat)
T1
T2
T3
...
...
Events log
Customers
Execute/ Enact
API REST
Generate
1
2
Logs
Agent
Log Colector
OSSIM
(AlienVault)
Continuous
Monitoring
3
DecoderMatching
Active
Response
A1 A2 A3
Rol1
if (T1.Rol = Rol1){
 Allow
} else {
 Deny
}
Log
Send Alert
Security Admin.
DecomposeAnalyseReact
123
Control
3.13.23.3

Infrastructure
16
Network
Bonita BPM
(Apache + Tomcat)
T1
T2
T3
...
...
Events log
Customers
Execute/ Enact
API REST
Generate
1
2
Logs
Agent
Log Colector
OSSIM
(AlienVault)
Continuous
Monitoring
3
DecoderMatching
Active
Response
A1 A2 A3
Rol1
if (T1.Rol = Rol1){
 Allow
} else {
 Deny
}
Log
Send Alert
Security Admin.
123
Control
3.13.23.3

Infrastructure
17
Network
Bonita BPM
(Apache + Tomcat)
T1
T2
T3
...
...
Events log
Customers
Execute/ Enact
API REST
Generate
1
2
Logs
Agent
Log Colector
OSSIM
(AlienVault)
Continuous
Monitoring
3
DecoderMatching
Active
Response
A1 A2 A3
Rol1
if (T1.Rol = Rol1){
 Allow
} else {
 Deny
}
Log
Send Alert
Security Admin.
123
Control
3.13.23.3

Infrastructure
18
Network
Bonita BPM
(Apache + Tomcat)
T1
T2
T3
...
...
Events log
Customers
Execute/ Enact
API REST
Generate
1
2
Logs
Agent
Log Colector
OSSIM
(AlienVault)
Continuous
Monitoring
3
DecoderMatching
Active
Response
A1 A2 A3
Rol1
if (T1.Rol = Rol1){
 Allow
} else {
 Deny
}
Log
Send Alert
Security Admin.
123
Control
3.13.23.3
Send
signals
Security
Alerts
(if any)
4
5

Conclusions
19
• How to monitor security requirements?
• Using connectors to log information and
agent to collect them.
• How monitoring/analyze security requirements
externally?
• AlientVault (SIEM) system.
• How check compliance of security requirements
externally?
• Engine based on rules and correlation rules.
• How to be security proactive?
• Creation of alarms and sending signals
through APIs to the process execution.

Thank for your attention, questions?
Dr. Ángel J. Varela Vaca
E-mail: ajvarela@us.es

�ݺ�ߣ

IBIMA 2015 Conference Preesntation

More Related Content

IBIMA 2015 Conference Preesntation

Editor's Notes