SecBPMN 2.0Tutorial

OIS 2017

Marco Robol

marco.robol@unitn.it

1

STS-tool

� Install STS-tool http://www.sts-tool.eu/

� Install the SecBPMN2 plugin directly from the marketplace that comes within STS-tool

2

SecBPMN2 tool interface

3

AirportTutorial

4

Create a new STS Project1. Create a new “STS Project”2. Create a new “STS Diagram” (add at least one actor)3. Create a new “Business Process Diagram” linked to that actor. (differently

the tool does not allow to perform security analysis)4. To add diagrams use the button “Add New Collaboration Diagram”

5

1

2

3

4

List of processes

1. Flight plan transmission

2. Co-pilot Reads flight plan3. Passenger cabin prepared4. Take-off request5. Generic runway request6. Specific runway request

6

Process: Flight plan transmission

7

Process: Co-pilot reads flight plan

8

Process: Prepare passenger cabin

9

Process: Request take-off

10

Process: Generic runway request

11

Process: Specific runway request

12

Policies

�Let’s now define some SecBPMN2-Q policies.

�Create a new «Security Policy Diagram» for eachSecBPMN2-Q policy.

13

Policy: Non-Disclosure

14

Policy: Confidentiality

15

Policy: Integrity

16

Analysis

�Execute «Security Enforcement Analysis» to verify the compliance of the processes to the policies.

�The pattern/antipattern is checked toward each process.

17

Analysis results

�Which policies are verified?�Which ones are not?�What is missing in the process?�…Let’s add missed security annotations

18

Process: Flight plan transmission

19

To Do

1. Add the missing security annotations� See “Integrity”

2. Modify the process in order to be not compliant with the policy “non-disclosure”

20

To do

1. Create a pattern and an anti-pattern policy considering two tasks in a walk. Then create other two policies considering two tasks in a flow.� How are they matched toward elements in the process?

� Try the @ keyword

2. Create a pattern and an anti-pattern policy considering two tasks in a negative walk. Then create other two policies considering two tasksin a negative flow.� How are the negative walks and flows matched in the processes?

3. Define a pattern and an antipattern policy for a walk/flow of tasksacross a gateway (Filter runways and Book runway»)� Are they verified in the process?

21

To Do

4. Create a pattern and an antipattern policy considering the task «Filter runways» and the data objects «List of runways» and «Filtered list of runways»� How are they verified in the process?

5. Create a pattern and an antipattern policy considering two task in a walk, one referring to a task in the process associated to a «call activity».� Is the task in the linked process matched?

6. Add the availability requirement to the document “List of runways». Create a policy that verify that documents used by the task «Filter runways» are available.

22

23

Thank youmarco.robol@unitn.it