Integrating model-based security risk management into eBusiness systems development - The CORAS approach

Security evaluation and security assurance are important aspects of trust in e-business. CORAS is a European project which is developing a tool-supported framework for precise, unambiguous, and efficient risk assessment of security critical systems. The framework is obtained through adapting, refining, extending, and combining methods for risk analysis of critical systems and semiformal modelling methods. In this paper we provide an overview of the CORAS framework for model-based risk assessment, emphasising the pursued integration of risk management and semiformal modelling throughout the evolution of an iterative system development process.ut of the process.