On the Issue of Information Security Risks Assessment of Business Processes

In this paper, the authors develop their earlier introduced approach of how to evaluate information security risks basing on business processes analysis, where business processes are represented in formal notations. We review known risks evaluating methods and reveal their drawbacks in the context of business processes analysis. We introduce a new risks evaluating technique which takes into account the significance of the business process, differentiation of the assets importance with regard to the business process, and impact of the moment, when potential threats are implemented, on the consequences for the business process and the related loss.