Vulnerability Effect Propagation in Service-Oriented Architectures

Abstract

Software vulnerabilities put automated business processes at risk. In service- oriented architectures (SOA), where business processes are implemented as potentially highly complex service compositions, the exploit of a software vulnerability can have far reaching effects on the confidentiality, integrity, and availability of business processes. In this paper, we report on our ongoing work which combines business process models with vulnerability information to automatically determine those effects. This determination is required in the identification phase in risk management.