Enhancement of IT risk assessments by UML
Ralf Mock, Benjamin Truninger, Patrick Brunner, Tomáš Hrúz · Zürcher Hochschule für Angewandte Wissenschaften digital collection (Zurich University of Applied Sciences) · 2015
Unified Modeling Language diagrams (UML) are considered as an underestimated knowledge source for risk assessment (RA) approaches. For this, a combination of Class and Sequence Diagrams is used to get relevant information for further risk analysis. In an IT enterprise, existing business processes source code can be used to automatically generate a full process Class Diagram. The paper suggests a way to significantly reduce the size of the Class Diagram. To do this, the most relevant business case of the audited enterprise is selected and used to generate a Sequence Diagram. Tools simplify this approach. The resulting Sequence Diagram only consists of classes and operations relevant to the chosen business case. They can then be matched to the initial full system Class Diagram. Elements in the Class Diagram that do not have a match in the Sequence Diagram can be removed, resulting in a reduced Class Diagram. The reduced Class Diagram is the base for RA heuristics, e.g., many incoming associations of a class suggest that other classes often depend on this class. Therefore, a failure of this class ponts to an increased impact value.