The effective, efficient and continuous execution of business processes is crucial for meeting entrepreneurial goals. Business process modeling and simulation are used to enable desired business process optimizations. However, current approaches mainly focus on economic aspects while security aspects are dealt with in separate initiatives. This missing interconnection may lead to significant differences in improvement suggestions, such as the differing valuation of security investments (e.g., redundancy of systems). The major contribution of this paper is the introduction of a formal model that is capable of expressing the relations between threats, detection mechanisms, safeguards, recovery measures and their effects on business processes. This novel business process simulation capability paves the way for the evaluation of security investments at process design stage by allowing the consideration of stochastic influences of the occurrence of threats on process activities and resources in a unified way. A stylized business case outlines how our method can be applied to real world scenarios.

Effectively and efficiently performing business processes is a key success factor for achieving economic entrepreneurial goals. Amongst others, the argument of more stringent cost pressure lead companies to enforce outsourcing activities. Thus, the management of services - both, from the service requester and provider point of view - gained importance. However, considering only economic aspects is half the truth. One must not forget to simultaneously reflect risk aspects in an integrated way. Observing developments in the past years one can see that regulative bodies, the industry as well as the research community laid a special focus on the tighter integration of business process and risk management. In the course of this movement, we developed a conceptual method enabling risk-aware business process modeling and simulation. The major contribution of this paper is to introduce formal extensions of risk-aware business process management in order to support the related discipline of service management, especially risk-aware service analysis and planning.

The planning and effective usage of resources is a major challenge for organizations. More than ever through the global interconnections and the current economic situation the domain of resource allocation gains importance. Thus, within this paper we contribute to this research field by introducing a novel approach for dynamic activity and resource allocation using risk-aware business process simulations in order to facilitate and enhance planning and analysis activities. To clarify our work we show the application using a stylized business case.

The continuous, effective and efficient performance of business processes is the central element for entrepreneurial success. In order to achieve the abovementioned goal various disciplines are involved: The improvement from an economical viewpoint is mainly performed by the domain of business process management, whereas the consideration of risks and continuous execution of business processes is considered separately by risk management and business continuity management. We observed that this separation often leads to inefficiencies as decisions can be contradictory and a consistent information basis is missing. Therefore, we introduce our vision of risk-aware business process management that is capable of providing information for economic as well as for security disciplines.

In an agile and dynamic market, companies face the challenge to continually adapt their business processes. Technologies such as RFID allow companies to automatically monitor their business processes. This paper introduces RFID based Business Process Analysis (RBPA). With the usage of RFID transponders and readers, different types of data about existing business processes is acquired and used as input for a detailed process analysis and simulation as well as for the automatic generation of process models. The approach supports process managers in executing detailed business process analysis with less effort and more adequate parameters compared to existing approaches.

The major contribution of this paper is the introduction of a reference model which is capable to consider information acquired within the business process management and risk management domain. The central objective of the reference model is to enable the modeling of risk aspects in such a way that it provides the foundation for risk-aware business process simulations. Within this paper, we firstly present an approach that combines essential activities of business process and risk management leading to risk aware business process management within an organization. Secondly, we illustrate our novel reference model which comprises extensions of existing modeling languages in order to meet our simulation-based risk-evaluation needs. We conclude this paper stating future research challenges.

Driven by the steadily growing number of natural disasters, the threat of terrorist and other criminal attacks as well as changed legislation and regulations, companies are increasingly forced to prepare against threats that endanger the survivability of crucial business activities. As a consequence, management has to pay more attention to business continuity issues including serious management commitment and more appropriate funding. Business impact analysis and risk assessment concepts enable adequate business continuity planning as they deliver essential information about the impact of resources' disruption on business. In this paper we present how these concepts can be enhanced through the application of the ROPE (Risk-Oriented Process Evaluation) methodology enabling risk-aware business process management and simulation. Moreover, we present essential extensions of the ROPE simulation capabilities leading to a more efficient and effective business continuity planning.

Increasingly, companies face the challenges to perform their business processes effectively as well as efficiently and to simultaneously assure the continuity of these processes. As the majority of companies rely on IT, it is essential to establish effective incident handling. In this paper, we introduce new extensions of the risk-aware business process management framework ROPE (risk-oriented process evaluation) in order to support the improvement of the management and execution of business processes. We further discuss the advantages of those extensions and how they can support the implementation of standards and best-practices such as the NIST SP800-61 (Computer Security Incident Handling Guide).

Information technologies and society are highly interwoven nowadays, but in both, the private and business sector, users are often not aware of security issues or lack proper security skills. The branch of information technology security is growing constantly but attacks against the vocational sector as well as the personal sector still cause great losses each day. Considering that the end-user is the weakest link of the security chain we aim to raise awareness, regarding IT security, and train and educate IT security skills by establishing a European-wide initiative and framework