The effective, efficient and continuous execution of business processes is crucial for meeting entrepreneurial goals. Business process modeling and simulation are used to enable desired business process optimizations. However, current approaches mainly focus on economic aspects while security aspects are dealt with in separate initiatives. This missing interconnection may lead to significant differences in improvement suggestions, such as the differing valuation of security investments (e.g., redundancy of systems). The major contribution of this paper is the introduction of a formal model that is capable of expressing the relations between threats, detection mechanisms, safeguards, recovery measures and their effects on business processes. This novel business process simulation capability paves the way for the evaluation of security investments at process design stage by allowing the consideration of stochastic influences of the occurrence of threats on process activities and resources in a unified way. A stylized business case outlines how our method can be applied to real world scenarios.

Effectively and efficiently performing business processes is a key success factor for achieving economic entrepreneurial goals. Amongst others, the argument of more stringent cost pressure lead companies to enforce outsourcing activities. Thus, the management of services - both, from the service requester and provider point of view - gained importance. However, considering only economic aspects is half the truth. One must not forget to simultaneously reflect risk aspects in an integrated way. Observing developments in the past years one can see that regulative bodies, the industry as well as the research community laid a special focus on the tighter integration of business process and risk management. In the course of this movement, we developed a conceptual method enabling risk-aware business process modeling and simulation. The major contribution of this paper is to introduce formal extensions of risk-aware business process management in order to support the related discipline of service management, especially risk-aware service analysis and planning.

The planning and effective usage of resources is a major challenge for organizations. More than ever through the global interconnections and the current economic situation the domain of resource allocation gains importance. Thus, within this paper we contribute to this research field by introducing a novel approach for dynamic activity and resource allocation using risk-aware business process simulations in order to facilitate and enhance planning and analysis activities. To clarify our work we show the application using a stylized business case.

In the ongoing arms race between spammers and the multi-million dollar anti-spam industry, the number of unsolicited e-mail messages (better known as "spam") and phishing has increased heavily in the last decade. In this paper, we show that our novel friend-in-the-middle attack on social networking sites (SNSs) can be used to harvest social data in an automated fashion. This social data can then be exploited for large-scale attacks such as context-aware spam and social-phishing. We prove the feasibility of our attack exemplarily on Facebook and identify possible consequences based on a mathematical model and simulations. Alarmingly, all major SNSs are vulnerable to our attack as they fail to secure the network layer appropriately.