An Ontology-Driven Approach for Process-Aware Risk Propagation

Risk Propagation (RP) is a central technique that allows the calculation of the cascading effect of risk within a system. At the current state, there is a lack of risk propagation solutions that can be used to assess the impact of risk at different levels of abstraction, accounting for actors, processes, physical-digital objects, and their relations. To fill this gap, in this paper, we propose a process-aware risk propagation approach that builds on two main components: i. an ontology, which supports functionalities typical of Semantic Web technologies (SWT), and ii. an ad hoc method to calculate the propagation of risk within the given system. We implemented our approach in a proof-of-concept tool, which was validated in the cybersecurity domain.