# Sustainable Risk Identification Using Formal Ontologies +
## 3 Results
### Ontology-Based Inference  
According to OnToRisk activity #4, we use the ontology-based reasoner to make inferences about the developing situation, and, ultimately, identify the emerging risks. The resulting inferred assertions that extend the explicitly declared assertions appear in Appendix B.  
The reasoner provides the following new inferences:  
1. The \"susceptible2 Vulnerability\" object property is attributed to App2, App3 and App4. This suggests that each of these applications is susceptible to the vulnerability.
2. The Log4 shell vulnerability is categorized--automatically--as a Vulnerability InducedRisk. This indicates that this specific vulnerability introduces new risk/s to the enterprise, as Figure 2 shows. This is the automatic identification of new risks.
3. The object property \"risksInfo ClientIDsList\" emerges with respect to the Log4 shell vulnerability (Figure 2). This suggests that ClientIDsList, which is one of the enterprise's sensitive information items, is at risk.
4. The object property \"risksFunction OpenAccount\" emerges with respect to the Log4 shell vulnerability (Figure 2). This suggests that OpenAccount--one of the enterprise's business functions--is at risk.
5. Two new risksVia object property assertions emerge, with respect to the Log4 shell vulnerability (Figure 2). Each of these suggests a possible attack surface through which the risk can realise. In the specific case, App3 is the attack surface for the risk on ClientIDsList and App4 is the attack surface for the risk on the OpenAccount. While this is not captured explicitly in the inferred assertions, the reasoner explanation mechanism provides this traceability, as Figure 3 shows.  
Figure 3: The reasoner explanation for asserting the risksVia properties. (**a**) for App3, as a result of the risksInfo with respect to ClientIDsList; (**b**) for App4, as a result of the risksFunction with respect to OpenAccount.  
Figure 2: The Log4 shell ontology-based assertions in Protege. Manually stated (explicit) assertions appear in bold font, while automatically inferred assertions appear in regular font.  
The automatically derived inferences are aligned with a manual analysis of the situation. While the manual analysis can be considered straightforward, performing such an analysis is time consuming, and this is exactly the effort that OnToRisk is designed to make redundant. The vulnerability in App2 does not present a new risk to the enterprise, from an operational perspective. Still, using the \"susceptible2 Vulnerability\" property which now characterises the application, the potential of App2 being affected by the vulnerability can be communicated with the App2 application owner. The application owner can then choose whether to further analyse the vulnerability impact on the application and/or solve any vulnerability-related issues in a future version. The vulnerabilities in App3 and in App4, however, should be of interest to the enterprise management, as they introduce business risks. Continuously applying the reasoner to the enterprise situation allows pertinent managers to be notified immediately of such risks as they emerge; and the enterprise management can then promptly act to solve them, by identifying and empowering the appropriate personnel--such as application owners, risk managers, security officers and information officers--to do so.