## 6 Conclusions and Future Work  
Security of IS has become an important issue and requires attention at early phases of system development. Since security is not only limited to information, instead, the entire process of the manufacturing system should be guaranteed to be secure. BPMN provides a flexible mechanism that enables us to model security requirements along with business process models. While security threats are encountered at different levels such as processes, storage, and communication and at the physical level of an organization. Herein, we presented a threat-based security framework and its BPMN extension to model the security threat that helps in risk analysis and define security requirements of organizations. This would facilitate the uses of this representation and negotiate the security aspects of a business with different stakeholders of the system. The model is implemented when using a case study of an aircraft's manufacturing organization, which is going to adapt an ERP system to automate its organizational processes and is concerned about security. Our results show that the proposed threat profile covers a broad range of security requirements considering all assets rather than information only. A goal-based approach shows the abstract concepts and goals are subject to change whenever the environment of an organization changes. The threat-goal approach is useful to elicit security requirements in changing environments such as if the organization wants to evolve with the changing climate such as smart manufacturing or Industry 4.0 paradigms.  
In the future, we will further refine the approach to show the classification of threats on the basis of the architecture of the software model that covers different aspects of the organization. A detailed evaluation of the proposed model will be carried out by involving different industries and users of the system. Moreover, the model will be evaluated to find out if the security requirements are covered for manufacturing the system based on the layered architecture of ERP systems.  
S.Z. conceptualized and prepared the original draft. A.A. and S.A.K. supervised and reviewed the draft. All authors have read and agreed to the submitted version of the manuscript.  
This research received no funding.  
We thank [PERSON] for improving English Language and [PERSON] for comments that greatly improved the manuscript.  
The authors declare no conflict of interest.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Proposed Security Objects in** & **Visual Representation in BPMN 2.0.2** & **BPMN Extension Using RMIAS** \\
**Threat Base BPMN Extension** & **Visual Representation in BPMN 2.0.2** & **BPMN Extension Using RMIAS** \\ \hline Security goal & Not present & Present \\ \hline Attack & Not present & Not present \\ \hline Attacking agent & Not present & Not present \\ \hline Asset & Data object & Information only \\ \hline Asset state & Not present & Information state \\ \hline Security roles & Not present & Not present \\ \hline Access mechanism & Not Present & Not present \\ \hline \hline \end{tabular}
\end{table}
Table 7: Comparison of proposed BPMN security objects with BPMN 2.0.2 and Reference Model of Information Assurance (RMIAS) model.