# Sustainable Risk Identification Using Formal Ontologies +
## 3 Results
### Concepts and Relations (Meta Levels Definitions)  
Figure 1 shows the concepts and relations, representing the result of performing activity #1 of OnToRisk in the case study. Concepts (classes) appear as graph nodes and relations (object properties) appear as edges between nodes. The concepts are:  
1. Application, representing a software application by the enterprise;
2. Component, representing any software component;
3. Business Function, representing any function that relates to the enterprise's business operation;
4. Sensitive Information, representing any sensitive information item owned by the enterprise;
5. Vulnerability, representing any vulnerability of software components;
6. Risk, representing the enterprise's risk definitions;
7. Cybersecurity Risk, representing a specific subclass of risk definitions relating to cybersecurity issues;
8. Vulnerability-Induced Risk, representing any risk to the business emerging from the existence of a vulnerability. Being a risk definition relating to a cybersecurity issue, it is a specific subclass of Cybersecurity Risk. Figure 1: The vulnerability-induced risk case represented as a formal graph of meta-level concepts and relations. This graph is generated by applying the CoModIDE plugin for Protege [36] to the formal ontology. The graph shows: the classes as nodes; the object properties between classes (from domain to range) as solid, annotated arrows; and subtype (subclass) relations as dashed arrows. The hierarchical structure of the risk concepts (concepts #6, #7 and #8 above) reflects the hierarchical risk definition architecture which is practiced within the enterprise; with Risk being a layer-1 risk definition, Cybersecurity risk being a layer-2 risk definition, and Vulnerability-induced Risk being introduced as a layer-3 risk definition. This conforms with the prominent business risk typology used in the financial sector with which the enterprise is associated [4]. Figure 1 also shows the object properties--expressing relations between concepts--as graph edges in solid line between the class nodes. The object properties are:  
1. accessInfo--represents an ability of an application (Domain) to access a sensitive information item (Range);
2. supportsFunction--represents that an application (Domain) supports a business function (Range);
3. includesComponent--represents a software application composition, linking the application (Domain) with its components (Range);
4. foundIn--represents a vulnerability (Domain) found in a software component (Range);
5. susceptible2 Vulnerability--marks an application (Domain) as being susceptible to a vulnerability (Range) due to one of its software components. This object property is formally defined as a composite property using other object properties: \[\text{susceptible2 Vulnerability}\equiv\text{inverse(foundIn)}\circ\text{includesComponent}\] (1)
6. risksInfo--indicates that a vulnerability (Domain) may risk sensitive information (Range). This object property is formally defined as a composite property using other object properties: \[\text{risksInfo}\equiv\text{accessInfo}\circ\text{inverse(includesComponent)} \circ\text{foundIn}\] (2)
7. risksFunction--indicates that a vulnerability (Domain) may risk a business function (Range). This object property is formally defined as a composite property using other object properties: \[\text{risksFunction}\equiv\text{supportsFunction}\circ\text{inverse(includesComponent)} \circ\text{foundIn}\] (3)
8. risksVia--identifies the application (Range) through which a specific Vulnerability-Induced Risk (Domain) can be realised. This object property is formally defined as a composite property using other object properties: \[\text{risksVia}\equiv\text{inverse(accessInfo)}\circ\text{risksInfo}\!\mid\] (4) \[\text{inverse(supportsFunction)}\circ\text{risksFunction}\]  
Reflecting on the derived ontology, we note that it is realistic and practical to acquire relevant information, which can be used for instantiating a situation using the ontology meta-level definitions.