# Sustainable Risk Identification Using Formal Ontologies +
## 2 Materials and Methods  
OnToRisk uses formal ontology mechanisms for rigorous, information-based and definitions-based risks identification. The OnToRisk method includes the following activities:  
1. formally define concepts associated with a specific risk type, as well as their relations, by authoring an ontology;
2. formally define the risk type in the ontology, using the predefined concepts and relations. This definition of a risk type aims to promote the automatic identification of its instantiations;
3. capture the organisational situation by instantiating the existing ontology definitions. This is achieved by incorporating \"individual\" definitions into the ontology;
4. apply automated, ontology-based reasoners to the ontology to derive new, inferred insights about the situation.  
Activity #3 is meant to be automated as much as possible, e.g., by importing--while translating--existing organisational information from information systems into the formal ontology. Activity #4 is the activity in which new risk-related insights should emerge, automatically, based on the integration of explicit definitions and explicit situations. Ideally, these activities should be performed continuously, reflecting an up-to-date organisational security posture.  
We validate OnToRisk using a case study methodology. The selection in a single-case study approach is aligned with the rationale identified by [PERSON]; that the case study is a representative, typical case [32]. The OnToRisk method is applied in a case study of an enterprise seeking to identify risks emerging from the disclosure of a new vulnerability, which is found in a prevalent software component. The widely representative and applicable case study was inspired by real events, following the late 2021 disclosure of a vulnerability in Log4j[33; 34].  
Risk management is considered a business-related activity in an enterprise. Accordingly, the enterprise established and maintains a system of policies, as well as a hierarchical framework for communicating and assessing operational risks, with cybersecurity risks being included as part of the overall risk management organisational system. The risk-related concepts were identified based on careful reading of official documents and directives, analysis of some of the enterprise's information systems, and on conversations with domain experts. The latter included risk managers and an incident response leader.  
First, as the OnToRisk method outlines, relevant concepts and their relations were defined as a formal ontology. Protege was the tool used for authoring the ontology [35]. The ontology itself is in the standard Web Ontology Language (OWL) format. Relevant concepts are depicted in OWL using \"classes\"; and relations between concepts are formally expressed in OWL using \"object properties\". In defining object properties, the source node class is referred to as \"Domain,\" and the target node class is referred to as \"Range\".  
A relevant risk definition was then added to the ontology, using some of the predefined classes and object properties. Next, a situation was captured. The situation was designed using natural language, and then translated into the ontology, as an instantiation of the formalised classes and object properties. Finally, a reasoner (HermiT within Protege) is used to reason about the situation, i.e., process the explicit situation definitions and present inferred information based on these. The inference was verified to yield the results that are expected based on manual analysis of the situation.  
The work, including the ontology and the resulting insight with respect to the enterprise's operations and infrastructure, was presented to domain experts as well as high-level management for both obtaining feedback and promoting the organisational risk management practices.