## 3 Proposed Methodology
### Threat-Based Security Requirements Framework and BPMN Extension
#### 3.1.4 Develop Secure Artifacts
Threats are classified in different types. Each type of a threat is assigned a graphical representation. Stencils for threat instances is created and security requirements are defined using text. The combination of a goal and a nature of threat determines the security requirements. The goal and threat impact are modeled using icons shown in Figure 7.  
4 Representation Rules in BPMN 2.0.2  
Representation rules of all these extended objects and attributes are mentioned in Table 3. The objects are represented using separate icons and data states are represented as markers on the right bottom corner of data objects. The access mechanism is represented using an icon at the pool, data object, and resource. Communication icons are positioned at the connecting objects. Figure 5: Different states of the document object using a BPMN extension. (**a**) create, (**b**) update, (**c**) delete, (**d**) approve, (**e**) transfer. Figure 6: Visual representation of different types of data objects in the BPMN extension. (**a**) critical, (**b**) important, (**c**) propriety, (**d**) regulatory, (**e**) sensitive, (**f**) form, (**g**) valuable. Figure 7: Visual representation of security goal and impact of threat on goal in the BPMN extension. (**a**) security goal symbol, (**b**) high threat of impact on goal, (**c**) low impact of threat on goal. Threats also have certain attributes, which need definition and mapping rules. The threat has attributes of name, impact, and agent, which causes that threat. The threat name and threat impact are represented as a marker while the threat agent is represented at the top of the threat icon. Agents of five different types are represented by icons and are shown in Figure 4.0 These icons are placed on the top right corner of the threat. Table 4 shows the mapping between the existing BPMN elements and threat profile objects. The goal can be used in connection with pool, activity, task, connecting objects, data objects, and resource and message flow and the goal cannot be applied to a data state. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Object Name** & **Attributes** & **Representation** \\ \hline Goals & Name & Marker \\ \hline \multirow{4}{*}{Threat} & Threat name & Marker \\ \cline{2-3}  & Threat & Marker \\ \cline{2-3}  & impact & Marker \\ \cline{2-3}  & Threat agent & Position \\ \hline \multirow{4}{*}{Data Object} & Regulatory & Icon \\ \cline{2-3}  & Important & Icon \\ \cline{2-3}  & Valuable & Icon \\ \cline{2-3}  & Sensitive & Icon \\ \cline{2-3}  & Critical & Icon \\ \cline{2-3}  & Proprietary & Icon \\ \cline{2-3}  & Form & Icon \\ \hline \multirow{4}{*}{Data State} & Create & Marker \\ \cline{2-3}  & Update & Marker \\ \cline{2-3}  & Delete & Marker \\ \cline{2-3}  & Approve & Marker \\ \cline{2-3}  & Transfer & Marker \\ \hline \multirow{4}{*}{Access Mechanism} & Open & Position \\ \cline{2-3}  & Password & Position \\ \cline{2-3}  & Biometric & Position \\ \hline \multirow{4}{*}{Communication} & Internet & Position \\ \cline{2-3}  & Intranet & Position \\ \cline{2-3}  & Specialized & Position \\ \cline{2-3}  & Internet & \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Attributes of extended security objects in BPMN. Figure 8: Visual representation of attacking agents and situations in the BPMN extension. (**a**) un-intentional external agent, (**b**) Intentional external agent, (**c**) System error, (**d**) Un-intentional internal agent, (**e**) Intentional internal agent. The access mechanism is applied to the pool, data object, and a resource. Communication is applied to only connecting objects. Access privileges are applied to the pool, activity, task, data object, data state, and a resource.