A comparison of security requirements engineering methods
Mal-activity diagrams for capturing attacks on business processes