Enterprise Architecture-Based Risk and Security Modelling and Analysis

  • Henk JonkersEmail author
  • Dick A. C. Quartel
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 9987)


The growing complexity of organizations and the increasing number of sophisticated cyber attacks asks for a systematic and integral approach to Enterprise Risk and Security Management (ERSM). As enterprise architecture offers the necessary integral perspective, including the business and IT aspects as well as the business motivation, it seems natural to integrate risk and security aspects in the enterprise architecture. In this paper we show how the ArchiMate standard for enterprise architecture modelling can be used to support risk and security modelling and analysis throughout the ERSM cycle, covering both risk assessment and security deployment.


Enterprise architecture Archimate Risk and security modelling Risk analysis 



Part of the research leading to these results has received funding from the European Union Seventh Framework Programme (FP7/2007–2013) under grant agreement no. 318003 (TRESPASS). This publication reflects only the authors views and the Union is not liable for any use that may be made of the information contained herein.


  1. 1.
    Band, I., Engelsman, W., Feltus, C.S., González Paredes, S., Hietala, J., Jonkers, H., Massart, S.: Modeling enterprise risk management and security with the ArchiMate language. White Paper, The Open Group (2015)Google Scholar
  2. 2.
    Dubois, E., Heymans, P., Mayer, N., Matulevičius, R.: A systematic approach to define the domain of information system security risk management. In: Nurcan, S., et al. (eds.) Intentional Perspectives on Information Systems Engineering, pp. 289–306. Springer, Heidelberg (2010)CrossRefGoogle Scholar
  3. 3.
    ISO, Itc, UNIDO: ISO 31000 Risk Management: A Practical Guide for SMEs (2015)Google Scholar
  4. 4.
    Jonkers, H., Seghers, B.: Visualizing the business impact of technical cyber risks. In: The Open Group Summit Amsterdam, and as an Open Group Webinar (2014)Google Scholar
  5. 5.
    Sherwood, J., Clark, A., Lynas, D.: Enterprise security architecture. White Paper, SABSA Institute (2009)Google Scholar
  6. 6.
    The Open Group: TOGAF\(^{\textregistered }\) Version 9.1. Van Haren Publishing, Zaltbommel (2011)Google Scholar
  7. 7.
    The Open Group: Risk taxonomy (O-RT), version 2.0 (2013)Google Scholar
  8. 8.
    The Open Group: ArchiMate\(^{\textregistered }\) 3.0 Specification. Van Haren Publishing, Zaltbommel (2016)Google Scholar

Copyright information

© Springer International Publishing AG 2016

Authors and Affiliations

  1. 1.BiZZdesignEnschedeThe Netherlands

Personalised recommendations