Specifying Legal Risk Scenarios Using the CORAS Threat Modelling Language

The paper makes two main contributions: (1) It presents experiences from using the CORAS language for security threat modelling to specify legal risk scenarios. These experiences are summarised in the form of requirements to a more expressive language providing specific support for the legal domain. (2) Its second main contribution is to present ideas towards the fulfilment of these requirements. More specifically, it extends the CORAS conceptual model for security risk analysis with legal concepts and associations. Moreover, based on this extended conceptual model, it introduces a number of promising language constructs addressing some of the identified deficiencies.

• Type: Conference
• Year: 2005
• Where: ITRUST
• Authors: Fredrik Vraalsen, Mass Soldal Lund, Tobias Mahler, Xavier Parent, Ketil Stølen
• Keywords: Conceptual Model, Information Management, ITRUST 2005, Legal Risk Scenarios, Main Contribution