Model based Security Risk Analysis for Web Applications: The CORAS approach

Security evaluation and security assurance are important aspects of trust in e-business. CORAS is a European project which is developing a tool-supported framework for precise, unambiguous, and efficient risk assessment of security critical systems. The framework is obtained through adapting, refining, extending, and combining methods for risk analysis of critical systems and semiformal modelling methods. In this paper we provide an overview of the CORAS framework for model-based risk assessment, emphasising its application on Webenabled B2C e-commerce services and the meta-data based deployment model underpinning the CORAS extensible platform for tool inclusion.