  Threat modeling has been successfully applied to model technical threats
within information systems. However, a lack of methods focusing on
non-technical assets and their representation can be observed in theory and
practice. Following the voices of industry practitioners, this paper explored
how to model insider threats based on business process models. Hence, this
study developed a novel insider threat knowledge base and a threat modeling
application that leverages Business Process Modeling and Notation (BPMN).
Finally, to understand how well the theoretic knowledge and its prototype
translate into practice, the study conducted a real-world case study of an IT
provider's business process and an experimental deployment for a real voting
process. The results indicate that even without annotation, BPMN diagrams can
be leveraged to automatically identify insider threats in an organization.
