Most established methods for IT security analysis relate to technical systems. With complex systems, however, this method is fraught with various risks. Often, a sophisticated consideration of the IT user as a potential security risk is lacking. The dynamics of security-critical IT systems often remain unclear. This book describes a method for IT security analysis based on business processes in order to eliminate such risks.