against attackers, creating barriers or lines of defense, through firewalls or encryption. However, losses result also from actions not executed properly (such as human errors) or from system errors among components. Losses could be prevented through preventive strategies and tactics. Security analysts could find possible attackers, highlighting their reasons, potential and purpose. Owning proper knowledge, security experts could assess their own system and identify the most suitable defense strategy. Tracing is one of the methods used by people in order to find any issue or deficiency in their system. Focusing first on strategy rather than tactics can be achieved by adopting a new system-theoretic causality model recently developed to provide a more powerful approach to engineering for safety. Causality models used in accidents are either traditional, caused by human errors, or more complex, caused by wrong interaction between components and systems errors. STAMP (System-Theoretic Accident Model and Processes) is a model of accident causality used in investigating potential accidents that can occur. In this case, issues are seen as results of inadequate control of the safety components used. Nowadays more powerful systems that analyse safety have been created. STPA (System-Theoretic Process Analysis) uses such techniques, being based on the STAMP model of causality. Once the cause is identified, STPA examines the system, creating a proper scenario that could solve the issue. Information systems Regarding technology, not only the safety and security of computers and isolated devices can be threatened, but also of entire complex information systems. As not all decisions made in an organisation are based on known rules, the analytical manager will examine in details the situation and anticipates potential issues that can occur. However. many decisions could have a great impact on some aspect of the organisation and cannot be easily reversed. Thus, modelling and simulating play the roles of preventive actions, being applied earlier for the design of the process, where real factual data is not available. It is an abstract representation, that includes all aspects of a process so its potential impact could be better analysed. Such a representation before implementing can be done through business process modeling (BPM). On one hand, there are indeed the deterministic systems that rely on the input data and are capable of predicting accurate output. On the other hand, there is the probabilistic system as well, which does not forecast with completely accuracy. However, both deterministic and probabilistic systems need