{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2022,11,11]],"date-time":"2022-11-11T17:49:42Z","timestamp":1668188982209},"reference-count":49,"publisher":"Oxford University Press (OUP)","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["J Cyber Secur"],"DOI":"10.1093\/cybsec\/tyw010","type":"journal-article","created":{"date-parts":[[2016,10,6]],"date-time":"2016-10-06T02:09:57Z","timestamp":1475719797000},"page":"tyw010","source":"Crossref","is-referenced-by-count":4,"title":["A grounded analysis of experts\u2019 decision-making during security assessments"],"prefix":"10.1093","author":[{"given":"Hanan","family":"Hibshi","sequence":"first","affiliation":[]},{"given":"Travis D.","family":"Breaux","sequence":"additional","affiliation":[]},{"given":"Maria","family":"Riaz","sequence":"additional","affiliation":[]},{"given":"Laurie","family":"Williams","sequence":"additional","affiliation":[]}],"member":"286","published-online":{"date-parts":[[2016,10,5]]},"reference":[{"key":"2016100519085894000_tyw010v1.1","unstructured":"HP. HP Top Cyber Security Risks Report. Hewlett-Packard Development Company, L.P., 2011."},{"key":"2016100519085894000_tyw010v1.2","unstructured":"OWASP. OWASP Top Ten Project - OWASP, 2014."},{"key":"2016100519085894000_tyw010v1.3","unstructured":"SANS. SANS 20 Critical Security Controls Solutions Directory, 2014."},{"key":"2016100519085894000_tyw010v1.4","unstructured":"NIST\/ITL Special Publication (800), 2015."},{"key":"2016100519085894000_tyw010v1.5","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2010.11.003"},{"key":"2016100519085894000_tyw010v1.6","first-page":"21.","article-title":"Validating security requirements using structured toulmin-style argumentation","volume":"4","author":"Haley","year":"2005","journal-title":"Dep Comput Open Univ Milton Keynes UK Tech Rep"},{"key":"2016100519085894000_tyw010v1.7","first-page":"272","article-title":"Wicked problems","volume":"26","author":"Rittel","year":"1974","journal-title":"Man-Made Futur"},{"key":"2016100519085894000_tyw010v1.8","unstructured":"Dutoit AH McCall R Mistr\u00edk I , . (eds), Rationale management in software engineering: Concepts and techniques. Rationale Management in Software Engineering. Berlin, Heidelberg: Springer, 2006, 1\u201348."},{"key":"2016100519085894000_tyw010v1.9","doi-asserted-by":"crossref","unstructured":"Chung L. Dealing with security requirements during the development of information systems. In: Rolland C Bodart F Cauvet C (eds), Advanced Information Systems Engineering. Berlin, Heidelberg: Springer, 1993, 234\u201351.","DOI":"10.1007\/3-540-56777-1_13"},{"key":"2016100519085894000_tyw010v1.10","doi-asserted-by":"crossref","unstructured":"McDermott J Fox C. Using abuse case models for security requirements analysis. In: Computer Security Applications Conference, 1999. (ACSAC \u201999) 15th Annual Proceedings. Phoenix, AZ: IEEE, 1999, pp. 55\u201364.","DOI":"10.1109\/CSAC.1999.816013"},{"key":"2016100519085894000_tyw010v1.11","unstructured":"Sindre G Opdahl AL. Capturing security requirements through misuse cases. In: Norsk Informatikkonferanse, NIK 2011, Stavanger."},{"key":"2016100519085894000_tyw010v1.12","first-page":"49","article-title":"From system goals to intruder anti-goals: attack generation and resolution for security requirements engineering","volume":"3","author":"Van Lamsweerde","year":"2003","journal-title":"Proc RHAS"},{"key":"2016100519085894000_tyw010v1.13","doi-asserted-by":"crossref","unstructured":"Haley CB Laney RC Moffett JD , . The effect of trust assumptions on the elaboration of security requirements. In: Proceedings of 12th IEEE International Requirements Engineering Conference. IEEE, 2004, pp. 102\u201311.","DOI":"10.1109\/ICRE.2004.1335668"},{"key":"2016100519085894000_tyw010v1.14","doi-asserted-by":"publisher","DOI":"10.1007\/s00766-005-0023-4"},{"key":"2016100519085894000_tyw010v1.15","doi-asserted-by":"publisher","DOI":"10.1016\/j.csi.2006.04.002"},{"key":"2016100519085894000_tyw010v1.16","doi-asserted-by":"publisher","DOI":"10.1177\/154193128803200221"},{"key":"2016100519085894000_tyw010v1.17","doi-asserted-by":"crossref","unstructured":"Endsley MR Jones DG. Designing for Situation Awareness: An Approach to User-Centered Design. Boca Raton, FL: Taylor & Francis, 2003.","DOI":"10.1201\/9780203485088"},{"key":"2016100519085894000_tyw010v1.18","doi-asserted-by":"publisher","DOI":"10.1518\/001872095779049543"},{"key":"2016100519085894000_tyw010v1.19","unstructured":"Anderson JR. Learning and Memory. New York: John Wiley, 2000."},{"key":"2016100519085894000_tyw010v1.20","doi-asserted-by":"crossref","first-page":"2","DOI":"10.1177\/002248718803900102","article-title":"Cognitive styles and multicultural populations","volume":"39","author":"Anderson","year":"1988","journal-title":"J Teach Educ"},{"key":"2016100519085894000_tyw010v1.21","doi-asserted-by":"publisher","DOI":"10.1111\/j.2044-8279.1933.tb02913.x"},{"key":"2016100519085894000_tyw010v1.22","doi-asserted-by":"publisher","DOI":"10.1037\/\/0033-295X.93.4.411"},{"key":"2016100519085894000_tyw010v1.23","unstructured":"Rao A Hibshi H Breaux TD , . Less is more?: Investigating the role of examples in security studies using analogical transfer. In: Proceedings of the 2014 Symposium and Bootcamp on the Science of Security. Raleigh, NC: ACM, 2014, pp.1\u20137."},{"key":"2016100519085894000_tyw010v1.24","doi-asserted-by":"crossref","unstructured":"Digioia G Panzieri S. INFUSION: A system for situation and threat assessment in current and foreseen scenarios. In: 2012 IEEE International Multi-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support (CogSIMA). IEEE, 2012, pp. 316\u201323.","DOI":"10.1109\/CogSIMA.2012.6188403"},{"key":"2016100519085894000_tyw010v1.25","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2007.09.061"},{"key":"2016100519085894000_tyw010v1.26","doi-asserted-by":"crossref","unstructured":"Chen P-C Liu P Yen J , . Experience-based cyber situation recognition using relaxable logic patterns. In: 2012 IEEE International Multi-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support (CogSIMA). IEEE, 2012, pp. 243\u201350.","DOI":"10.1109\/CogSIMA.2012.6188392"},{"key":"2016100519085894000_tyw010v1.27","doi-asserted-by":"crossref","unstructured":"Schaefer KE Billings DR Hancock PA. Robots vs. machines: Identifying user perceptions and classifications. In: 2012 IEEE International Multi-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support (CogSIMA) 2012, pp.138\u201341.","DOI":"10.1109\/CogSIMA.2012.6188366"},{"key":"2016100519085894000_tyw010v1.28","doi-asserted-by":"crossref","unstructured":"Jakobson G. Using federated adaptable multi-agent systems in achieving cyber attack tolerant missions. In: 2012 IEEE International Multi-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support (CogSIMA) 2012, pp. 96\u2013102.","DOI":"10.1109\/CogSIMA.2012.6188415"},{"key":"2016100519085894000_tyw010v1.29","unstructured":"Corbin J Strauss A. Basics of Qualitative Research: Techniques and Procedures for Developing Grounded Theory. Thousand Oaks, CA: Sage, 2007."},{"key":"2016100519085894000_tyw010v1.30","unstructured":"Salda\u00f1a J. The Coding Manual for Qualitative Researchers. Thousand Oaks, CA: Sage, 2012."},{"key":"2016100519085894000_tyw010v1.31","unstructured":"May C. Applied Information Assurance, Information Networking Institute, [website], 2008, https:\/\/www.andrew.cmu.edu\/course\/14-761\/(24 June 2016, date last accessed)."},{"key":"2016100519085894000_tyw010v1.32","doi-asserted-by":"crossref","unstructured":"Arasu A Chaudhuri S Ganjam K , . Incorporating String Transformations in Record Matching. In: Proceedings of the 2008 ACM SIGMOD International Conference on Management of Data. New York, NY, USA: ACM, 2008, pp.1231\u201334.","DOI":"10.1145\/1376616.1376742"},{"key":"2016100519085894000_tyw010v1.33","unstructured":"Glesne C Peshkin A. Becoming Qualitative Researchers: An Introduction. New York, NY: Longman White Plains, 1992."},{"key":"2016100519085894000_tyw010v1.34","first-page":"597","article-title":"Understanding reliability and validity in qualitative research","volume":"8","author":"Golafshani","year":"2003","journal-title":"The Qualitative Report"},{"key":"2016100519085894000_tyw010v1.35","unstructured":"Crocker L Algina J. Introduction to Classical and Modern Test Theory. Orlando, FL: ERIC, 1986."},{"key":"2016100519085894000_tyw010v1.36","unstructured":"Patton MQ. Qualitative Evaluation and Research Methods. Thousand Oaks, CA: SAGE Publications, Inc, 1990."},{"key":"2016100519085894000_tyw010v1.37","unstructured":"Creswell JW. Qualitative Inquiry and Research Design: Choosing among Five Approaches. Thousand Oaks, CA: Sage, 2013."},{"key":"2016100519085894000_tyw010v1.38","unstructured":"Glaser BG Strauss AL. The Discovery of Grounded Theory: Strategies for Qualitative Research. Piscataway, NJ: Transaction Publishers, 2009."},{"key":"2016100519085894000_tyw010v1.39","doi-asserted-by":"publisher","DOI":"10.1037\/0033-295X.112.4.744"},{"key":"2016100519085894000_tyw010v1.40","doi-asserted-by":"publisher","DOI":"10.1037\/h0026256"},{"key":"2016100519085894000_tyw010v1.41","doi-asserted-by":"crossref","first-page":"81","DOI":"10.1109\/MSP.2004.84","article-title":"Software security testing","volume":"2","author":"Potter","year":"2004","journal-title":"Secur Priv IEEE"},{"key":"2016100519085894000_tyw010v1.42","unstructured":"Yin RK. Case Study Research: Design and Methods. Sage, 2009."},{"key":"2016100519085894000_tyw010v1.43","doi-asserted-by":"publisher","DOI":"10.1037\/0033-2909.125.1.47"},{"key":"2016100519085894000_tyw010v1.44","doi-asserted-by":"publisher","DOI":"10.1037\/0003-066X.54.9.741"},{"key":"2016100519085894000_tyw010v1.45","unstructured":"Fletovich PJ Prietula MJ Ericsson KA. Studies of expertise from pscyhological perspectives. In: Ericsson KA Charness N Feltovich PJ . (eds), The Cambridge Handbook of Expertise and Expert Performance. Cambridge: IEEE, 2006."},{"key":"2016100519085894000_tyw010v1.46","doi-asserted-by":"crossref","unstructured":"Hibshi H Breaux TD Broomell SB. Assessment of risk perception in security requirements composition. In: 2015 IEEE 23rd International Requirements Engineering Conference (RE). New York, NY: ACM, 2015, pp.146\u201355.","DOI":"10.1109\/RE.2015.7320417"},{"key":"2016100519085894000_tyw010v1.47","doi-asserted-by":"crossref","first-page":"31","DOI":"10.1145\/359205.359223","article-title":"Trust (and Mistrust) in secure applications","volume":"44","author":"Viega","year":"2001","journal-title":"Commun ACM"},{"key":"2016100519085894000_tyw010v1.48","doi-asserted-by":"crossref","unstructured":"Van Lamsweerde A Letier E. From object orientation to goal orientation: A paradigm shift for requirements engineering. In: Wirsing M Knapp A Balsamo S (eds), Radical Innovations of Software and Systems Engineering in the Future. Berlin, Heidelberg: Springer, 2004, 325\u201340.","DOI":"10.1007\/978-3-540-24626-8_23"},{"key":"2016100519085894000_tyw010v1.49","doi-asserted-by":"crossref","unstructured":"Beresnevichiene Y Pym D Shiu S. Decision support for systems security investment. In: Network Operations and Management Symposium Workshops (NOMS Wksps), 2010 IEEE\/IFIP. IEEE, 2010, pp. 118\u201325.","DOI":"10.1109\/NOMSW.2010.5486590"}],"container-title":["Journal of Cybersecurity"],"original-title":[],"language":"en","deposited":{"date-parts":[[2017,6,25]],"date-time":"2017-06-25T00:27:29Z","timestamp":1498350449000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/cybersecurity\/article-lookup\/doi\/10.1093\/cybsec\/tyw010"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016,10,5]]},"references-count":49,"alternative-id":["10.1093\/cybsec\/tyw010"],"URL":"https:\/\/doi.org\/10.1093\/cybsec\/tyw010","relation":{},"ISSN":["2057-2085","2057-2093"],"issn-type":[{"value":"2057-2085","type":"print"},{"value":"2057-2093","type":"electronic"}],"subject":[],"published":{"date-parts":[[2016,10,5]]}}}