A comparison of security requirements engineering methods
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Over the last several years the MEM was actively used as a framework for the comparative evaluation of security and risk identification and analysis methods.
“Over the last several years the MEM was actively used as a framework for the comparative evalu-ation of security and risk identification and analysis methods (Espaná et al., 2010; Fabian et al., 2010; Labunets et al., 2013, 2014).”
From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as Fabian et al., 2010
Cites
Abiteboul, S., Hull, R. B., & Vianu, V. (1994) · Cited by 3,397 · see citing works
The Unified Software Development Process
Jacobson, I., Booch, G., & Rumbaugh, J. E. (1999) · CERN Document Server (European Organization for Nuclear Research) · Cited by 3,389 · see citing works
Hauser, J. R. (1988) · Harvard business review · Cited by 2,271 · see citing works
Goal-directed requirements acquisition
Dardenne, A., van Lamsweerde, A., & Fickas, S. F. (1993) · Science of Computer Programming · doi:10.1016/0167-6423(93)90021-g · Cited by 1,979 · see citing works
(1995) · Choice Reviews Online · doi:10.5860/choice.33-0359 · Cited by 1,767 · see citing works
Tropos: An Agent-Oriented Software Development Methodology
Bresciani, P., Perini, A., Giorgini, P., et al. (2004) · Autonomous Agents and Multi-Agent Systems · doi:10.1023/b:agnt.0000018806.20944.ef · Cited by 1,752 · see citing works
Towards modelling and reasoning support for early-phase requirements engineering
Yu, E. S. K. (2002) · doi:10.1109/isre.1997.566873 · Cited by 1,581 · see citing works
Modelling strategic relationships for process reengineering
Mylopoulos, J., & Yu, E. S. K. (1995) · Cited by 1,402 · see citing works
The DLV system for knowledge representation and reasoning
Leone, N., Pfeifer, G., Faber, W., Eiter, T., Gottlob, G., Perri, S., & Scarcello, F. (2006) · ACM Transactions on Computational Logic · doi:10.1145/1149114.1149117 · Cited by 1,152 · see citing works
Representing and using nonfunctional requirements: a process-oriented approach
Mylopoulos, J., Chung, L., & Nixon, B. A. (1992) · IEEE Transactions on Software Engineering · doi:10.1109/32.142871 · Cited by 1,019 · see citing works
Problem Frames: Analyzing and Structuring Software Development Problems
Jackson, M. (2000) · Medical Entomology and Zoology · Cited by 916 · see citing works
Gollmann, D. (1999) · Cited by 883 · see citing works
SecureUML: A UML-Based Modeling Language for Model-Driven Security
Lodderstedt, T., Basin, D., & Doser, J. (2002) · Lecture notes in computer science · doi:10.1007/3-540-45800-x_33 · Cited by 763 · see citing works
Four dark corners of requirements engineering
Zave, P., & Jackson, M. (1997) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/237432.237434 · Cited by 737 · see citing works
On Non-Functional Requirements
Glinz, M. (2007) · IEEE International Requirements Engineering Conference (RE) · doi:10.1109/re.2007.45 · Cited by 698 · see citing works
Secure systems development with UML
Jürjens, J. (2004) · Medical Entomology and Zoology · Cited by 616 · see citing works
Managing conflicts in goal-driven requirements engineering
van Lamsweerde, A., Darimont, R., & Letier, E. (1998) · IEEE Transactions on Software Engineering · doi:10.1109/32.730542 · Cited by 600 · see citing works
Inconsistency handling in multiperspective specifications
Finkelstein, A., Gabbay, M., Hunter, A., et al. (1994) · IEEE Transactions on Software Engineering · doi:10.1109/32.310667 · Cited by 538 · see citing works
Agent UML: A Formalism for Specifying Multiagent Software Systems
Bauer, B., Müller, J., & Odell, J. (2001) · International journal of software engineering and knowledge engineering · doi:10.1142/s0218194001000517 · Cited by 504 · see citing works
Security Requirements Engineering: A Framework for Representation and Analysis
Haley, C. B., Laney, R., Moffett, J., & Nuseibeh, B. (2008) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2007.70754 · Cited by 464 · see citing works
Building Secure Software: How to Avoid Security Problems the Right Way
Viega, J., & McGraw, G. E. (2001) · Cited by 440 · see citing works
Security and privacy requirements analysis within a social setting
Liu, L., Yu, E. S. K., & Mylopoulos, J. (2004) · Journal of Lightwave Technology · doi:10.1109/icre.2003.1232746 · Cited by 393 · see citing works
SECURE TROPOS: A SECURITY-ORIENTED EXTENSION OF THE TROPOS METHODOLOGY
Mouratidis, H., & Giorgini, P. (2007) · International Journal of Software Engineering and Knowledge Engineering · doi:10.1142/s0218194007003240 · Cited by 380 · see citing works
Elaborating Security Requirements by Construction of Intentional Anti-Models
van Lamsweerde, A., & Engineering, P. 2. I. C. O. S. (2004) · Cited by 351 · see citing works
Security quality requirements engineering (SQUARE) methodology
Mead, N. R., & Stehney, T. (2005) · ACM SIGSOFT Software Engineering Notes · doi:10.1145/1082983.1083214 · Cited by 318 · see citing works
Requirements engineering with viewpoints
Kotonya, G., & Sommerville, I. (1996) · Software Engineering Journal · doi:10.1049/sej.1996.0002 · Cited by 299 · see citing works
日本規格協会 (2000) · 日本規格協会 eBooks · Cited by 275 · see citing works
Specifying and analyzing early requirements in Tropos
Fuxman, A., Liu, L., Mylopoulos, J., et al. (2004) · Requirements Engineering · doi:10.1007/s00766-004-0191-7 · Cited by 243 · see citing works
Elaborating security requirements by construction of intentional anti-models
van Lamsweerde, A. (2004) · Proceedings/Proceedings - International Conference on Software Engineering · doi:10.1109/icse.2004.1317437 · Cited by 234 · see citing works
Requirements interaction management
Robinson, W. N., Pawlowski, S. D., & Volkov, V. Y. (2003) · ACM Computing Surveys · doi:10.1145/857076.857079 · Cited by 207 · see citing works
Using ViewPoints for inconsistency management
Easterbrook, S., & Nuseibeh, B. (1996) · Software Engineering Journal · doi:10.1049/sej.1996.0004 · Cited by 206 · see citing works
Model-based security analysis in seven steps — a guided tour to the CORAS method
den Braber, F., Hogganvik, I., Lund, M. S., et al. (2007) · BT Technology Journal · doi:10.1007/s10550-007-0013-9 · Cited by 199 · see citing works
Darimont, R., Delor, E., Massonet, P., et al. (1997) · Proceedings/Proceedings - International Conference on Software Engineering · doi:10.1145/253228.253499 · Cited by 173 · see citing works
A framework for security requirements engineering
Haley, C. B., Moffett, J., Laney, R., et al. (2006) · doi:10.1145/1137627.1137634 · Cited by 162 · see citing works
Deriving Specifications from Requirements: an Example
Jackson, & Zave (1995) · Cited by 159 · see citing works
Revisiting the Core Ontology and Problem in Requirements Engineering
Jureta, I., Mylopoulos, J., & Faulkner, S. (2008) · IEEE International Requirements Engineering Conference (RE) · doi:10.1109/re.2008.13 · Cited by 152 · see citing works
Requirements Engineering und Management
Rupp, C., Simon, M., & Hocker, F. (2009) · HMD Praxis der Wirtschaftsinformatik · doi:10.1007/bf03340367 · Cited by 151 · see citing works
Deriving specifications from requirements
Jackson, M., & Zave, P. (1995) · Proceedings/Proceedings - International Conference on Software Engineering · doi:10.1145/225014.225016 · Cited by 134 · see citing works
Common Concepts Underlying Safety, Security, and Survivability Engineering
Firesmith, D. G. (2003) · KiltHub Repository · doi:10.1184/r1/6572621.v1 · Cited by 131 · see citing works
Security Requirements for the Rest of Us: A Survey
Tøndel, I. A., Jaatun, M. G., & Meland, P. H. (2008) · IEEE Software · doi:10.1109/ms.2008.19 · Cited by 129 · see citing works
Common Concepts Underlying Safety Security and Survivability Engineering
Firesmith, D. G. (2003) · doi:10.21236/ada421683 · Cited by 125 · see citing works
Viega, J., & McGraw, G. E. (2001) · Cited by 122 · see citing works
From Requirements to Architectural Design -Using Goals and Scenarios
Liu, L., & Yu, E. S. K. (2001) · Cited by 119 · see citing works
The Tropos Metamodel and its Use
Susi, A., Perini, A., Mylopoulos, J., et al. (2005) · Informatica · Cited by 115 · see citing works
Security self-assessment guide for information technology systems
Swanson, M. (2001) · doi:10.6028/nist.sp.800-26 · Cited by 105 · see citing works
Model-based Management of Information System Security RiskPreprint
Mayer, N. (2009) · HAL (Le Centre pour la Communication Scientifique Directe) · Cited by 92 · see citing works
Security Quality Requirements Engineering (SQUARE) Methodology
Mead, N. R., Hough, E. D., Stehney, I., et al. (2005) · doi:10.21236/ada443493 · Cited by 92 · see citing works
Analyzing goal semantics for rights, permissions, and obligations
Breaux, T. D., & Antón, A. I. (2005) · doi:10.1109/re.2005.12 · Cited by 90 · see citing works
A Goal Oriented Approach for Modeling and Analyzing Security TradeOffs
Elahi, G., Yu, E. S. K., & Sandhu, R. (2007) · Cited by 88 · see citing works
Mal-Activity Diagrams for Capturing Attacks on Business Processes
Sindre, G. (2007) · Springer eBooks · doi:10.1007/978-3-540-73031-6_27 · Cited by 78 · see citing works
Matulevičius, R., Mayer, N., Mouratidis, H., et al. (2008) · Notes on numerical fluid mechanics and multidisciplinary design · doi:10.1007/978-3-540-69534-9_40 · Cited by 78 · see citing works
Modelling Trust for System Design Using the i * Strategic Actors Framework
Yu, E. S. K., & Liu, L. (2001) · Lecture notes in computer science · doi:10.1007/3-540-45547-7_11 · Cited by 73 · see citing works
From Trust to Dependability through Risk Analysis
Asnar, Y. D. W., Giorgini, P., Massacci, F., et al. (2007) · doi:10.1109/ares.2007.93 · Cited by 71 · see citing works
A Goal Oriented Approach for Modeling and Analyzing Security Trade-Offs
Elahi, G., & Yu, E. S. K. (2007) · Lecture notes in computer science · doi:10.1007/978-3-540-75563-0_26 · Cited by 69 · see citing works
Strategies for Developing Policies and Requirements for Secure Electronic Commerce Systems
Antón, A. I., & Earp, J. B. (2000) · NCSU Libraries Repository (North Carolina State University Libraries) · Cited by 66 · see citing works
Applying a Security Requirements Engineering Process
Mellado, D., Fernández‐Medina, E., & Piattini, M. G. (2006) · Lecture notes in computer science · doi:10.1007/11863908_13 · Cited by 64 · see citing works
Using abuse frames to bound the scope of security problems
Lin, L., Nuseibeh, B., Ince, D. C., et al. (2004) · Open Research Online (The Open University) · doi:10.1109/re.2004.54 · Cited by 61 · see citing works
Modelling Security and Trust with Secure Tropos
Giorgini, P., Mouratidis, H., & Zannone, N. (2007) · IGI Global eBooks · doi:10.4018/978-1-59904-147-6.ch008 · Cited by 56 · see citing works
Arguing security: validating security requirements using structured argumentation
Haley, C. B., Moffett, J., Laney, R., et al. (2005) · Open Research Online - ORO (The Open University) · Cited by 54 · see citing works
A Pattern System for Security Requirements Engineering
Hatebur, D., Heisel, M., & Schmidt, H. (2007) · doi:10.1109/ares.2007.12 · Cited by 52 · see citing works
Self-citationDesign of a Modelling Language for Information System Security Risk Management.
Mayer, N., Heymans, P., & Matulevičius, R. (2007) · Cited by 48 · see citing works
Security Engineering Using Problem Frames
Hatebur, D., Heisel, M., & Schmidt, H. (2006) · Lecture notes in computer science · doi:10.1007/11766155_17 · Cited by 44 · see citing works
Self-citationUsing trust assumptions with security requirements
Haley, C. B., Laney, R., Moffett, J., et al. (2005) · Requirements Engineering · doi:10.1007/s00766-005-0023-4 · Cited by 44 · see citing works
An Ontology for Secure Socio-Technical Systems
Massacci, F., Mylopoulos, J., & Zannone, N. (2008) · IGI Global eBooks · doi:10.4018/978-1-59904-660-0.ch011 · Cited by 44 · see citing works
Engineering Requirements for System Reliability and Security
van Lamsweerde, A. (2007) · Cited by 42 · see citing works
Integrating Security and Software Engineering
Mouratidis, H., & Giorgini, P. (2007) · IGI Global eBooks · doi:10.4018/978-1-59904-147-6 · Cited by 42 · see citing works
Modeling a Sensor Network by means of Clustering
Barali, E., Cerquitelli, T., & D’Elia, V. (2007) · Proceedings - International Workshop on Database and Expert Systems Applications/Proceedings · doi:10.1109/dexa.2007.23 · Cited by 39 · see citing works
Multilateral security requirements analysis for preserving privacy in ubiquitous environments
Gürses, S. F., Berendt, B., & Santen, T. (2006) · Lirias · Cited by 34 · see citing works
Self-citationEliciting confidentiality requirements in practice
Gürses, S. F., Jahnke, J. H., Obry, C., et al. (2005) · Conference of the Centre for Advanced Studies on Collaborative Research · Cited by 33 · see citing works
Self-citationBerry, D. M., & Lawrence, B. (1998) · IEEE Software · doi:10.1109/ms.1998.663780 · Cited by 31 · see citing works
Applying the common criteria in systems engineering
Keblawi, F., & Sullivan, D. (2006) · IEEE Security & Privacy · doi:10.1109/msp.2006.35 · Cited by 29 · see citing works
Analysis and Component-based Realization of Security Requirements
Hatebur, D., Heisel, M., & Schmidt, H. (2008) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1109/ares.2008.27 · Cited by 29 · see citing works
Self-citationGoal-Oriented Requirements Communication in New Product Development
Fricker, S., Gorschek, T., & Glinz, M. (2008) · doi:10.1109/iwspm.2008.2 · Cited by 27 · see citing works
A Security Engineering Process based on Patterns
Hatebur, D., Heisel, M., & Schmidt, H. (2007) · Proceedings - International Workshop on Database and Expert Systems Applications/Proceedings · doi:10.1109/dexa.2007.36 · Cited by 25 · see citing works
Self-citationMassacci, F., & Zannone, N. (2011) · TU/e Research Portal · Cited by 24 · see citing works
Contextualizing security goals: A method for multilateral security requirements elicitation
Gürses, S. F., & Santen, T. (2006) · Cited by 23 · see citing works
Self-citationST-tool: a CASE tool for security requirements engineering
Giorgini, P., Massacci, F., Mylopoulos, J., et al. (2005) · doi:10.1109/re.2005.67 · Cited by 23 · see citing works
Mouratidis, H., & Giorgini, P. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-04879-1_2 · Cited by 21 · see citing works
Structured Semantics for the CORAS Security Risk Modelling Language
Dahl, H. E. I., Stølen, K., & Hogganvik, I. (2007) · Cited by 21 · see citing works
A comparison of the Common Criteria with proposals of information systems security requirements
Mellado, D., Fernández‐Medina, E., & Piattini, M. G. (2006) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1109/ares.2006.2 · Cited by 20 · see citing works
Picking Battles: The Impact of Trust Assumptions on the Elaboration of Security Requirements
Haley, C. B., Laney, R., Moffett, J., et al. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-24747-0_27 · Cited by 19 · see citing works
Security Requirements Engineering for e-Government Applications: Analysis of Current Frameworks
Kalloniatis, C., Kavakli, E., & Gritzalis, S. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-30078-6_11 · Cited by 17 · see citing works
Risk Modelling and Reasoning in Goal Models
Asnar, Y. D. W., Giorgini, P., & Mylopoulos, J. (2006) · Unitn Eprints Research (Università Degli Studi di Trento) · Cited by 16 · see citing works
Preserving Software Quality Characteristics from Requirements Analysis to Architectural Design
Schmidt, H., & Wentzlaff, I. (2006) · Lecture notes in computer science · doi:10.1007/11966104_14 · Cited by 16 · see citing works
Self-citationIncorporating Security Quality Requirements Engineering (SQUARE) into Standard Life-Cycle Models
Mead, N. R., Viswanathan, V., Padmanabhan, D., et al. (2008) · doi:10.21236/ada482345 · Cited by 16 · see citing works
USING SECURITY ATTACK SCENARIOS TO ANALYSE SECURITY DURING INFORMATION SYSTEMS DESIGN
Mouratidis, H., Giorgini, P., & Manson, G. A. (2004) · International Workshop on Pattern Recognition in Information Systems (PRIS) · doi:10.5220/0002599000100017 · Cited by 15 · see citing works
Detecting Conflicts of Interest
Giorgini, P., Massacci, F., Mylopoulos, J., et al. (2006) · IEEE International Requirements Engineering Conference (RE) · doi:10.1109/re.2006.16 · Cited by 12 · see citing works
Pattern-Based Confidentiality-Preserving Refinement
Schmidt, H. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-00199-4_5 · Cited by 4 · see citing works
Self-citationStepwise Development of Secure Systems
Santen, T. (2006) · Lecture notes in computer science · doi:10.1007/11875567_11 · Cited by 4 · see citing works
Self-citationStratified Modelling and Analysis of Confidentiality Requirements
Onabajo, A., & Weber-Jahnke, J. H. (2008) · Proceedings of the ... Annual Hawaii International Conference on System Sciences/Proceedings of the Annual Hawaii International Conference on System Sciences · doi:10.1109/hicss.2008.414 · Cited by 3 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
A review of cyber security risk assessment methods for SCADA systems
Cherdantseva, Y., Burnap, P., Blyth, A., Eden, P., Jones, K., Soulsby, H., & Stoddart, K. (2016) · Computers & Security · doi:10.1016/j.cose.2015.09.009 · Cited by 606 · see citing works
“Over the last several years the MEM was actively used as a framework for the comparative evaluation of security and risk identification and analysis methods (Espaná et al., 2010; Fabian et al., 2010; Labunets et al., 2013, 2014 ).”
MethodCollaborative and secure sharing of healthcare data in multi-clouds
Fabian, B., Ermakova, T., & Junghanns, P. (2015) · Information Systems · doi:10.1016/j.is.2014.05.004 · Cited by 223 · see citing works
Self-citation
- Authors
- Fabian, B., Gürses, S., Heisel, M., Santen, T., & Schmidt, H.
- Affiliations
- Humboldt-Universität zu Berlin (DE)
- KU Leuven (BE)
- University of Duisburg-Essen (DE)
- Microsoft (Germany) (DE)
- Corresponding author
- Fabian, Benjamin
- Gürses, Seda
- Heisel, Maritta
- Santen, Thomas
- Schmidt, Holger
- Venue
- Requirements Engineering
- Published
- 2009-11-26
- Volume
- 15
- Issue
- 1
- Pages
- 7-40
- ISSN
- 0947-3602 (ISSN-L)
- 1432-010X
- OpenAlex
- W2111695375
- Cited by
- 239
- References
- 90
- Citations by year
- 2026: 1 · 2025: 4 · 2024: 8 · 2023: 8 · 2022: 6 · 2021: 10 · 2020: 11 · 2019: 17 · 2018: 18 · 2017: 18 · 2016: 19 · 2015: 30 · 2014: 30 · 2013: 19 · 2012: 21
- FWCI
- 35.25
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- www.springer.com/tdm (tdm)
- Locations
- Requirements Engineering (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
- Physical Sciences › Engineering › Safety, Risk, Reliability and Quality › Safety Systems Engineering in Autonomy
- Physical Sciences › Computer Science › Artificial Intelligence › Advanced Software Engineering Methodologies
- Keywords
- security requirements engineering, security requirements elicitation, security requirements analysis, conceptual framework, Common Criteria, Secure Tropos, MsrA, problem frames, method comparison, method evaluation, quality assurance
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
