{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,27]],"date-time":"2025-06-27T04:14:16Z","timestamp":1750997656294,"version":"3.41.0"},"publisher-location":"Cham","reference-count":32,"publisher":"Springer International Publishing","isbn-type":[{"type":"print","value":"9783319702407"},{"type":"electronic","value":"9783319702414"}],"license":[{"start":{"date-parts":[[2017,1,1]],"date-time":"2017-01-01T00:00:00Z","timestamp":1483228800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2017,1,1]],"date-time":"2017-01-01T00:00:00Z","timestamp":1483228800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2017]]},"DOI":"10.1007\/978-3-319-70241-4_2","type":"book-chapter","created":{"date-parts":[[2017,10,30]],"date-time":"2017-10-30T01:07:58Z","timestamp":1509325678000},"page":"18-33","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["Information Security Risk Management"],"prefix":"10.1007","author":[{"given":"Salimeh","family":"Dashti","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Paolo","family":"Giorgini","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Elda","family":"Paja","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2017,10,31]]},"reference":[{"key":"2_CR1","unstructured":"Abid, M.: Information technology infrastructure library (ITIL). JIT 1(1) (2012)"},{"key":"2_CR2","unstructured":"Continuity Central: Information risk co-existance. https:\/\/www.continuitycentral.com\/feature0189.htm"},{"key":"2_CR3","volume-title":"Security Requirements Engineering: Designing Secure Socio-Technical Systems","author":"F Dalpiaz","year":"2016","unstructured":"Dalpiaz, F., Paja, E., Giorgini, P.: Security Requirements Engineering: Designing Secure Socio-Technical Systems. MIT Press, Cambridge (2016)"},{"issue":"3","key":"2_CR4","doi-asserted-by":"publisher","first-page":"53","DOI":"10.5381\/jot.2003.2.3.c6","volume":"2","author":"D Firesmith","year":"2003","unstructured":"Firesmith, D.: Security use cases. J. Object Technol. 2(3), 53\u201364 (2003)","journal-title":"J. Object Technol."},{"key":"2_CR5","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"263","DOI":"10.1007\/978-3-540-39648-2_22","volume-title":"Conceptual Modeling - ER 2003","author":"P Giorgini","year":"2003","unstructured":"Giorgini, P., Massacci, F., Mylopoulos, J.: Requirement engineering meets security: a case study on modelling secure electronic transactions by VISA and Mastercard. In: Song, I.-Y., Liddle, S.W., Ling, T.-W., Scheuermann, P. (eds.) ER 2003. LNCS, vol. 2813, pp. 263\u2013276. Springer, Heidelberg (2003). doi:10.1007\/978-3-540-39648-2_22"},{"issue":"1","key":"2_CR6","doi-asserted-by":"publisher","first-page":"133","DOI":"10.1109\/TSE.2007.70754","volume":"34","author":"C Haley","year":"2008","unstructured":"Haley, C., Laney, R., Moffett, J., Nuseibeh, B.: Security requirements engineering: a framework for representation and analysis. IEEE Trans. Softw. Eng. 34(1), 133\u2013153 (2008)","journal-title":"IEEE Trans. Softw. Eng."},{"key":"2_CR7","unstructured":"ISO\/IEC: ISO\/IEC 27001 information security standard (2013)"},{"key":"2_CR8","unstructured":"ISO\/IEC: ISO\/IEC 27002 information security standard (2013)"},{"key":"2_CR9","unstructured":"ISO\/IEC 15408: ISO\/IEC 15408\u20131:2009 information technology standard (2009)"},{"key":"2_CR10","unstructured":"Kessel, P.: Into the cloud, out of the fog: EY 2011 global information security survey (2011)"},{"key":"2_CR11","doi-asserted-by":"crossref","unstructured":"Lainhart IV, J.W.: A method for controlling information and information technology risks and vulnerabilities. JIS 14(s-1), 21\u201325 (2000)","DOI":"10.2308\/jis.2000.14.s-1.21"},{"key":"2_CR12","doi-asserted-by":"crossref","unstructured":"Liu, L., Yu, E., Mylopoulos, J.: Security and privacy requirements analysis within a social setting. In: Proceedings of RE Conference, pp. 151\u2013161. IEEE (2003)","DOI":"10.1109\/ICRE.2003.1232746"},{"key":"2_CR13","volume-title":"Model-Driven Risk Analysis: The CORAS Approach","author":"M Lund","year":"2010","unstructured":"Lund, M., Solhaug, B., St\u00f8len, K.: Model-Driven Risk Analysis: The CORAS Approach. Springer Science & Business Media, Heidelberg (2010)"},{"key":"2_CR14","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"88","DOI":"10.1007\/3-540-45831-X_7","volume-title":"Infrastructure Security","author":"N McEvoy","year":"2002","unstructured":"McEvoy, N., Whitcombe, A.: Structured risk analysis. In: Davida, G., Frankel, Y., Rees, O. (eds.) InfraSec 2002. LNCS, vol. 2437, pp. 88\u2013103. Springer, Heidelberg (2002). doi:10.1007\/3-540-45831-X_7"},{"key":"2_CR15","doi-asserted-by":"publisher","DOI":"10.21236\/ADA443493","volume-title":"Security Quality Requirements Engineering (SQUARE) Methodology","author":"N Mead","year":"2005","unstructured":"Mead, N., Stehney, T.: Security Quality Requirements Engineering (SQUARE) Methodology, vol. 30. ACM, New York (2005)"},{"key":"2_CR16","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"192","DOI":"10.1007\/11863908_13","volume-title":"Computer Security \u2013 ESORICS 2006","author":"D Mellado","year":"2006","unstructured":"Mellado, D., Fern\u00e1ndez-Medina, E., Piattini, M.: Applying a security requirements engineering process. In: Gollmann, D., Meier, J., Sabelfeld, A. (eds.) ESORICS 2006. LNCS, vol. 4189, pp. 192\u2013206. Springer, Heidelberg (2006). doi:10.1007\/11863908_13"},{"issue":"4","key":"2_CR17","first-page":"143","volume":"3","author":"V Mihailescu","year":"2012","unstructured":"Mihailescu, V.: Mehari. JABIS 3(4), 143 (2012)","journal-title":"JABIS"},{"key":"2_CR18","doi-asserted-by":"publisher","first-page":"123","DOI":"10.1016\/j.datak.2015.07.007","volume":"98","author":"E Paja","year":"2015","unstructured":"Paja, E., Dalpiaz, F., Giorgini, P.: Modelling and reasoning about security requirements in socio-technical systems. Data Knowl. Eng. 98, 123\u2013143 (2015)","journal-title":"Data Knowl. Eng."},{"key":"2_CR19","volume-title":"Facilitated risk analysis process (FRAP)","author":"T Peltier","year":"2000","unstructured":"Peltier, T.: Facilitated risk analysis process (FRAP). Auerbach Publication, CRC Press LLC, Boca Raton (2000)"},{"key":"2_CR20","unstructured":"PWC: Turnaround and transformation in cybersecurity. https:\/\/www.pwc.com\/sg\/en\/publications\/assets\/pwc-global-state-of-information-security-survay-2016.pdf"},{"key":"2_CR21","unstructured":"PWC: Why risk assessments fail. https:\/\/www.pwc.com\/us\/en\/risk-assurance\/publications\/assets\/preventing-erm-risk-assessment-failure.pdf"},{"key":"2_CR22","unstructured":"PWC: 2015 information security breaches survey (2015). https:\/\/www.pwc.co.uk\/assets\/pdf\/2015-isbs-technical-report-blue-digital.pdf"},{"key":"2_CR23","unstructured":"Richardson, R.: CSI computer crime and security survey, 2011 (2010)"},{"key":"2_CR24","doi-asserted-by":"crossref","unstructured":"Ridley, G., Young, J., Carroll, P.: COBIT and its utilization: a framework from the literature. In: Proceedings of the 37th HICSS. IEEE (2004)","DOI":"10.1109\/HICSS.2004.1265566"},{"key":"2_CR25","unstructured":"Simonsson, M., Johnson, P., Wijkstr\u00f6m, H.: Model-based it governance maturity assessments with COBIT. In: ECIS, pp. 1276\u20131287 (2007)"},{"issue":"1","key":"2_CR26","doi-asserted-by":"publisher","first-page":"34","DOI":"10.1007\/s00766-004-0194-4","volume":"10","author":"G Sindre","year":"2005","unstructured":"Sindre, G., Opdahl, A.L.: Eliciting security requirements with misuse cases. Requirements Eng. 10(1), 34\u201344 (2005)","journal-title":"Requirements Eng."},{"key":"2_CR27","unstructured":"Stamatelatos, M., Vesely, W., Dugan, J., Fragola, J., Minarick, J., Railsback, J.: Fault Tree Handbook (2002)"},{"key":"2_CR28","unstructured":"British Standard: Code of practice for ISM British Standards Institution (1995)"},{"key":"2_CR29","unstructured":"British Standard: Standard 100-2: It-grundschutz-vorgehensweise. BSI (2008)"},{"key":"2_CR30","doi-asserted-by":"crossref","unstructured":"Stoneburner, G., Goguen, A.Y., Feringa, A.: SP 800-30. Risk management guide for information technology systems (2002)","DOI":"10.6028\/NIST.SP.800-30"},{"issue":"4","key":"2_CR31","first-page":"109","volume":"22","author":"L Sun","year":"2006","unstructured":"Sun, L., Srivastava, R., Mock, T.: An information systems security risk assessment model under the Dempster-Shafer theory of belief functions. JMIS 22(4), 109\u2013142 (2006)","journal-title":"JMIS"},{"key":"2_CR32","volume-title":"Payment Card Industry Data Security Standard Handbook","author":"T Virtue","year":"2009","unstructured":"Virtue, T.: Payment Card Industry Data Security Standard Handbook. Wiley, Hoboken (2009)"}],"container-title":["Lecture Notes in Business Information Processing","The Practice of Enterprise Modeling"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-319-70241-4_2","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,26]],"date-time":"2025-06-26T19:52:44Z","timestamp":1750967564000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-319-70241-4_2"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017]]},"ISBN":["9783319702407","9783319702414"],"references-count":32,"URL":"https:\/\/doi.org\/10.1007\/978-3-319-70241-4_2","relation":{},"ISSN":["1865-1348","1865-1356"],"issn-type":[{"type":"print","value":"1865-1348"},{"type":"electronic","value":"1865-1356"}],"subject":[],"published":{"date-parts":[[2017]]},"assertion":[{"value":"31 October 2017","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"PoEM","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"IFIP Working Conference on The Practice of Enterprise Modeling","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Leuven","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Belgium","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2017","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"22 November 2017","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"24 November 2017","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"10","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"poem2017","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"http:\/\/kuleuvencongres.be\/poem2017\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"This content has been made available to all.","name":"free","label":"Free to read"}]}}