{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,9]],"date-time":"2026-01-09T00:27:35Z","timestamp":1767918455488,"version":"3.49.0"},"reference-count":39,"publisher":"Springer Science and Business Media LLC","issue":"4","license":[{"start":{"date-parts":[[2016,12,16]],"date-time":"2016-12-16T00:00:00Z","timestamp":1481846400000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"funder":[{"name":"NSA Science of Security Lablet"},{"name":"SESAR Joint Undertaking WP-E EMFASE Project"},{"name":"Ministry of Science, Technology and Telecommunications (MICITT)","award":["University of Costa Rica Project No. 834-B5-A18"],"award-info":[{"award-number":["University of Costa Rica Project No. 834-B5-A18"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Empir Software Eng"],"published-print":{"date-parts":[[2017,8]]},"DOI":"10.1007\/s10664-016-9481-1","type":"journal-article","created":{"date-parts":[[2016,12,17]],"date-time":"2016-12-17T07:01:36Z","timestamp":1481958096000},"page":"2127-2178","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":17,"title":["Identifying the implied: Findings from three differentiated replications on the use of security requirements templates"],"prefix":"10.1007","volume":"22","author":[{"given":"Maria","family":"Riaz","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jason","family":"King","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"John","family":"Slankas","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Laurie","family":"Williams","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Fabio","family":"Massacci","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Christian","family":"Quesada-L\u00f3pez","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Marcelo","family":"Jenkins","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2016,12,16]]},"reference":[{"issue":"1","key":"9481_CR1","doi-asserted-by":"crossref","first-page":"58","DOI":"10.1109\/MS.2003.1159030","volume":"20","author":"I Alexander","year":"2003","unstructured":"Alexander I (2003) Misuse Cases: Use Cases with Hostile Intent. IEEE Softw 20(1):58\u201366","journal-title":"IEEE Softw"},{"key":"9481_CR2","doi-asserted-by":"crossref","unstructured":"Braz F, Fernandez EB, VanHilst M (2008) Eliciting security requirements through misuse activities. 4th International Conference on Trust, Privacy & Security in Digital Busines (TrustBus\u201908), Turin, Italy, September 1\u20135, 2008, pp 328\u2013333","DOI":"10.1109\/DEXA.2008.101"},{"key":"9481_CR3","unstructured":"Carver J (2010) Towards reporting guidelines for experimental replications: a proposal. 1st International Workshop on Replication in Empirical Software Engineering Research (RESER) [Held during ICSE 2010], Cape Town, South Africa"},{"key":"9481_CR4","doi-asserted-by":"crossref","first-page":"35","DOI":"10.1007\/s10664-009-9109-9","volume":"15","author":"J Carver","year":"2010","unstructured":"Carver J, Jaccheri L, Morasca S (2010) A checklist for integrating student empirical studies with research and teaching goals. Empir Softw Eng 15:35\u201359","journal-title":"Empir Softw Eng"},{"issue":"2","key":"9481_CR5","doi-asserted-by":"crossref","first-page":"267","DOI":"10.1007\/s10664-013-9290-8","volume":"19","author":"J Carver","year":"2014","unstructured":"Carver J, Juristo N, Baldassarre M, Vegas S (2014) Replications of software engineering experiments. Empir Softw Eng 19(2):267\u2013276","journal-title":"Empir Softw Eng"},{"key":"9481_CR6","doi-asserted-by":"crossref","unstructured":"De Gramatica M, Labunets K, Massacci F, Paci F, Tedeschi A (2015) The role of catalogues of threats and security controls in security risk assessment: an empirical study with ATM professionals. 21st International Working Conference on Requirements Engineering: Foundation for Software Quality (REFSQ2015), Springer Verlag, pp 98\u2013114","DOI":"10.1007\/978-3-319-16101-3_7"},{"key":"9481_CR7","doi-asserted-by":"crossref","unstructured":"Fabian B, G\u00fcrses S, Heisel M, Santen T, Schmidt H (2010) A comparison of security requirements engineering methods. Requirements Engineering - Special Issue on RE\u201909: Security Requirements Engineering 15: 7\u201340","DOI":"10.1007\/s00766-009-0092-x"},{"issue":"1","key":"9481_CR8","doi-asserted-by":"crossref","first-page":"15","DOI":"10.5381\/jot.2004.3.1.c6","volume":"3","author":"DG Firesmith","year":"2004","unstructured":"Firesmith DG (2004) Specifying Reusable Security Requirements. J Object Technol 3(1):15","journal-title":"J Object Technol"},{"issue":"6","key":"9481_CR9","doi-asserted-by":"crossref","first-page":"821","DOI":"10.1287\/mnsc.1030.0192","volume":"50","author":"PH Gray","year":"2004","unstructured":"Gray PH, Meister DB (2004) Knowledge sourcing effectiveness. Manag Sci 50(6):821\u2013834","journal-title":"Manag Sci"},{"issue":"1","key":"9481_CR10","doi-asserted-by":"crossref","first-page":"133","DOI":"10.1109\/TSE.2007.70754","volume":"34","author":"CB Haley","year":"2008","unstructured":"Haley CB, Laney R, Moffett JD, Nuseibeh B (2008) Security requirements engineering: a framework for representation and analysis. IEEE Trans Softw Eng 34(1):133\u2013153","journal-title":"IEEE Trans Softw Eng"},{"key":"9481_CR11","unstructured":"Ito Y, Washizaki H, Yoshizawa M, Fukazawa Y, Okubo T, Kaiya H, Hazeyama A, Yoshioka N, Fernandez E (2015) Systematic mapping of security patterns research. Plop 2015"},{"key":"9481_CR12","doi-asserted-by":"publisher","unstructured":"Karpati P, Opdahl AL, Sindre G (2015) Investigating security threats in architectural context: experimental evaluations of misuse case maps. J Syst Softw 104:90\u2013111. doi: 10.1016\/j.jss.2015.02.040 . Elsevier Ltd","DOI":"10.1016\/j.jss.2015.02.040"},{"key":"9481_CR13","unstructured":"Kitchenham B, Charters S (2007) Guidelines for performing systematic literature reviews in software engineering. Technical Report EBSE-2007-01 School of Computer Science and Mathematics, Keele University"},{"issue":"3","key":"9481_CR14","doi-asserted-by":"crossref","first-page":"217","DOI":"10.1080\/00031305.1993.10475983","volume":"47","author":"RM Lindsay","year":"1993","unstructured":"Lindsay RM, Ehrenberg ASC (1993) The design of replicated studies. Am Stat 47(3):217\u2013228","journal-title":"Am Stat"},{"issue":"1","key":"9481_CR15","doi-asserted-by":"publisher","first-page":"38","DOI":"10.1016\/j.bjoms.2007.09.002","volume":"46","author":"E McCrum-Gardner","year":"2008","unstructured":"McCrum-Gardner E (2008) Which is the correct statistical test to use? Br J Oral Maxillofac Surg 46(1):38\u201341. doi: 10.1016\/j.bjoms.2007.09.002","journal-title":"Br J Oral Maxillofac Surg"},{"key":"9481_CR16","doi-asserted-by":"crossref","unstructured":"McDermott J, Fox C (1999) Using abuse case models for security requirements analysis. In: Computer Security Applications Conference, pp 55\u201364","DOI":"10.1109\/CSAC.1999.816013"},{"key":"9481_CR17","doi-asserted-by":"crossref","unstructured":"Mead NR, Houg ED, Stehney TR (2005) Security quality requirements engineering (SQUARE) methodology. Technical Report CMU\/SEI-2005-TR-009 Software Engineering Institute, Carnegie Mellon University","DOI":"10.21236\/ADA443493"},{"issue":"2","key":"9481_CR18","doi-asserted-by":"crossref","first-page":"244","DOI":"10.1016\/j.csi.2006.04.002","volume":"29","author":"D Mellado","year":"2007","unstructured":"Mellado D, Fern\u00e1ndez-Medina E, Piattini M (2007) A common criteria based security requirements engineering process for the development of secure information systems. Comput Stand Interfaces 29(2):244\u2013253","journal-title":"Comput Stand Interfaces"},{"key":"9481_CR19","doi-asserted-by":"crossref","first-page":"153","DOI":"10.1016\/j.csi.2010.01.006","volume":"32","author":"D Mellado","year":"2010","unstructured":"Mellado D, Blanco C, S\u00e1nchez LE, Fern\u00e1ndez-Medina E (2010) A systematic review of security requirements engineering. Comput Stand Interfaces 32:153\u2013165","journal-title":"Comput Stand Interfaces"},{"key":"9481_CR20","unstructured":"Meneely A, Smith B, Williams L (2012) Appendix B: iTrust electronic health care system case study. Software and Systems Traceability, Springer Verlag, pp 425\u2013438"},{"issue":"9","key":"9481_CR21","doi-asserted-by":"crossref","first-page":"637","DOI":"10.1109\/TSE.2007.70721","volume":"33","author":"T Menzies","year":"2007","unstructured":"Menzies T, Dekhtyar A, Distefano J, Greenwald J (2007) Problems with precision: a response to \u201cComments on \u2018data mining static code attributes to learn defect predictors\u201d. IEEE Trans Softw Eng 33(9):637\u2013640","journal-title":"IEEE Trans Softw Eng"},{"key":"9481_CR22","doi-asserted-by":"crossref","unstructured":"Riaz M, King J, Slankas J, Williams L (2014) Hidden in plain sight: automatically identifying security requirements from natural language artifacts. Requirements Engineering (RE 2014). Karlskrona, Sweden, pp 183\u2013192","DOI":"10.1109\/RE.2014.6912260"},{"key":"9481_CR23","doi-asserted-by":"crossref","unstructured":"Riaz M, Slankas J, King J, Williams L (2014) Using templates to elicit implied security requirements from functional requirements\u2009\u2212\u2009a controlled experiment. International Symposium on Empirical Software Engineering and Measurement (ESEM), Torino, Italy","DOI":"10.1145\/2652524.2652532"},{"key":"9481_CR24","doi-asserted-by":"crossref","first-page":"14","DOI":"10.1016\/j.infsof.2015.04.002","volume":"65","author":"M Riaz","year":"2015","unstructured":"Riaz M, Breaux T, Williams L (2015) How have we evaluated software pattern application? a systematic mapping study of research design practices. Inf Softw Technol 65:14\u201338","journal-title":"Inf Softw Technol"},{"key":"9481_CR25","doi-asserted-by":"crossref","unstructured":"Riaz M, Elder S, Williams L (2016) Systematically developing prevention, detection, and response patterns for security requirements. 3rd International Workshop on Evolving Security and Privacy Requirements Engineering (ESPRE), Beijing, China","DOI":"10.1109\/REW.2016.025"},{"key":"9481_CR26","volume-title":"Security Patterns: Integrating Security and Systems Engineering","author":"M Schumacher","year":"2006","unstructured":"Schumacher M, Fernandez-Buglioni E, Hybertson D, Buschmann F, Sommerlad P (2006) Security Patterns: Integrating Security and Systems Engineering. John Wiley & Sons, Ltd., West Sussex"},{"issue":"1","key":"9481_CR27","doi-asserted-by":"publisher","first-page":"34","DOI":"10.1007\/s00766-004-0194-4","volume":"10","author":"G Sindre","year":"2005","unstructured":"Sindre G, Opdahl AL (2005) Eliciting security requirements with misuse cases. Requir Eng 10(1):34\u201344. doi: 10.1007\/s00766-004-0194-4","journal-title":"Requir Eng"},{"key":"9481_CR28","doi-asserted-by":"crossref","unstructured":"Suleiman H, Svetinovic D (2013) Evaluating the effectiveness of the security quality requirements engineering (SQUARE) method: a case study using smart grid advanced metering infrastructure. Requirements Engineering 18(3):251\u2013279","DOI":"10.1007\/s00766-012-0153-4"},{"key":"9481_CR29","doi-asserted-by":"crossref","unstructured":"Taubenberger S, J\u00fcrjens J, Yu Y, Nuseibeh B (2011) Problem analysis of it-security risk assessment methods \u2013 an experience report from the insurance and auditing domain. Future Challenges in Security and Privacy for Academia and Industry, pp 259\u2013270","DOI":"10.1007\/978-3-642-21424-0_21"},{"issue":"3","key":"9481_CR30","doi-asserted-by":"crossref","first-page":"202","DOI":"10.1108\/IMCS-09-2012-0054","volume":"21","author":"S Taubenberger","year":"2013","unstructured":"Taubenberger S, J\u00fcrjens J, Yu Y, Nuseibeh B (2013) Resolving vulnerability identification errors using security requirements on business process models. Inf Manag Comput Secur 21(3):202\u2013223","journal-title":"Inf Manag Comput Secur"},{"issue":"4","key":"9481_CR31","doi-asserted-by":"crossref","first-page":"205","DOI":"10.1007\/PL00010360","volume":"6","author":"A Toval","year":"2002","unstructured":"Toval A, Nicol\u00e1s J, Moros B, Garc\u00eda F (2002) Requirements reuse for improving information systems security: a practitioner\u2019s approach. Requir Eng 6(4):205\u2013219","journal-title":"Requir Eng"},{"issue":"5","key":"9481_CR32","first-page":"360","volume":"37","author":"AJ Viera","year":"2005","unstructured":"Viera AJ, Garrett JM (2005) Understanding interobserver agreement: the kappa statistic. Fam Med 37(5):360\u2013363","journal-title":"Fam Med"},{"issue":"7","key":"9481_CR33","doi-asserted-by":"crossref","first-page":"1087","DOI":"10.1016\/j.infsof.2009.01.004","volume":"51","author":"GS Walia","year":"2009","unstructured":"Walia GS, Carver JC (2009) A systematic literature review to identify and classify software requirement errors. Inf Softw Technol 51(7):1087\u20131109","journal-title":"Inf Softw Technol"},{"key":"9481_CR34","doi-asserted-by":"crossref","unstructured":"Wen Y, Zhao H, Liu L (2011) Analysing security requirements patterns based on problems decomposition and composition. First International Workshop on Requirements Patterns (RePa), pp 11\u201320","DOI":"10.1109\/RePa.2011.6046726"},{"key":"9481_CR35","unstructured":"Withall S (2007) Software requirement patterns. Microsoft Press"},{"key":"9481_CR36","doi-asserted-by":"crossref","DOI":"10.1007\/978-1-4615-4625-2","volume-title":"Experimentation in software engineering: an introduction","author":"C Wohlin","year":"2000","unstructured":"Wohlin C, Runeson P, H\u00f6st M, Ohlsson M, Regnell B, Wessl\u00e9n A (2000) Planning. In: Basili VR (ed) Experimentation in software engineering: an introduction. Kluwer Academic Publishers, Norwell, MA"},{"key":"9481_CR37","doi-asserted-by":"crossref","unstructured":"Yoshioka N, Washizaki H, Maruyama K (2008) A survey on security patterns. Progress in Informatics, Special Issue: The future of software engineering for security and privacy (5): 35\u201347","DOI":"10.2201\/NiiPi.2008.5.5"},{"key":"9481_CR38","doi-asserted-by":"crossref","unstructured":"Yskout K, Scandariato R, Joosen W (2015) Do security patterns really help designers? Proc. of ICSE 2015. IEEE, pp 292\u2013302","DOI":"10.1109\/ICSE.2015.49"},{"issue":"5","key":"9481_CR39","doi-asserted-by":"crossref","first-page":"1213","DOI":"10.1109\/TSE.2011.79","volume":"38","author":"C Zhang","year":"2012","unstructured":"Zhang C, Budgen D (2012) What do we know about the effectiveness of software design patterns? IEEE Trans Softw Eng 38(5):1213\u20131231","journal-title":"IEEE Trans Softw Eng"}],"container-title":["Empirical Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s10664-016-9481-1\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s10664-016-9481-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s10664-016-9481-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,6,21]],"date-time":"2024-06-21T07:22:18Z","timestamp":1718954538000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s10664-016-9481-1"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016,12,16]]},"references-count":39,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2017,8]]}},"alternative-id":["9481"],"URL":"https:\/\/doi.org\/10.1007\/s10664-016-9481-1","relation":{},"ISSN":["1382-3256","1573-7616"],"issn-type":[{"value":"1382-3256","type":"print"},{"value":"1573-7616","type":"electronic"}],"subject":[],"published":{"date-parts":[[2016,12,16]]}}}