{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,18]],"date-time":"2026-08-18T00:37:02Z","timestamp":1787013422309,"version":"build-2736575974"},"reference-count":58,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"4","license":[{"start":{"date-parts":[[2023,4,1]],"date-time":"2023-04-01T00:00:00Z","timestamp":1680307200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2023,4,1]],"date-time":"2023-04-01T00:00:00Z","timestamp":1680307200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2023,4,1]],"date-time":"2023-04-01T00:00:00Z","timestamp":1680307200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100000038","name":"Natural Sciences and Engineering Research Council of Canada","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100000038","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IIEEE Trans. Software Eng."],"published-print":{"date-parts":[[2023,4,1]]},"DOI":"10.1109\/tse.2023.3235684","type":"journal-article","created":{"date-parts":[[2023,1,10]],"date-time":"2023-01-10T14:11:01Z","timestamp":1673359861000},"page":"2892-2919","source":"Crossref","is-referenced-by-count":14,"title":["DASP: A Framework for Driving the Adoption of Software Security Practices"],"prefix":"10.1109","volume":"49","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6406-5263","authenticated-orcid":false,"given":"Enrique","family":"Larios-Vargas","sequence":"first","affiliation":[{"name":"Department of Computer Science, University of Victoria, Victoria, BC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6843-7629","authenticated-orcid":false,"given":"Omar","family":"Elazhary","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Victoria, Victoria, BC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Soroush","family":"Yousefi","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Victoria, Victoria, BC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Derek","family":"Lowlind","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Victoria, Victoria, BC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Michael L. W.","family":"Vliek","sequence":"additional","affiliation":[{"name":"Leiden University, Leiden, EZ, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2278-2536","authenticated-orcid":false,"given":"Margaret-Anne","family":"Storey","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Victoria, Victoria, BC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"National vulnerability database","year":"2021"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.4324\/9781315618906"},{"key":"ref5","volume-title":"Communication and Persuasion: Psychological Studies of Opinion Change","author":"Hovland","year":"1953"},{"key":"ref6","volume-title":"Belief, Attitude, Intention and Behavior: An Introduction to Theory and Research","author":"Fishbein","year":"1975"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1177\/109019818401100101"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.2307\/1914185"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1207\/s15327957pspr0803_1"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1037\/0003-066x.37.2.122"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1186\/1748-5908-6-42"},{"key":"ref12","volume-title":"The Behaviour Change Wheel: A Guide to Designing Interventions","author":"Michie","year":"2014"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.3109\/14992027.2015.1120894"},{"key":"ref14","article-title":"Toward sustainable behaviour change: An approach for cyber security education training and awareness","volume-title":"Proc. 27th Eur. Conf. Inf. Syst.","author":"Alshaikh"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1186\/s12913-019-3885-8"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.3390\/healthcare4020031"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.3390\/ijerph18041939"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1080\/08870446.2019.1679373"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1080\/17437199.2016.1190658"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1016\/j.puhe.2015.12.009"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1016\/j.erss.2016.06.015"},{"key":"ref22","volume-title":"Research Design: Qualitative, Quantitative, and Mixed Methods Approaches","author":"Creswell","year":"2013"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1111\/j.1755-618X.2004.tb02167.x"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1007\/BF02766777"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1080\/13814788.2017.1375092"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.11648\/j.ajtas.20160501.11"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/METRICS.2005.24"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/ESEM.2011.36"},{"key":"ref29","first-page":"38","volume-title":"Thematic Coding and Categorizing","author":"Gibbs","year":"2007"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1007\/BF00988593"},{"key":"ref31","volume-title":"Qualitative Data Analysis: A Methods Sourcebook","author":"Miles","year":"2014"},{"key":"ref32","volume-title":"Grounded Theory in Practice","author":"Strauss","year":"1997"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2021.3077405"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2020.3001959"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.17990\/Axi\/2016_9789726972679_041"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1007\/s12160-013-9486-6"},{"key":"ref37","first-page":"71","volume-title":"Self-Efficacy","volume":"4","author":"Bandura"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1016\/0146-6402(78)90002-4"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1016\/S0090-2616(98)90006-7"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1080\/00223980.1975.9915803"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1177\/109019810002700506"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1016\/0749-5978(91)90020-T"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1037\/0033-2909.92.1.111"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3471930"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1201\/1086\/44797.13.5.20041101\/84907.5"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijhcs.2009.03.002"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/3481357.3481522"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/CESSER-IP.2019.00014"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/VLHCC.2011.6070393"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/2998181.2998191"},{"key":"ref51","first-page":"161","article-title":"Why do programmers do what they do? A theory of influences on security practices","volume-title":"Proc. HATS Workshop Usable Secur. Privacy","author":"Sajwan"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1145\/3290605.3300519"},{"key":"ref53","first-page":"1","article-title":"Motivations and amotivations for software security","volume-title":"Proc. SOUPS Workshop Secur. Inf. Workers","author":"Assal"},{"key":"ref54","first-page":"109","article-title":"Understanding security mistakes developers make: Qualitative analysis from build it, break it, fix it","volume-title":"Proc. USENIX Secur. Symp.","author":"Votipka"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-SEIP52600.2021.00011"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3511560"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2022.3142337"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/tse.2023.3235684"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1037\/a0018938"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1146\/annurev-psych-113011-143809"}],"container-title":["IEEE Transactions on Software Engineering"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/32\/10103953\/10014531.pdf?arnumber=10014531","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,3,14]],"date-time":"2024-03-14T00:25:23Z","timestamp":1710375923000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10014531\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,4,1]]},"references-count":58,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.1109\/tse.2023.3235684","relation":{},"ISSN":["0098-5589","1939-3520","2326-3881"],"issn-type":[{"value":"0098-5589","type":"print"},{"value":"1939-3520","type":"electronic"},{"value":"2326-3881","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,4,1]]}}}