{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,22]],"date-time":"2026-04-22T02:20:35Z","timestamp":1776824435683,"version":"3.51.2"},"reference-count":52,"publisher":"World Scientific Pub Co Pte Ltd","issue":"04","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Int. J. Soft. Eng. Knowl. Eng."],"published-print":{"date-parts":[[2024,4]]},"abstract":"<jats:p> To avoid costly security patching after software deployment, security-by-design techniques (e.g. threat analysis) are adopted in organizations to find and mitigate security issues before the system is ever implemented. Organizations are ramping up such (heavily manual) activities, but there is a global gap in the security workforce. Favorable performance indicators would result in cost savings for organizations with scarce security experts. However, past empirical studies were inconclusive regarding some performance indicators of threat analysis techniques, thus practitioners have little evidence for choosing the technique to adopt. To address this issue, we replicated a controlled experiment with STRIDE. Our study aimed to measure and compare the performance indicators (productivity and precision) of two STRIDE variants (per-element and per-interaction). Since we made some similar observations to the original study, we conclude that the two approaches are not different enough to make a practical impact. To this end, the choice of which variant to adopt should be informed by the needs of the organization performing threat analysis. We conclude by discussing some of the unexplored yet relevant topic domains in the context of STRIDE that will be considered in future work. <\/jats:p>","DOI":"10.1142\/s0218194023500651","type":"journal-article","created":{"date-parts":[[2023,10,29]],"date-time":"2023-10-29T05:17:15Z","timestamp":1698556635000},"page":"623-650","source":"Crossref","is-referenced-by-count":4,"title":["On the Measures of Success in Replication of Controlled Experiments with STRIDE"],"prefix":"10.1142","volume":"34","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6913-1971","authenticated-orcid":false,"given":"Winnie","family":"Mbaka","sequence":"first","affiliation":[{"name":"Department of Computer Science, Vrije Universiteit Amsterdam, 10811 HV, Amsterdam, Netherlands"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7189-2817","authenticated-orcid":false,"given":"Katja","family":"Tuma","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Vrije Universiteit Amsterdam, 10811 HV, Amsterdam, Netherlands"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"219","published-online":{"date-parts":[[2024,5,23]]},"reference":[{"key":"S0218194023500651BIB002","doi-asserted-by":"publisher","DOI":"10.1109\/ICSAW.2017.25"},{"key":"S0218194023500651BIB003","doi-asserted-by":"publisher","DOI":"10.1016\/j.heliyon.2021.e05969"},{"key":"S0218194023500651BIB004","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58295-1_4"},{"key":"S0218194023500651BIB006","doi-asserted-by":"publisher","DOI":"10.1007\/s00766-013-0195-2"},{"key":"S0218194023500651BIB007","doi-asserted-by":"publisher","DOI":"10.1109\/ASWEC.2018.00023"},{"key":"S0218194023500651BIB009","doi-asserted-by":"publisher","DOI":"10.5772\/intechopen.97094"},{"key":"S0218194023500651BIB010","volume-title":"Threat Modeling: Designing for Security","author":"Shostack A.","year":"2014"},{"key":"S0218194023500651BIB011","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSPW51379.2020.00047"},{"key":"S0218194023500651BIB012","first-page":"1","volume-title":"Proc. 15th ESCAR Conf.","author":"Karahasanovic A.","year":"2017"},{"key":"S0218194023500651BIB013","doi-asserted-by":"publisher","DOI":"10.1109\/QRS-C51114.2020.00078"},{"key":"S0218194023500651BIB015","first-page":"47","volume-title":"Computer Security","author":"Tuma K.","year":"2017"},{"key":"S0218194023500651BIB016","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00761-4_23"},{"key":"S0218194023500651BIB017","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2021.111003"},{"key":"S0218194023500651BIB018","doi-asserted-by":"publisher","DOI":"10.1023\/B:EMSE.0000013516.80487.33"},{"key":"S0218194023500651BIB019","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-71301-2_11"},{"issue":"9","key":"S0218194023500651BIB020","first-page":"1742","volume":"47","author":"Santos A.","year":"2019","journal-title":"IEEE Trans. Softw. Eng."},{"key":"S0218194023500651BIB021","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-91602-6_3"},{"key":"S0218194023500651BIB022","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2014.05.018"},{"key":"S0218194023500651BIB023","doi-asserted-by":"publisher","DOI":"10.1109\/TechDebt.2019.00011"},{"key":"S0218194023500651BIB024","doi-asserted-by":"publisher","DOI":"10.1145\/2652524.2652532"},{"key":"S0218194023500651BIB025","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-008-9074-8"},{"key":"S0218194023500651BIB026","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-011-9172-x"},{"key":"S0218194023500651BIB027","doi-asserted-by":"publisher","DOI":"10.1109\/ESEM.2013.59"},{"key":"S0218194023500651BIB028","doi-asserted-by":"publisher","DOI":"10.1109\/CONISOFT.2019.00019"},{"key":"S0218194023500651BIB029","doi-asserted-by":"publisher","DOI":"10.1109\/ESEM.2013.29"},{"key":"S0218194023500651BIB030","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2022.3149586"},{"key":"S0218194023500651BIB031","doi-asserted-by":"publisher","DOI":"10.1016\/j.jvlc.2014.03.002"},{"key":"S0218194023500651BIB033","doi-asserted-by":"publisher","DOI":"10.1109\/WICSA.2014.43"},{"key":"S0218194023500651BIB034","doi-asserted-by":"publisher","DOI":"10.1080\/00031305.1993.10475983"},{"key":"S0218194023500651BIB036","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-013-9265-9"},{"key":"S0218194023500651BIB037","doi-asserted-by":"publisher","DOI":"10.1145\/1368088.1368115"},{"key":"S0218194023500651BIB038","first-page":"144","volume-title":"Proceedings of the 21st International Conference on Evaluation and Assessment in Software Engineering, EASE \u201917","author":"Abraho S.","year":"2017"},{"key":"S0218194023500651BIB039","first-page":"1","volume-title":"2019 ACM\/IEEE Int. Symp. Empirical Software Engineering and Measurement","author":"Fagerholm F."},{"key":"S0218194023500651BIB040","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-54045-0_15"},{"key":"S0218194023500651BIB041","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2017.12.016"},{"key":"S0218194023500651BIB042","doi-asserted-by":"publisher","DOI":"10.1145\/3474624.3474649"},{"key":"S0218194023500651BIB043","doi-asserted-by":"publisher","DOI":"10.1109\/ESEM.2015.7321185"},{"key":"S0218194023500651BIB044","doi-asserted-by":"publisher","DOI":"10.1145\/1414004.1414055"},{"key":"S0218194023500651BIB045","doi-asserted-by":"publisher","DOI":"10.1109\/CyberSecPODS.2019.8885144"},{"key":"S0218194023500651BIB046","doi-asserted-by":"publisher","DOI":"10.1007\/s10270-021-00941-7"},{"key":"S0218194023500651BIB047","doi-asserted-by":"publisher","DOI":"10.1016\/j.foodqual.2012.05.003"},{"key":"S0218194023500651BIB050","doi-asserted-by":"publisher","DOI":"10.1111\/risa.13583"},{"key":"S0218194023500651BIB051","doi-asserted-by":"publisher","DOI":"10.1111\/risa.13534"},{"key":"S0218194023500651BIB052","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.03.010"},{"key":"S0218194023500651BIB053","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-016-9481-1"},{"key":"S0218194023500651BIB054","doi-asserted-by":"publisher","DOI":"10.1145\/3524501.3527595"},{"issue":"6","key":"S0218194023500651BIB055","first-page":"1","volume":"21","author":"Landuyt D. V.","year":"2021","journal-title":"Softw. Syst. Model."},{"key":"S0218194023500651BIB056","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2015.82"},{"key":"S0218194023500651BIB057","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-45143-3_2"},{"key":"S0218194023500651BIB058","doi-asserted-by":"publisher","DOI":"10.1109\/APSEC.2013.19"},{"key":"S0218194023500651BIB059","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-017-9523-3"},{"key":"S0218194023500651BIB060","doi-asserted-by":"publisher","DOI":"10.1109\/ISESE.2004.1334904"}],"container-title":["International Journal of Software Engineering and Knowledge Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.worldscientific.com\/doi\/pdf\/10.1142\/S0218194023500651","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,5,27]],"date-time":"2024-05-27T04:11:19Z","timestamp":1716783079000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.worldscientific.com\/doi\/10.1142\/S0218194023500651"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,4]]},"references-count":52,"journal-issue":{"issue":"04","published-print":{"date-parts":[[2024,4]]}},"alternative-id":["10.1142\/S0218194023500651"],"URL":"https:\/\/doi.org\/10.1142\/s0218194023500651","relation":{},"ISSN":["0218-1940","1793-6403"],"issn-type":[{"value":"0218-1940","type":"print"},{"value":"1793-6403","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,4]]}}}