{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,18]],"date-time":"2026-03-18T13:49:42Z","timestamp":1773841782662,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":45,"publisher":"ACM","license":[{"start":{"date-parts":[[2018,5,21]],"date-time":"2018-05-21T00:00:00Z","timestamp":1526860800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2018,5,21]]},"DOI":"10.1145\/3234152.3234187","type":"proceedings-article","created":{"date-parts":[[2019,5,3]],"date-time":"2019-05-03T14:29:00Z","timestamp":1556893740000},"page":"1-9","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":17,"title":["Aligning security objectives with agile software development"],"prefix":"10.1145","author":[{"given":"Kalle","family":"Rindell","sequence":"first","affiliation":[{"name":"University of Turku, Turku, Finland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Sami","family":"Hyrynsalmi","sequence":"additional","affiliation":[{"name":"Tampere University of Technology, Turku, Finland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ville","family":"Lepp\u00e4nen","sequence":"additional","affiliation":[{"name":"University of Turku, Turku, Finland"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2018,5,21]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Technical Report 478. VTT PUBLICATIONS.","author":"Abrahamsson P.","year":"2002","unstructured":"P. Abrahamsson , O. Salo , J. Ronkainen , and J. Warsta . 2002 . Agile software development methods - Review and analysis. Technical Report 478. VTT PUBLICATIONS. P. Abrahamsson, O. Salo, J. Ronkainen, and J. Warsta. 2002. Agile software development methods - Review and analysis. Technical Report 478. VTT PUBLICATIONS."},{"key":"e_1_3_2_1_2_1","volume-title":"Ambler and Mark Lines","author":"Scott","year":"2012","unstructured":"Scott W. Ambler and Mark Lines . 2012 . Disciplined Agile Delivery: A Practitioner's Guide to Agile Software Delivery in the Enterprise (1st ed.). IBM Press . Scott W. Ambler and Mark Lines. 2012. Disciplined Agile Delivery: A Practitioner's Guide to Agile Software Delivery in the Enterprise (1st ed.). IBM Press."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-41488-6_10"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/1987875.1987900"},{"key":"e_1_3_2_1_5_1","volume-title":"IT Infrastructures, IT Development, and Business. In Business Agility and Information Technology Diffusion, Richard L. Baskerville, Lars Mathiassen, Jan Pries-Heje","author":"Baskerville Richard L.","unstructured":"Richard L. Baskerville , Lars Mathiassen , and Jan Pries-Heje . 2005. Agility in Fours: IT Diffusion , IT Infrastructures, IT Development, and Business. In Business Agility and Information Technology Diffusion, Richard L. Baskerville, Lars Mathiassen, Jan Pries-Heje , and Janice I. DeGross (Eds.). Springer US , Boston, MA , 3--10. Richard L. Baskerville, Lars Mathiassen, and Jan Pries-Heje. 2005. Agility in Fours: IT Diffusion, IT Infrastructures, IT Development, and Business. In Business Agility and Information Technology Diffusion, Richard L. Baskerville, Lars Mathiassen, Jan Pries-Heje, and Janice I. DeGross (Eds.). Springer US, Boston, MA, 3--10."},{"key":"e_1_3_2_1_6_1","volume-title":"Extreme Programming Explained: Embrace Change","author":"Beck Kent","unstructured":"Kent Beck . 2000. Extreme Programming Explained: Embrace Change . Addison-Wesley Longman Publishing Co., Inc. , Boston, MA, USA . Kent Beck. 2000. Extreme Programming Explained: Embrace Change. Addison-Wesley Longman Publishing Co., Inc., Boston, MA, USA."},{"key":"e_1_3_2_1_7_1","first-page":"12","article-title":"How to Agilely Architect an Agile Architecture","volume":"27","author":"Bellomo Stephany","year":"2014","unstructured":"Stephany Bellomo , Philippe Kruchten , Robert L Nord , and Ipek Ozkaya . 2014 . How to Agilely Architect an Agile Architecture . Cutter IT Journal 27 , 2 (2014), 12 -- 17 . Stephany Bellomo, Philippe Kruchten, Robert L Nord, and Ipek Ozkaya. 2014. How to Agilely Architect an Agile Architecture. Cutter IT Journal 27, 2 (2014), 12--17.","journal-title":"Cutter IT Journal"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/1065907.1066034"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.5555\/1111312.1111317"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"crossref","unstructured":"B. Boehm and R. Turner. 2003. Balancing Agility and Discipline: A Guide for the Perplexed. Addison-Wesley New York.   B. Boehm and R. Turner. 2003. Balancing Agility and Discipline: A Guide for the Perplexed . Addison-Wesley New York.","DOI":"10.1007\/978-3-540-24675-6_1"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2003.1204376"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/MS.2005.129"},{"key":"e_1_3_2_1_13_1","volume-title":"The costs and benefits of pair programming. Extreme programming examined 8","author":"Cockburn Alistair","year":"2000","unstructured":"Alistair Cockburn and Laurie Williams . 2000. The costs and benefits of pair programming. Extreme programming examined 8 ( 2000 ), 223--247. Alistair Cockburn and Laurie Williams. 2000. The costs and benefits of pair programming. Extreme programming examined 8 (2000), 223--247."},{"key":"e_1_3_2_1_14_1","unstructured":"Common Criteria Recognition Arrangement (CCRA). 2018. The Common Criteria. (2018).  Common Criteria Recognition Arrangement (CCRA). 2018. The Common Criteria. (2018)."},{"key":"e_1_3_2_1_15_1","volume-title":"Calvo-Manzano","author":"Diaz Jessica","year":"2009","unstructured":"Jessica Diaz , Juan Garbajosa , and Jose A . Calvo-Manzano . 2009 . Mapping CMMI Level 2 to Scrum Practices : An Experience Report. In Software Process Improvement, Rory V. O'Connor, Nathan Baddoo, Juan Cuadrago Gallego, Ricardo Rejas Muslera, Kari Smolander, and Richard Messnarz (Eds.). Springer Berlin Heidelberg , Berlin, Heidelberg, 93--104. Jessica Diaz, Juan Garbajosa, and Jose A. Calvo-Manzano. 2009. Mapping CMMI Level 2 to Scrum Practices: An Experience Report. In Software Process Improvement, Rory V. O'Connor, Nathan Baddoo, Juan Cuadrago Gallego, Ricardo Rejas Muslera, Kari Smolander, and Richard Messnarz (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg, 93--104."},{"key":"e_1_3_2_1_16_1","volume-title":"Selected Writings on Computing: A Personal Perspective","author":"Dijkstra Edsger W.","unstructured":"Edsger W. Dijkstra . 1982. Selected Writings on Computing: A Personal Perspective . Springer-Verlag . Edsger W. Dijkstra. 1982. Selected Writings on Computing: A Personal Perspective. Springer-Verlag."},{"key":"e_1_3_2_1_17_1","unstructured":"DoD. 1983. TRUSTED COMPUTER SYSTEM EVALUATION CRITERIA. United States Department of Defence.  DoD. 1983. TRUSTED COMPUTER SYSTEM EVALUATION CRITERIA . United States Department of Defence."},{"key":"e_1_3_2_1_18_1","unstructured":"DoD. 1985. GUIDANCE FOR APPLYING THE DEPARTMENT OF DEFENSE TRUSTED COMPUTER SYSTEM EVALUATION CRITERIA IN SPECIFIC ENVIRONMENTS. United States Department of Defence.  DoD. 1985. GUIDANCE FOR APPLYING THE DEPARTMENT OF DEFENSE TRUSTED COMPUTER SYSTEM EVALUATION CRITERIA IN SPECIFIC ENVIRONMENTS . United States Department of Defence."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/2593812.2593813"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/MS.2001.922739"},{"key":"e_1_3_2_1_21_1","volume-title":"Technical debt and agile software development practices and processes: An industry practitioner survey. Information and Software Technology","author":"Holvitie Johannes","year":"2017","unstructured":"Johannes Holvitie , Sherlock A. Licorish , Rodrigo O. Sp\u00ednola , Sami Hyrynsalmi , Stephen G. MacDonell , Thiago S. Mendes , Jim Buchan , and Ville Lepp\u00e4nen . 2017. Technical debt and agile software development practices and processes: An industry practitioner survey. Information and Software Technology ( 2017 ). Johannes Holvitie, Sherlock A. Licorish, Rodrigo O. Sp\u00ednola, Sami Hyrynsalmi, Stephen G. MacDonell, Thiago S. Mendes, Jim Buchan, and Ville Lepp\u00e4nen. 2017. Technical debt and agile software development practices and processes: An industry practitioner survey. Information and Software Technology (2017)."},{"key":"e_1_3_2_1_22_1","volume-title":"The Security Development Lifecycle","author":"Howard Michael","unstructured":"Michael Howard and Steve Lipner . 2006. The Security Development Lifecycle . Microsoft Press , Redmond, WA, USA . Michael Howard and Steve Lipner. 2006. The Security Development Lifecycle. Microsoft Press, Redmond, WA, USA."},{"key":"e_1_3_2_1_23_1","unstructured":"ISO\/IEC standard 15408-1:2009. 2009. Information technology - Security techniques - Evaluation criteria for IT security. ISO\/IEC.  ISO\/IEC standard 15408-1:2009. 2009. Information technology - Security techniques - Evaluation criteria for IT security . ISO\/IEC."},{"key":"e_1_3_2_1_24_1","unstructured":"ISO\/IEC standard 21827. 2008. Information Technology - Security Techniques - Systems Security Engineering - Capability Maturity Model (SSE-CMM). ISO\/IEC.  ISO\/IEC standard 21827. 2008. Information Technology - Security Techniques - Systems Security Engineering - Capability Maturity Model (SSE-CMM) . ISO\/IEC."},{"key":"e_1_3_2_1_25_1","volume-title":"Adoption and Suitability of Software Development Methods and Practices. In 2016 23rd Asia-Pacific Software Engineering Conference (APSEC). 369--372","author":"Licorish S. A.","unstructured":"S. A. Licorish , J. Holvitie , S. Hyrynsalmi , V. Lepp\u00e4nen , R. O. Spinola , T. S. Mendes , S. G. MacDonell , and J. Buchan . 2016 . Adoption and Suitability of Software Development Methods and Practices. In 2016 23rd Asia-Pacific Software Engineering Conference (APSEC). 369--372 . S. A. Licorish, J. Holvitie, S. Hyrynsalmi, V. Lepp\u00e4nen, R. O. Spinola, T. S. Mendes, S. G. MacDonell, and J. Buchan. 2016. Adoption and Suitability of Software Development Methods and Practices. In 2016 23rd Asia-Pacific Software Engineering Conference (APSEC). 369--372."},{"key":"e_1_3_2_1_26_1","unstructured":"CMMI Institute LLC. 2017. The CMMI Institute. (2017). http:\/\/cmmiinstitute.com\/.  CMMI Institute LLC. 2017. The CMMI Institute. (2017). http:\/\/cmmiinstitute.com\/."},{"key":"e_1_3_2_1_27_1","unstructured":"Microsoft. 2017. Agile Development Using Microsoft Security Development Lifecycle. (2017).  Microsoft. 2017. Agile Development Using Microsoft Security Development Lifecycle. (2017)."},{"key":"e_1_3_2_1_28_1","unstructured":"OWASP. 2017. Software Assurance Maturity Model. (2017).  OWASP. 2017. Software Assurance Maturity Model. (2017)."},{"key":"e_1_3_2_1_29_1","unstructured":"OWASP. 2018. OWASP Top 10 Application Security Risks. (2018).  OWASP. 2018. OWASP Top 10 Application Security Risks. (2018)."},{"key":"e_1_3_2_1_30_1","volume-title":"Usage and Training Needs in Agile Settings. In 2016 11th International Conference on Availability, Reliability and Security (ARES). 548--555","author":"Oyetoyan T. D.","unstructured":"T. D. Oyetoyan , D. S. Cruzes , and M. G. Jaatun . 2016. An Empirical Study on the Relationship between Software Security Skills , Usage and Training Needs in Agile Settings. In 2016 11th International Conference on Availability, Reliability and Security (ARES). 548--555 . T. D. Oyetoyan, D. S. Cruzes, and M. G. Jaatun. 2016. An Empirical Study on the Relationship between Software Security Skills, Usage and Training Needs in Agile Settings. In 2016 11th International Conference on Availability, Reliability and Security (ARES). 548--555."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/52.965798"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1365-2575.2007.00259.x"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/3098954.3103170"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/2372251.2372275"},{"key":"e_1_3_2_1_35_1","volume-title":"Risk-Driven Security Metrics in Agile Software Development - An Industrial Pilot Study. 18, 12 (jun","author":"Savola Reijo M.","year":"2012","unstructured":"Reijo M. Savola , Christian Fr\u00c3ijhwirth , and Ari Pietik\u00c3d'inen . 2012. Risk-Driven Security Metrics in Agile Software Development - An Industrial Pilot Study. 18, 12 (jun 2012 ), 1679--1702. |http:\/\/www.jucs.org\/jucs_18_12\/risk_driven_security_metrics|. Reijo M. Savola, Christian Fr\u00c3ijhwirth, and Ari Pietik\u00c3d'inen. 2012. Risk-Driven Security Metrics in Agile Software Development - An Industrial Pilot Study. 18, 12 (jun 2012), 1679--1702. |http:\/\/www.jucs.org\/jucs_18_12\/risk_driven_security_metrics|."},{"key":"e_1_3_2_1_36_1","volume-title":"Scrum Development Process. OOPSLA'95 Workshop on Business Object Design and Implementation.","author":"Schwaber Ken","year":"1995","unstructured":"Ken Schwaber . 1995 . Scrum Development Process. OOPSLA'95 Workshop on Business Object Design and Implementation. Ken Schwaber. 1995. Scrum Development Process. OOPSLA'95 Workshop on Business Object Design and Implementation."},{"key":"e_1_3_2_1_37_1","volume-title":"Agile Processes in Software Engineering and Extreme Programming","author":"S\u00e9guin Normand","unstructured":"Normand S\u00e9guin , Guy Tremblay , and Houda Bagane . 2012. Agile Principles as Software Engineering Principles: An Analysis . In Agile Processes in Software Engineering and Extreme Programming , Claes Wohlin (Ed.). Springer Berlin Heidelberg , Berlin, Heidelberg , 1--15. Normand S\u00e9guin, Guy Tremblay, and Houda Bagane. 2012. Agile Principles as Software Engineering Principles: An Analysis. In Agile Processes in Software Engineering and Extreme Programming, Claes Wohlin (Ed.). Springer Berlin Heidelberg, Berlin, Heidelberg, 1--15."},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2010.07.006"},{"key":"e_1_3_2_1_39_1","unstructured":"Synopsys Software Integrity Group. 2017. The Building Security In Maturity Model. (2017). https:\/\/www.bsimm.com\/  Synopsys Software Integrity Group. 2017. The Building Security In Maturity Model. (2017). https:\/\/www.bsimm.com\/"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/MS.2008.19"},{"key":"e_1_3_2_1_41_1","volume-title":"Proceedings of the International Workshop on Secure Software Engineering in DevOps and Agile Development (SecSE 2017). CEUR Workshop Proceedings, 34--49","author":"T\u00fcrpe Sven","year":"2017","unstructured":"Sven T\u00fcrpe and Andreas Poller . 2017 . Managing Security Work in Scrum: Tensions and Challenges . In Proceedings of the International Workshop on Secure Software Engineering in DevOps and Agile Development (SecSE 2017). CEUR Workshop Proceedings, 34--49 . Sven T\u00fcrpe and Andreas Poller. 2017. Managing Security Work in Scrum: Tensions and Challenges. In Proceedings of the International Workshop on Secure Software Engineering in DevOps and Agile Development (SecSE 2017). CEUR Workshop Proceedings, 34--49."},{"key":"e_1_3_2_1_42_1","volume-title":"11th Annual State of Agile Survey. (2017). https:\/\/versionone.com\/pdf\/VersionOne-11th-Annual-State-of-Agile-Report.pdf","unstructured":"VersionOne. 2017. 11th Annual State of Agile Survey. (2017). https:\/\/versionone.com\/pdf\/VersionOne-11th-Annual-State-of-Agile-Report.pdf . VersionOne. 2017. 11th Annual State of Agile Survey. (2017). https:\/\/versionone.com\/pdf\/VersionOne-11th-Annual-State-of-Agile-Report.pdf."},{"key":"e_1_3_2_1_43_1","volume-title":"Building Secure Software: How to Avoid Security Problems the Right Way","author":"Viega John","unstructured":"John Viega and Gary R McGraw . 2002. Building Secure Software: How to Avoid Security Problems the Right Way . Addison-Wesley . John Viega and Gary R McGraw. 2002. Building Secure Software: How to Avoid Security Problems the Right Way. Addison-Wesley."},{"key":"e_1_3_2_1_44_1","unstructured":"William Wake. 2003. INVEST in Good Stories and SMART Tasks. (2003). https:\/\/xp123.com\/articles\/invest-in-good-stories-and-smart-tasks\/  William Wake. 2003. INVEST in Good Stories and SMART Tasks. (2003). https:\/\/xp123.com\/articles\/invest-in-good-stories-and-smart-tasks\/"},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/MAHC.2015.21"}],"event":{"name":"XP '18 Companion: 19th International Conference on Agile Software Development","location":"Porto Portugal","acronym":"XP '18 Companion"},"container-title":["Proceedings of the 19th International Conference on Agile Software Development: Companion"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3234152.3234187","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3234152.3234187","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T02:08:04Z","timestamp":1750212484000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3234152.3234187"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,5,21]]},"references-count":45,"alternative-id":["10.1145\/3234152.3234187","10.1145\/3234152"],"URL":"https:\/\/doi.org\/10.1145\/3234152.3234187","relation":{},"subject":[],"published":{"date-parts":[[2018,5,21]]},"assertion":[{"value":"2018-05-21","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}