![](bgc.png)
9013 of Lecture Notes in Computer Science, pages
98–114. Springer.
Faßbender, S., Heisel, M., and Meis, R. (2014). Aspect-
oriented requirements engineering with problem
frames. In ICSOFT-PT 2014 - Proc. of the 9th Int.
Conf. on Software Paradigm Trends. SciTePress.
FIRST.org (2015). Common Vulnerability Scor-
ing System v3.0: Specification Document.
https://www.first.org/cvss/cvss-v30-specification-
v1.8.pdf.
Haskins, B., Stecklein, J., Dick, B., Moroney, G., Lovell,
R., and Dabney, J. (2004). Error cost escalation
through the project life cycle. INCOSE International
Symposium, 14:1723–1737.
Herrmann, A., Morali, A., Etalle, S., and Wieringa, R.
(2011). Riskrep: Risk-based security requirements
elicitation and prioritization. In 1st Intern. Workshop
on Alignment of Business Process and Security Mod-
elling, ABPSM 2011, Lect. Notes in Business Inform.
Processing. Springer Verlag.
ISO (2018). ISO 27005:2018 Information technology – Se-
curity techniques – Information security risk manage-
ment. International Organization for Standardization.
Jackson, M. (2001). Problem Frames. Analyzing and
structuring software development problems. Addison-
Wesley.
Kaspersky Lab (2019). The Kasper-
sky Lab Global IT Risk Report.
https://media.kaspersky.com/documents/business-
/brfwn/en/The-Kaspersky-Lab-Global-IT-Risk-
Report Kaspersky-Endpoint-Security-report.pdf.
Kumar, P., Lin, Y., Bai, G., Paverd, A., Dong, J. S., and
Martin, A. P. (2019). Smart grid metering networks:
A survey on security, privacy and open research is-
sues. IEEE Communications Surveys and Tutorials,
21(3):2886–2927.
Lund, M. S., Solhaug, B., and Stølen, K. (2010).
Model-Driven Risk Analysis. The CORAS Approach.
Springer.
NIST (2013). Special Publication 800-53 Rev. 4. National
Institute of Standards and Technology.
Steinberg, D., Budinsky, F., Paternostro, M., and Merks,
E. (2009). EMF: Eclipse Modeling Framework 2.0.
Addison-Wesley Professional, 2nd edition.
Tellbach, D. and Li, Y.-F. (2018). Cyber-attacks on smart
meters in household nanogrid: Modeling, simulation
and analysis. Energies, 11(2):316.
Varela-Vaca, A. J. and Gasca, R. M. (2013). Towards
the automatic and optimal selection of risk treatments
for business processes using a constraint program-
ming approach. Information & Software Technology,
55(11):1948–1973.
Varela-Vaca, A. J., Warschofsky, R., Gasca, R. M., Pozo,
S., and Meinel, C. (2012). A security pattern-driven
approach toward the automation of risk treatment
in business processes. In Herrero,
´
A., Sn
´
asel, V.,
Abraham, A., Zelinka, I., Baruque, B., Quinti
´
an-
Pardo, H., Calvo-Rolle, J. L., Sedano, J., and
Corchado, E., editors, International Joint Confer-
ence CISIS’12-ICEUTE’12-SOCO’12 Special Ses-
sions, Ostrava, Czech Republic, September 5th-7th,
2012, volume 189 of Advances in Intelligent Systems
and Computing, pages 13–23. Springer.
Wirtz, R. and Heisel, M. (2019a). Managing security risks:
template-based specification of controls. In Sousa,
T. B., editor, Proceedings of the 24th European Con-
ference on Pattern Languages of Programs, Euro-
PLoP 2019, Irsee, Germany, July 3-7, 2019, pages
10:1–10:13. ACM.
Wirtz, R. and Heisel, M. (2019b). Model-based risk anal-
ysis and evaluation using CORAS and CVSS. In
Damiani, E., Spanoudakis, G., and Maciaszek, L. A.,
editors, Evaluation of Novel Approaches to Software
Engineering - 14th International Conference, ENASE
2019, Heraklion, Crete, Greece, May 4-5, 2019, Re-
vised Selected Papers, volume 1172 of Communica-
tions in Computer and Information Science, pages
108–134. Springer.
Wirtz, R. and Heisel, M. (2019c). RE4DIST: model-
based elicitation of functional requirements for dis-
tributed systems. In van Sinderen, M. and Maciaszek,
L. A., editors, Proceedings of the 14th International
Conference on Software Technologies, ICSOFT 2019,
Prague, Czech Republic, July 26-28, 2019, pages 71–
81. SciTePress.
Wirtz, R. and Heisel, M. (2019d). A systematic method to
describe and identify security threats based on func-
tional requirements. In Zemmari, A., Mosbah, M.,
Cuppens-Boulahia, N., and Cuppens, F., editors, Risks
and Security of Internet and Systems, pages 205–221,
Cham. Springer International Publishing.
Systematic Treatment of Security Risks during Requirements Engineering
143