{"id":"https://openalex.org/W1968330473","doi":"https://doi.org/10.1145/2746194.2746217","title":"Building a security practices evaluation framework","display_name":"Building a security practices evaluation framework","publication_year":2015,"publication_date":"2015-04-17","ids":{"openalex":"https://openalex.org/W1968330473","doi":"https://doi.org/10.1145/2746194.2746217","mag":"1968330473"},"language":"en","primary_location":{"id":"doi:10.1145/2746194.2746217","is_oa":false,"landing_page_url":"https://doi.org/10.1145/2746194.2746217","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2015 Symposium and Bootcamp on the Science of Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101506825","display_name":"Patrick Morrison","orcid":"https://orcid.org/0000-0003-0773-7817"},"institutions":[{"id":"https://openalex.org/I137902535","display_name":"North Carolina State University","ror":"https://ror.org/04tj63d06","country_code":"US","type":"education","lineage":["https://openalex.org/I137902535"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Patrick Morrison","raw_affiliation_strings":["North Carolina State University, Raleigh, NC","North Carolina State University, Raleigh, NC;"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"North Carolina State University, Raleigh, NC","institution_ids":["https://openalex.org/I137902535"]},{"raw_affiliation_string":"North Carolina State University, Raleigh, NC;","institution_ids":["https://openalex.org/I137902535"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5101506825"],"corresponding_institution_ids":["https://openalex.org/I137902535"],"apc_list":null,"apc_paid":null,"fwci":0.2896,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.49000423,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":95},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"2"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10430","display_name":"Software Engineering Techniques and Practices","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9983000159263611,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.7593854069709778},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6102697253227234},{"id":"https://openalex.org/keywords/software-development","display_name":"Software development","score":0.5920616388320923},{"id":"https://openalex.org/keywords/software-development-process","display_name":"Software development process","score":0.5218530893325806},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.4981648921966553},{"id":"https://openalex.org/keywords/personal-software-process","display_name":"Personal software process","score":0.4799557030200958},{"id":"https://openalex.org/keywords/best-practice","display_name":"Best practice","score":0.45643818378448486},{"id":"https://openalex.org/keywords/security-engineering","display_name":"Security engineering","score":0.4232307970523834},{"id":"https://openalex.org/keywords/social-software-engineering","display_name":"Social software engineering","score":0.4212941825389862},{"id":"https://openalex.org/keywords/software-peer-review","display_name":"Software peer review","score":0.4115591049194336},{"id":"https://openalex.org/keywords/process-management","display_name":"Process management","score":0.3752312660217285},{"id":"https://openalex.org/keywords/engineering-management","display_name":"Engineering management","score":0.37197864055633545},{"id":"https://openalex.org/keywords/software-construction","display_name":"Software construction","score":0.3704204559326172},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.3586162328720093},{"id":"https://openalex.org/keywords/knowledge-management","display_name":"Knowledge management","score":0.35657578706741333},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3050863742828369},{"id":"https://openalex.org/keywords/security-service","display_name":"Security service","score":0.24357706308364868},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.24237841367721558},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.2302054464817047},{"id":"https://openalex.org/keywords/political-science","display_name":"Political science","score":0.07576790452003479}],"concepts":[{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.7593854069709778},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6102697253227234},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.5920616388320923},{"id":"https://openalex.org/C180152950","wikidata":"https://www.wikidata.org/wiki/Q2904257","display_name":"Software development process","level":4,"score":0.5218530893325806},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.4981648921966553},{"id":"https://openalex.org/C39890963","wikidata":"https://www.wikidata.org/wiki/Q1702721","display_name":"Personal software process","level":5,"score":0.4799557030200958},{"id":"https://openalex.org/C184356942","wikidata":"https://www.wikidata.org/wiki/Q830382","display_name":"Best practice","level":2,"score":0.45643818378448486},{"id":"https://openalex.org/C13159133","wikidata":"https://www.wikidata.org/wiki/Q365674","display_name":"Security engineering","level":5,"score":0.4232307970523834},{"id":"https://openalex.org/C182500959","wikidata":"https://www.wikidata.org/wiki/Q7551380","display_name":"Social software engineering","level":5,"score":0.4212941825389862},{"id":"https://openalex.org/C74579156","wikidata":"https://www.wikidata.org/wiki/Q7554342","display_name":"Software peer review","level":5,"score":0.4115591049194336},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.3752312660217285},{"id":"https://openalex.org/C110354214","wikidata":"https://www.wikidata.org/wiki/Q6314146","display_name":"Engineering management","level":1,"score":0.37197864055633545},{"id":"https://openalex.org/C186846655","wikidata":"https://www.wikidata.org/wiki/Q3398377","display_name":"Software construction","level":4,"score":0.3704204559326172},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.3586162328720093},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.35657578706741333},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3050863742828369},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.24357706308364868},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.24237841367721558},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.2302054464817047},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.07576790452003479},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/2746194.2746217","is_oa":false,"landing_page_url":"https://doi.org/10.1145/2746194.2746217","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2015 Symposium and Bootcamp on the Science of Security","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9","score":0.4399999976158142}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":6,"referenced_works":["https://openalex.org/W642120166","https://openalex.org/W2024650319","https://openalex.org/W2037316754","https://openalex.org/W2126762719","https://openalex.org/W2167926541","https://openalex.org/W4245587674"],"related_works":["https://openalex.org/W1985363770","https://openalex.org/W2127166435","https://openalex.org/W2163383818","https://openalex.org/W2289273099","https://openalex.org/W1518972522","https://openalex.org/W2139942891","https://openalex.org/W2041796194","https://openalex.org/W2120376006","https://openalex.org/W2052544251","https://openalex.org/W2186532739"],"abstract_inverted_index":{"Software":[0],"development":[1,22,39,78,89,108],"teams":[2],"need":[3],"guidance":[4],"on":[5,20,119],"choosing":[6,45],"security":[7,23,34,73,90,109],"practices":[8,24,47],"so":[9],"they":[10],"can":[11],"develop":[12],"code":[13],"securely.":[14],"The":[15,61],"academic":[16],"and":[17,27,42,56,82,93,117,122],"practitioner":[18],"literature":[19],"software":[21,38,58,69,88,107],"is":[25,40,66],"large,":[26],"expanding.":[28],"However,":[29],"published":[30],"empirical":[31],"evidence":[32],"for":[33,54,87,106],"practice":[35,74,91],"use":[36,75,92],"in":[37,71,76],"limited":[41],"fragmented,":[43],"making":[44],"appropriate":[46],"difficult.":[48],"Measurement":[49],"frameworks":[50],"offer":[51],"a":[52,84,103],"tool":[53],"collecting":[55],"comparing":[57],"engineering":[59],"data.":[60],"goal":[62],"of":[63],"this":[64],"work":[65],"to":[67,113],"aid":[68],"practitioners":[70],"evaluating":[72],"the":[77,97,115],"process":[79],"by":[80],"defining":[81],"validating":[83],"measurement":[85,104],"framework":[86,105,116],"outcomes.":[94],"We":[95,111],"define":[96],"Security":[98],"Practices":[99],"Evaluation":[100],"Framework":[101],"(SP-EF),":[102],"practices.":[110],"plan":[112],"evaluate":[114],"ontology":[118],"historical":[120],"data":[121],"industrial":[123],"projects.":[124]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2018,"cited_by_count":1}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}