{"id":"https://openalex.org/W2966889885","doi":"https://doi.org/10.1145/3339252.3339263","title":"Costing Secure Software Development","display_name":"Costing Secure Software Development","publication_year":2019,"publication_date":"2019-08-09","ids":{"openalex":"https://openalex.org/W2966889885","doi":"https://doi.org/10.1145/3339252.3339263","mag":"2966889885"},"language":"en","primary_location":{"id":"doi:10.1145/3339252.3339263","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3339252.3339263","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 14th International Conference on Availability, Reliability and Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5085080986","display_name":"Elaine Venson","orcid":"https://orcid.org/0000-0002-7607-5936"},"institutions":[{"id":"https://openalex.org/I1174212","display_name":"University of Southern California","ror":"https://ror.org/03taz7m60","country_code":"US","type":"education","lineage":["https://openalex.org/I1174212"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Elaine Venson","raw_affiliation_strings":["Center for Systems and Software Engineering, University of Southern California"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Center for Systems and Software Engineering, University of Southern California","institution_ids":["https://openalex.org/I1174212"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101059426","display_name":"Xiaomeng Guo","orcid":null},"institutions":[{"id":"https://openalex.org/I1174212","display_name":"University of Southern California","ror":"https://ror.org/03taz7m60","country_code":"US","type":"education","lineage":["https://openalex.org/I1174212"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xiaomeng Guo","raw_affiliation_strings":["Center for Systems and Software Engineering, University of Southern California"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Center for Systems and Software Engineering, University of Southern California","institution_ids":["https://openalex.org/I1174212"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102676447","display_name":"Zidi Yan","orcid":null},"institutions":[{"id":"https://openalex.org/I1174212","display_name":"University of Southern California","ror":"https://ror.org/03taz7m60","country_code":"US","type":"education","lineage":["https://openalex.org/I1174212"]},{"id":"https://openalex.org/I2800817003","display_name":"California Southern University","ror":"https://ror.org/058zz0t50","country_code":"US","type":"education","lineage":["https://openalex.org/I2800817003"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zidi Yan","raw_affiliation_strings":["University of Southern California"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Southern California","institution_ids":["https://openalex.org/I1174212","https://openalex.org/I2800817003"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5020182574","display_name":"Barry Boehm","orcid":null},"institutions":[{"id":"https://openalex.org/I1174212","display_name":"University of Southern California","ror":"https://ror.org/03taz7m60","country_code":"US","type":"education","lineage":["https://openalex.org/I1174212"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Barry Boehm","raw_affiliation_strings":["Center for Systems and Software Engineering, University of Southern California"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Center for Systems and Software Engineering, University of Southern California","institution_ids":["https://openalex.org/I1174212"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":18,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"11"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9980999827384949,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7179814577102661},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.6752374172210693},{"id":"https://openalex.org/keywords/software-development","display_name":"Software development","score":0.583357036113739},{"id":"https://openalex.org/keywords/security-bug","display_name":"Security bug","score":0.5237959623336792},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.48515161871910095},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.45726263523101807},{"id":"https://openalex.org/keywords/activity-based-costing","display_name":"Activity-based costing","score":0.45037591457366943},{"id":"https://openalex.org/keywords/secure-coding","display_name":"Secure coding","score":0.44216388463974},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4243679642677307},{"id":"https://openalex.org/keywords/software-construction","display_name":"Software construction","score":0.41907715797424316},{"id":"https://openalex.org/keywords/software-development-process","display_name":"Software development process","score":0.41776248812675476},{"id":"https://openalex.org/keywords/risk-analysis","display_name":"Risk analysis (engineering)","score":0.34391045570373535},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.20132866501808167},{"id":"https://openalex.org/keywords/security-service","display_name":"Security service","score":0.12846466898918152},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.06837907433509827}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7179814577102661},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.6752374172210693},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.583357036113739},{"id":"https://openalex.org/C131275738","wikidata":"https://www.wikidata.org/wiki/Q7445023","display_name":"Security bug","level":5,"score":0.5237959623336792},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.48515161871910095},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.45726263523101807},{"id":"https://openalex.org/C164624739","wikidata":"https://www.wikidata.org/wiki/Q754331","display_name":"Activity-based costing","level":2,"score":0.45037591457366943},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.44216388463974},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4243679642677307},{"id":"https://openalex.org/C186846655","wikidata":"https://www.wikidata.org/wiki/Q3398377","display_name":"Software construction","level":4,"score":0.41907715797424316},{"id":"https://openalex.org/C180152950","wikidata":"https://www.wikidata.org/wiki/Q2904257","display_name":"Software development process","level":4,"score":0.41776248812675476},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.34391045570373535},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.20132866501808167},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.12846466898918152},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.06837907433509827},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.0},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.0},{"id":"https://openalex.org/C162853370","wikidata":"https://www.wikidata.org/wiki/Q39809","display_name":"Marketing","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3339252.3339263","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3339252.3339263","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 14th International Conference on Availability, Reliability and Security","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":96,"referenced_works":["https://openalex.org/W14257781","https://openalex.org/W17818914","https://openalex.org/W1079567482","https://openalex.org/W1495115868","https://openalex.org/W1495565380","https://openalex.org/W1497203923","https://openalex.org/W1554355587","https://openalex.org/W1595080503","https://openalex.org/W1604191750","https://openalex.org/W1613744360","https://openalex.org/W1669992463","https://openalex.org/W1695350145","https://openalex.org/W1696906756","https://openalex.org/W1818897895","https://openalex.org/W1947959002","https://openalex.org/W1968572451","https://openalex.org/W1969939902","https://openalex.org/W1973719626","https://openalex.org/W1975675278","https://openalex.org/W1978415201","https://openalex.org/W1979503333","https://openalex.org/W1986222079","https://openalex.org/W1986736724","https://openalex.org/W1997236144","https://openalex.org/W2015004885","https://openalex.org/W2028813279","https://openalex.org/W2043837581","https://openalex.org/W2045465652","https://openalex.org/W2050163926","https://openalex.org/W2058871236","https://openalex.org/W2060210006","https://openalex.org/W2080076767","https://openalex.org/W2085040524","https://openalex.org/W2094774010","https://openalex.org/W2098861514","https://openalex.org/W2104789242","https://openalex.org/W2112657059","https://openalex.org/W2113627748","https://openalex.org/W2122385484","https://openalex.org/W2123774540","https://openalex.org/W2124493593","https://openalex.org/W2133933998","https://openalex.org/W2135276860","https://openalex.org/W2146322906","https://openalex.org/W2148183591","https://openalex.org/W2149439200","https://openalex.org/W2151511199","https://openalex.org/W2154780932","https://openalex.org/W2154941560","https://openalex.org/W2166336492","https://openalex.org/W2168599422","https://openalex.org/W2170341841","https://openalex.org/W2187635982","https://openalex.org/W2191018382","https://openalex.org/W2223652430","https://openalex.org/W2232396709","https://openalex.org/W2240706405","https://openalex.org/W2288841757","https://openalex.org/W2291164584","https://openalex.org/W2294407885","https://openalex.org/W2361575844","https://openalex.org/W2363451736","https://openalex.org/W2391474792","https://openalex.org/W2417788275","https://openalex.org/W2471213063","https://openalex.org/W2512714308","https://openalex.org/W2529133275","https://openalex.org/W2529758583","https://openalex.org/W2533379192","https://openalex.org/W2562223200","https://openalex.org/W2562914086","https://openalex.org/W2564142338","https://openalex.org/W2571682840","https://openalex.org/W2571995300","https://openalex.org/W2590810828","https://openalex.org/W2594301554","https://openalex.org/W2603117807","https://openalex.org/W2617116426","https://openalex.org/W2766073798","https://openalex.org/W2770592828","https://openalex.org/W2783078595","https://openalex.org/W2913191858","https://openalex.org/W2971794642","https://openalex.org/W3006539356","https://openalex.org/W4233339973","https://openalex.org/W4239530551","https://openalex.org/W4245047106","https://openalex.org/W4245260471","https://openalex.org/W4248229790","https://openalex.org/W4249632239","https://openalex.org/W4250844610","https://openalex.org/W4252395698","https://openalex.org/W4253215717","https://openalex.org/W4285719527","https://openalex.org/W4295098747","https://openalex.org/W4399917771"],"related_works":["https://openalex.org/W1978034799","https://openalex.org/W4384518368","https://openalex.org/W2141388993","https://openalex.org/W2155353733","https://openalex.org/W2504659933","https://openalex.org/W2039943835","https://openalex.org/W2293245356","https://openalex.org/W2560421591","https://openalex.org/W1566131087","https://openalex.org/W4225160120"],"abstract_inverted_index":{"Building":[0],"more":[1],"secure":[2,64],"software":[3,9,25,35,53,91,148,186],"is":[4],"a":[5,68,75,106,117,134,196],"recent":[6],"concern":[7],"for":[8,189],"engineers":[10],"due":[11],"to":[12,40,62,78,85,98,115,144,147,169,184],"increasing":[13],"incidences":[14],"of":[15,21,30,74,88,105,109,129,137],"data":[16],"breaches":[17],"and":[18,80,120,158,171],"other":[19],"types":[20],"cyber":[22],"attacks.":[23],"However,":[24],"security,":[26],"through":[27],"the":[28,34,44,58,72,82,86,103,145,163,175],"introduction":[29],"specialized":[31],"practices":[32],"in":[33,43,71,90,133,202],"development":[36,45,92,190],"life":[37],"cycle,":[38],"leads":[39],"an":[41],"increase":[42],"cost.":[46],"Although":[47],"there":[48],"are":[49],"many":[50],"studies":[51],"on":[52],"cost":[54,150],"models,":[55],"few":[56],"address":[57],"additional":[59],"costs":[60,188],"required":[61],"build":[63],"software.":[65],"We":[66,179],"conducted":[67],"systematic":[69],"review":[70],"form":[73],"mapping":[76],"study":[77],"classify":[79],"analyze":[81],"literature":[83],"related":[84,168],"impact":[87],"security":[89,149,187],"costs.":[93],"Our":[94],"search":[95,118],"strategy":[96],"strove":[97],"achieve":[99],"high":[100],"completeness":[101],"by":[102],"identification":[104],"quasi-gold-standard":[107],"set":[108,136],"papers,":[110,139],"which":[111,140,198],"we":[112],"then":[113],"used":[114],"establish":[116],"string":[119],"retrieve":[121],"papers":[122],"from":[123],"research":[124],"databases":[125],"automatically.":[126],"The":[127],"application":[128],"inclusion/exclusion":[130],"criteria":[131],"resulted":[132],"final":[135],"54":[138],"were":[141,162],"categorized":[142],"according":[143],"approach":[146],"analysis.":[151],"Perform":[152,159],"Security":[153,160],"Review,":[154],"Apply":[155],"Threat":[156],"Modeling,":[157],"Testing":[161],"three":[164],"most":[165,176],"frequent":[166],"activities":[167],"cost,":[170],"Common":[172],"Criteria":[173],"was":[174],"applied":[177],"standard.":[178],"also":[180],"identified":[181],"ten":[182],"approaches":[183],"estimating":[185],"projects;":[191],"however,":[192],"their":[193],"validation":[194],"remains":[195],"challenge,":[197],"could":[199],"be":[200],"addressed":[201],"future":[203],"studies.":[204]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":3},{"year":2022,"cited_by_count":5},{"year":2021,"cited_by_count":3},{"year":2020,"cited_by_count":3}],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-10T00:00:00"}