A new, evidence-based, theory for knowledge reuse in security risk analysis

Katsiaryna Labunets, Fabio Massacci, Federica Paci, Katja Tuma*

*Corresponding author for this work

Research output: Contribution to journalArticleAcademicpeer-review


Security risk analysis (SRA) is a key activity in software engineering but requires heavy manual effort. Community knowledge in the form of security patterns or security catalogs can be used to support the identification of threats and security controls. However, no evidence-based theory exists about the effectiveness of security catalogs when used for security risk analysis. We adopt a grounded theory approach to propose a conceptual, revised and refined theory of SRA knowledge reuse. The theory refinement is backed by evidence gathered from conducting interviews with experts (20) and controlled experiments with both experts (15) and novice analysts (18). We conclude the paper by providing insights into the use of catalogs and managerial implications.

Original languageEnglish
Article number90
JournalEmpirical Software Engineering
Issue number4
Publication statusPublished - Jul 2023


  • Empirical study
  • Information security
  • Knowledge reuse
  • Risk assessment


Dive into the research topics of 'A new, evidence-based, theory for knowledge reuse in security risk analysis'. Together they form a unique fingerprint.

Cite this