Instruct: Identify the main and secondary category of Arxiv papers based on the titles and abstracts
Query: Finding Security Threats That Matter: An Industrial Case Study   Recent trends in the software engineering (i.e., Agile, DevOps) have
shortened the development life-cycle limiting resources spent on security
analysis of software designs. In this context, architecture models are (often
manually) analyzed for potential security threats. Risk-last threat analysis
suggests identifying all security threats before prioritizing them. In
contrast, risk-first threat analysis suggests identifying the risks before the
threats, by-passing threat prioritization. This seems promising for
organizations where developing speed is of great importance. Yet, little
empirical evidence exists about the effect of sacrificing systematicity for
high-priority threats on the performance and execution of threat analysis. To
this aim, we conduct a case study with industrial experts from the automotive
domain, where we empirically compare a risk-first technique to a risk-last
technique. In this study, we consciously trade the amount of participants for a
more realistic simulation of threat analysis sessions in practice. This allows
us to closely observe industrial experts and gain deep insights into the
industrial practice. This work contributes with: (i) a quantitative comparison
of performance, (ii) a quantitative and qualitative comparison of execution,
and (iii) a comparative discussion of the two techniques. We find no
differences in the productivity and timeliness of discovering high-priority
security threats. Yet, we find differences in analysis execution. In
particular, participants using the risk-first technique found twice as many
high-priority threats, developed detailed attack scenarios, and discussed
threat feasibility in detail. On the other hand, participants using the
risk-last technique found more medium and low-priority threats and finished
early.

21
The categories of this paper are: adap-org
18
The categories of this paper are: econ
25
The categories of this paper are: patt-sol
35
The categories of this paper are: mtrl-th
5
The categories of this paper are: gr-qc
23
The categories of this paper are: solv-int
30
The categories of this paper are: q-alg
15
The categories of this paper are: nucl-ex
20
The categories of this paper are: acc-phys
31
The categories of this paper are: ao-sci
6
The categories of this paper are: astro-ph
24
The categories of this paper are: dg-ga
19
The categories of this paper are: eess
37
The categories of this paper are: supr-con
33
The categories of this paper are: plasm-ph
9
The categories of this paper are: nlin