@article{feather04,
        title = {Quantitative risk-based requirements reasoning},
        author = {Martin S. Feather and Steven Cornford},
        editor = {J. Mylopoulos and P. Lycopoulos},
        journal = {Requirements Engineering},
        month = {November},
        number = 4,
        pages = {248-265},
        volume = 8,
        year = 2003,
        url = {http://dx.doi.org/10.1007/s00766-002-0160-y},
        description = {SpringerLink - Journal Article},
	abstract = {At NASA we have been developing and applying a risk management framework, "Defect Detection and Prevention"(DDP). It is based on a simple quantitative model of risk and is supported by custom software. We have used it to aid in study and planning for systems that employ advanced technologies. The framework has proven successful at identifying problematic requirements(those which will be the most difficult to attain), at optimizing the allocation of resources so as to maximize requirements attainment, at identifying areas where research investments should be made, and at supporting tradeoff analyses among major alternatives. We describe the DDP model, the information that populates a model, how DDP is used, and its tool support. DDP has been designed to aid decision making early in development. Detailed information is lacking at this early stage. Accordingly, DDP exhibits a number of strategic compromises between fidelity and tractability. The net result is an approach that appears both feasible and useful during early requirements decision making.},
	biburl = {http://www.bibsonomy.org/bibtex/233d2d1cee731505d5eadb164a9247a40/neilernst},
	keywords = {Information visualization Risk Decision Tradeoffs Cost–benefit should-read Requirements}
}

@inproceedings{asnar06,
        title = {Modelling Risk and Identifying Countermeasure in Organizations},
        address = {Samos, Greece},
        author = {Yudistira Asnar and Paolo Giorgini},
        journal = {First International Workshop on Critical Information Infrastructures Security},
        month = {August},
        note = {LNCS 4347},
        pages = {55--66},
        year = 2006,
        day = {31--1},
        url = {http://dx.doi.org/10.1007/11962977_5},
        abstract = {Modelling and analysing risk is one of the most critical activity
in system engineering. However, in literature approaches like Fault
Tree Analysis, Event Tree Analysis, Failure Modes and Criticality Analysis
focus on the system-to-be without considering the impact of the
associated risks to the organization where the system will operate. The
Tropos framework has been proved effective in modelling strategic interests
of the stakeholders at organizational level. In this paper, we introduce
the extended Tropos goal model to analyse risk at organization
level and we illustrate a number of different techniques to help the analyst
in identifying and enumerating relevant countermeasures for risk
mitigation.},
	biburl = {http://www.bibsonomy.org/bibtex/2bafd61566bfe1160bfc7a0b848c4e4d0/neilernst},
	keywords = {risk should-read goal}
}

@inproceedings{rosenberg99,
        title = {Continuous Risk Management at NASA},
        address = {San Jose, California},
        author = {Linda H. Rosenberg and Theodore Hammer and Albert Gallo},
        booktitle = {Applied Software Measurement / Software Management Conference},
        month = {February},
        year = 1999,
        description = {Continuous Risk Management at NASA},
	abstract = {NPG 7120.5A, "NASA Program and Project Management Processes and Requirements" enacted in April, 1998, requires that "The program or project manager shall apply risk management principles…" The Software Assurance Technology Center (SATC) at NASA GSFC has been tasked with the responsibility for developing and teaching a systems level course for risk management that provides information on how to comply with this edict. This risk management structure of functions has been taught to projects at all NASA Centers and is being successfully implemented on many projects. The course was developed in conjunction with the Software Engineering Institute at Carnegie Mellon University, then tailored to the NASA systems community. This presentation will briefly discuss the six functions for risk management: (1) Identify the risks in a specific format; (2) Analyze the risk probability, impact/severity, and timeframe; (3) Plan the approach; (4) Track the risk through data compilation and analysis; (5) Control and monitor the risk; (6) Communicate and document the process and decisions.

Finally, the presentation will give project managers the information needed to implement Continuous Risk Management successfully at a cost they can afford.},
	biburl = {http://www.bibsonomy.org/bibtex/2445ccc6b10e4aafdd22a6ded2b6b5f71/neilernst},
	keywords = {risk nasa}
}

@inproceedings{kiper05,
        title = {A Risk-Based Approach to Strategic Decision-Making for Software Development.},
        author = {James D. Kiper and Martin S. Feather},
        booktitle = {Hawaii International Conference on System Sciences},
        pages = 313,
        publisher = {IEEE Computer Society},
        year = 2005,
        url = {http://doi.ieeecomputersociety.org/10.1109/HICSS.2005.48},
        abstract = {In any software system development, the most important strategic decisions are, by definition, those made early in the lifecycle. However, these early lifecycle decisions are generally made in a data-starved environment. The best sources of data are those based on historical information (if the current project is sufficiently similar to past systems), and the judgments of domain experts. At NASA, we have been developing and applying a risk-based model to capture information from domain experts and to study and plan for systems that use advanced technology. Here we describe the "Defect Detection and Prevention" (DDP) model and software tool. This model and the custom built tool that implements it initially arose from needs in the hardware domain. However, current spacecraft systems are a complex combination of hardware and software. In this paper, we describe some initial work investigating the applicability of this model and tool to software components.},
	biburl = {http://www.bibsonomy.org/bibtex/2d2034ec7a5ef2b0077728440be31220e/neilernst},
	keywords = {risk management requirements}
}