Replication Package: Security Risk Management for Configurable Software Systems: A Critical Reflection

Welcome to the public repository for the additional content of the paper "Security Risk Management for Configurable Software Systems: A Critical Reflection", submitted at the SPLC 2023.

This repository provides additional information to the conducted systematic literature review, including the following files:

• fetched_results_SPLC2023.csv: sheet containing all papers fetched from IEEEXplore, Scopus, and the ACM Guide to Computing Literature.
• analysis_sheet_SPLC2023.csv: sheet containing information regarding the analysis results of 50 included papers based on the extraction criteria.

1. We defined the following selection criteria:
   1. The paper is written in English.
   2. The paper has been published between 2013 and 2022.
   3. The paper is a peer-reviewed conference paper or journal articles, or book chapters (e.g., excluding books, posters).
   4. The paper hast at least four pages.
   5. The paper focuses on security-related risk management of configurable systems based on product-line engineering.
2. We searched in IEEEXplore (22 papers), Scopus (54 papers), and the ACM Guide to Computing Literature (582 papers). The fetched papers are listed in fetched_results_SPLC2023.csv. The following search string was applied on March 15, 2023: ("security") AND ("risk" OR "threat" OR "test*" OR "model*" OR "management" OR "assess*" OR "evaluat*") AND ("software product line")
3. We removed 39 duplicates.
4. After title (198 papers), abstract (51 papers), and full-text (37 papers) selection, we employed two iterations of backwards and forwards snowballing, resulting in 50 paper for full-text analysis.
5. An analysis sheet was created (analysis_sheet_SPLC2023.csv) containing all extraction criteria.