[Anderson 97]

Anderson, R. H.; Hearn, A. C.; & Hundley, R. O. RAND Studies of Cyberspace Security Issues and the Concept of a U.S. Minimum Essential Information Infrastructure. http://www.cert.org/research/isw97_hypertext/all_the_papers/no1.html (1997).

[Bass 98]

Bass, L.; Clements, P.; & Kazman, R. Software Architecture in Practice. Reading, Mass.: Addison Wesley Longman, 1998.

[Birman 96]

Birman, Kenneth P. Building Secure and Reliable Network Application. Greenwich, Connecticut: Manning, 1996.

[Clark 93]

Clark, R. K.; Greenberg, I. B.; Boucher, P. K.; Lund, T. F.; Neumann, P. G.; Wells, D. M.; & Jenson, E. D. "Effects of Multilevel Security on Real-Time Applications," 120-129. Proceedings of Ninth Annual Computer Security Applications. Orlando, Florida, December 6-10, 1993. Los Alamitos, Ca.: IEEE Computer Society Press, 1993.

[Ebert 97]

Ebert, C. "Dealing with Nonfunctional Requirements in Large Software Systems." Annals of Software Engineering 3 (September 1997): 367-395.

[Halpern 84]

Halpern, J. & Moses, Y. "Knowledge and Common Knowledge in a Distributed Environment," 50-61. Proceedings of the Third Annual ACM Symposium on Principles of Distributed Computing. Vancouver, British Columbia, Canada, August 27, 1984. New York, N.Y.: Association for Computing Engineers (ACM), 1984.

[Kazman 96]

Kazman, R.; Abowd, G.; Bass, L.; & Clements, P. "Scenario-Based Analysis of Software Architecture." IEEE Software 13, 6 (November 1996): 47-55.

[Kazman 97]

Kazman, R.; Klein, M.; Barbacci, M.; Longstaff, T.; Lipson, H.; & Carriere, J. The Architecture Tradeoff Analysis Method. http://www.sei.cmu.edu/technology/product_line_systems/ata_method.html (1997).

[Leveson 95]

Leveson, N. G. Safeware: System Safety and Computers, New York, New York: Addison-Wesley, 1995.

[Linger 97]

Linger, R.; Mead, N.; Lipson, H. Requirements Definition for Survivable Network Systems. http://www.cert.org/research (1997).

[Linger 98]

Linger, R. Systematic Generation of Stochastic Diversity in Survivable System Software. http://www.cert.org/research (1998)

[Lipson 97]

Lipson, H. & Longstaff, T. Information Survivability Workshop. http://www.cert.org/research/isw97_hypertext/front_page.html (1997).

[Mendiratta 96]

Mendiratta, V. "Assessing the Reliability Impacts of Software Fault-Tolerance Mechanisms," 99-103. Proceedings of the Seventh International Symposium on Software Reliability Engineering. White Plains, N.Y., October 30 to November 2, 1996. Los Alamitos, Ca.: IEEE Computer Society Press, 1996.

[Mills 92]

Mills, H. D. "Certifying the Correctness of Software," vol 2, 373-381. Proceedings of 25^th Hawaii International Conference on System Sciences. Kauai, Hawaii, January 7-10, 1992. Los Alamitos, Ca.: IEEE Computer Society Press, 1992.

[Musa 87]

Musa, J.; Iannino, A.; & Okumoto, K. Software Reliability: Measurement, Prediction, and Application. New York, N.Y.: McGraw-Hill, 1987.

[Saltzer 84]

Saltzer, J. H.; Reed, D. P.; & Clark, D. D. "End-to-End Arguments in System Design." ACM Transactions on Computer Systems 2, 4 (November 1984): 277-288.

[Trammell 95]

Trammell, C. "Quantifying the Reliability of Software: Statistical Testing Based on a Usage Model," 208-218. Proceedings of the Second IEEE International Symposium on Software Engineering Standards. Montreal, Quebec, Canada, August 21-25, 1995. Los Alamitos, Ca.: IEEE Computer Society Press, 1995.