<back>
<ref-list>
<title>References</title>
<ref id="ref_1"><label>1</label><mixed-citation publication-type="confproc"><string-name><surname>Acar</surname> <given-names>Y</given-names></string-name>, <string-name><surname>Backes</surname> <given-names>M</given-names></string-name>, <string-name><surname>Fahl</surname> <given-names>S</given-names></string-name>, <string-name><surname>Kim</surname> <given-names>D</given-names></string-name>, <string-name><surname>Mazurek</surname> <given-names>ML</given-names></string-name>, <string-name><surname>Stransky</surname> <given-names>C</given-names></string-name> (<year>2016</year>) <article-title>You get where you’re looking for: The impact of information sources on code security.</article-title> <source>Proceedings of the 37th IEEE Symposium on Security and Privacy</source>, pp <fpage>289</fpage>–<lpage>305</lpage>.</mixed-citation></ref>
<ref id="ref_2"><label>2</label><mixed-citation publication-type="confproc"><string-name><surname>Duong</surname> <given-names>T</given-names></string-name>, <string-name><surname>Rizzo</surname> <given-names>J</given-names></string-name> (<year>2011</year>) <article-title>Cryptography in the web: The case of cryptographic design flaws in ASP.NET.</article-title> <source>Proceedings of the 31st IEEE Symposium on Security and Privacy</source>, pp <fpage>481</fpage>–<lpage>489</lpage>.</mixed-citation></ref>
<ref id="ref_3"><label>3</label><mixed-citation publication-type="confproc"><string-name><surname>Egele</surname> <given-names>M</given-names></string-name>, <string-name><surname>Brumley</surname> <given-names>D</given-names></string-name>, <string-name><surname>Fratantonio</surname> <given-names>Y</given-names></string-name>, <string-name><surname>Kruegel</surname> <given-names>C</given-names></string-name> (<year>2013</year>) <article-title>An empirical study of cryptographic misuse in Android applications.</article-title> <source>Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security (CCS ’13)</source>, pp <fpage>73</fpage>–<lpage>84</lpage>.</mixed-citation></ref>
<ref id="ref_4"><label>4</label><mixed-citation publication-type="confproc"><string-name><surname>Fahl</surname> <given-names>S</given-names></string-name>, <string-name><surname>Harbach</surname> <given-names>M</given-names></string-name>, <string-name><surname>Muders</surname> <given-names>T</given-names></string-name>, <string-name><surname>Baumgartner</surname> <given-names>L</given-names></string-name>, <string-name><surname>Freisleben</surname> <given-names>B</given-names></string-name>, <string-name><surname>Smith</surname>, <given-names>M</given-names></string-name> (<year>2012</year>) <article-title>Why Eve and Mallory love Android: An analysis of Android SSL (in)security.</article-title> <source>Proceedings of the 2012 ACM Conference on Computer and Communications Security (CCS ’12)</source>, pp <fpage>50</fpage>–<lpage>61</lpage>.</mixed-citation></ref>
<ref id="ref_5"><label>5</label><mixed-citation publication-type="confproc"><string-name><surname>Nadi</surname> <given-names>S</given-names></string-name>, <string-name><surname>Kruger</surname> <given-names>S</given-names></string-name>, <string-name><surname>Mezini</surname> <given-names>M</given-names></string-name>, <string-name><surname>Bodden</surname> <given-names>E</given-names></string-name> (<year>2016</year>) <article-title>Jumping through hoops: Why do Java developers struggle with cryptography APIs?</article-title> <source>Proceedings of the 38th International Conference on Software Engineering (ICSE ’16)</source>, pp <fpage>935</fpage>–<lpage>946</lpage>.</mixed-citation></ref>
<ref id="ref_6"><label>6</label><mixed-citation publication-type="confproc"><string-name><surname>Haney</surname> <given-names>JM</given-names></string-name>, <string-name><surname>Theofanos</surname> <given-names>MF</given-names></string-name>, <string-name><surname>Acar</surname> <given-names>Y</given-names></string-name>, <string-name><surname>Prettyman</surname> <given-names>SS</given-names></string-name> (<year>2018</year>) “<article-title>We make it a big deal in the company</article-title>”: Security mindsets in organizations that develop cryptographic products. <source>Proceedings of the 14<sup>th</sup> Symposium on Usable Privacy and Security</source>, pp <fpage>357</fpage>-<lpage>373</lpage>.</mixed-citation></ref>
<ref id="ref_7"><label>7</label><mixed-citation publication-type="web"><collab>National Institute of Standards and Technology</collab> (<year>2001</year>) <source>Security requirements for cryptographic modules</source>, Federal Information Processing Standard Publication 140-2, <ext-link ext-link-type="uri" xlink:href="http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf">http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf</ext-link> <comment>[accessed 8/1/2018]</comment></mixed-citation></ref>
</ref-list>
</back> |