u Nonreliance on security standards results in unnecessary custom
solutions that are usually limited in effectiveness because of the
inadequate security expertise of the developers.
In later work, [185] Haley describes a security requirements framework that