IT confidentiality risk assessment for an architecture-based approach. - Ayse Morali; Emmanuele Zambon; Sandro Etalle; Paul L. O. Re (BDIM, 2008)

Extended eTVRA vs. security checklist: Experiences in a value-web. - Ayse Morali; Emmanuele Zambon; Siv Hilde Houmb; Karin Sallhammar; Sandro Etalle (ICSE Companion, 2009)

CRAC: Confidentiality risk assessment and IT-infrastructure comparison. - Ayse Morali; Emmanuele Zambon; Sandro Etalle; Roel J. Wieringa (CNSM, 2010)

Risk-based Confidentiality Requirements Specification for Outsourced IT Systems. - Ayse Morali; Roel J. Wieringa (RE, 2010)

Risk and Business Goal Based Security Requirement and Countermeasure Prioritization. - Andrea Herrmann 001; Ayse Morali; Sandro Etalle; Roel J. Wieringa (BIR Workshops, 2011)

Technical Action Research as a Validation Method in Information Systems Design Science. - Roel J. Wieringa; Ayse Morali (DESRIST, 2012)