Introduction to identity management risk metrics. - Gunnar Peterson (IEEE Secur. Priv., 2006)

Defining Misuse within the Development Process. - Gunnar Peterson; John Steven (IEEE Secur. Priv., 2006)

A Metrics Framework to Drive Application Security Improvement. - Elizabeth A. Nichols; Gunnar Peterson (IEEE Secur. Priv., 2007)

Metricon 2.0. - John Steven; Gunnar Peterson (IEEE Secur. Priv., 2007)

The economics of finding and fixing vulnerabilities in distributed systems. - Gunnar Peterson (QoP, 2008)

Logging in the Age of Web Services. - Anton Chuvakin; Gunnar Peterson (IEEE Secur. Priv., 2009)

Service-Oriented Security Indications for Use. - Gunnar Peterson (IEEE Secur. Priv., 2009)

Software Assumptions Lead to Preventable Errors. - Andy Steingruebl; Gunnar Peterson (IEEE Secur. Priv., 2009)

How to Do Application Logging Right. - Anton Chuvakin; Gunnar Peterson (IEEE Secur. Priv., 2010)

10 Quick, Dirty, and Cheap Things to Improve Enterprise Security. - James McGovern; Gunnar Peterson (IEEE Secur. Priv., 2010)

Don't Trust. And Verify: A Security Architecture Stack for the Cloud. - Gunnar Peterson (IEEE Secur. Priv., 2010)

From auditor-centric to architecture-centric: SDLC for PCI DSS. - Gunnar Peterson (Inf. Secur. Tech. Rep., 2010)

Directions in Incident Detection and Response. - Richard Bejtlich; John Steven; Gunnar Peterson (IEEE Secur. Priv., 2011)

Margin of Safety or Speculation? Measuring Security Book Value. - Dan Geer; Gunnar Peterson (login Usenix Mag., 2014)