Security in Computing, 4th Edition

Basic works on risk analysis are Rook's tutorial [ROO93] and the paper by Fairley and Rook [FAI97].

Two good resources on administering security are Fites [FIT89] and Wood [WOO87b].

For a discussion of the cautions of using risk analysis on software projects, see [PFL00]. This issue of the Journal of Systems and Software is a special issue on risk management for software engineering.