Cite a lot

Your work will likely relate to or even incorporate the work of others. To ensure fairness and academic integrity, it is important to accurately attribute these sources through references and citations. This not only credits the original authors but also directs your readers to additional information and safeguards you against plagiarism accusations. Therefore, understanding how to reference others, quote directly, and provide access to further information is essential.

We recommend adopting a numeric citation style where each source is referenced by a number enclosed in square brackets. This approach is standard in computer science literature and tends to be less cluttered than citation styles that use author names, publication years, or footnotes. We adopt these rules from IEEE.

Note that you might come across other rules in literature.

Add citation of your sources

Employ citations whenever you discuss, summarize, or contextualize someone else’s work. Clearly indicate when you are referring to someone else’s work.

Bring the sources into context

Simply changing a few words, altering sentence structures, or linking phrases together does not suffice for proper citation!

Original¹:

It is well known that the security of a networked computer is only as strong as its weakest component.

Incorrect citation (lacks context, is merely a word substitution):

Note that a networked computer is only as secure as its weakest component [2].

Correct citation (references a primary souce, summarizes their findings):

Considering the five properties of security by Whitten et al. [2], our primary focus was on identifying the weakest security components.

Define the scope of your citations

The position of the citation is important, as it defines the citation’s scope. You usually cite the source after the respective word or sentence that contains or relates to someone else’s work. In case a single source is used throughout a whole paragraph, you can introduce the source in an introductory phrase and make clear that it applies to the whole paragraph, or you can also specify the citation at the very end of the paragraph after the punctuation.

Citation for a sentence (placed before the punctuation):

Case studies are an appropriate method for assessing security concepts [2].

Citation for a specific term or concept (placed before the punctuation):

Various study types are well-suited for evaluating security concepts, such as case studies [2], …

Citation for a whole paragraph (placed after the punctuation)²:

The DES, 3DES and AES ciphers are specified in the standard, in addition to the null cipher for cleartext. The standard also provides for the use of vendor-specific proprietary algorithms (such as 40 bit RC4 for radios aimed at the export market). [13]

Introductory phrase:

Whitten et al. [2] conducted a case study on the usability of PGP 5.0. They … (additional details about their study) …

Note that citations for paragraphs must apply to the entire paragraph. Do not use paragraph-wide citations if there are multiple sources in a paragraph. If citations only apply to a part, you must resort to word- or sentence-specific citations. Consequently, it is not sufficient to simply tack all citations from parts of the paragraph onto the end. The goal of citations is to make the origin of ideas clear, use appropriate ways of citation that make clear which statements can be attributed to which source.

Name the authors sparingly, do not name the titles of your sources

It is common to name the authors only when the primary source originates from them or when their name carries weight in the field. Otherwise, it is sufficient to refer to the source solely by the reference number.

When citing works with multiple authors, it’s common to name only the first author followed by “et al.”, which is a Latin abrreviation for “and others”.

It is very uncommon to name the titles of your sources within your text, except for your reference section, where it is very common.

Find multiple sources

By citing multiple sources, you enhance the credibility and reliability of your statement. It shows that you have done thorough research and that your fact is not based on a single source, which might be biased or incorrect. Instead, if several reputable sources agree on a fact, it is more likely to be accurate. On the other hand, if the sources contradict each other, you should refrain from stating this fact, or instead explicitely state is as controversial.

Different sources may present the same fact in different contexts or with different emphases. Furthermore, facts and interpretations can change over time as new research is conducted. For many information, there are primary sources that have been cited directly or indirectly by others. By consulting multiple sources, especially up-to-date ones, you can ensure that you state the current understanding of the topic.

Remember, it’s not just about finding multiple sources but about finding credible, relevant, and up-to-date sources that adequately support your thesis.

You can choose, whether you put multiple reference numbers in one pair of square brackets or in multiple ones, but stick to one method:

Case studies are an appropriate method for assessing security concepts [2] [4] [16].

Case studies are an appropriate method for assessing security concepts [2, 4, 16].

Cite at the first occurence

Every time you take or reference something from another work, you need to cite this work. Do this always the first time you talk about this content. If you later-on mention the same thing again, you can but you don’t need to cite again. (Note that you will still need to cite the same work for each thing at least once.) In your related work chapter you might need to repeat.

Example:

Case studies are an appropriate method for assessing security concepts [2 [4] [16]. … Considering the five properties of security by Whitten et al. [2], our primary focus was on identifying the weakest security components. … We conduct a case study [2] that …

Here, the work by Whitten et al. is cited for two things: case studies and the properties of security. Hence, the first two references are required. From now on, you can assume that the reader will know that these informations are adopted from this source. Whereas, the last sentence references the same thing as the first one, therefore it does not give any new information and hence a repeated citation is not necessary here.

Figure sources

If you provide figures created by someone else, you need to reference the original work in the caption.

The same applies, if you do not copy the original figure, but adopt content, snippets, layouts or designs.

References for further reading

Also use references when mentioning others’ work that you wish to acknowledge but did not directly cite as a source, such as a repository for a tool you utilized. These references are not mandatory, thus more flexible in formatting. You can decide whether to mention them in-line, enclosed in square brackets as seen earlier, or as a footnote, based on your preference and the flow of your text.

Quotations

Use quotations whenever you want to repeat the exact wording of someone else. This can be, for example, a famous quote, some common saying, a definition or an answer in an interview. In all these cases, you mark the quote with quotation marks and name the authors. In case of a study, use the participants’ identifiers.

S1 noted: “Task A was easier than task B,” contrary to: “Task B was the easiest” (S4, S6).

For longer quotes, you can optionally use block quotes.

“It is well known that the security of a networked computer is only as strong as its weakest component.”

(Whitten et al. [2])

Quality of your sources

Ensure that your most relevant sources are of high quality. Therefore, you should check whether these sources come from reputable authors, have been published at leading conferences or the like, or have had a notable impact on the research field. Indicators of this include:

• the content of the source; does it look legit?; Is the methodology sound?; Does it cite other relevant work?
• the publication venue is peer reviewed,
• the conference has a high rating,
• the work has been frequently referenced, or
• other works by the authors have been frequently cited.

Note that these indicators and not requirements. For example, SOUPS is of high quality but has only a B1 ranking according to Qualis.

In this context, it’s important to know that, unfortunately, many conferences exist that will publish anything as long as the authors pay for it.

Whenever possible, you should prefer using scientific sources, e.g., from peer-reviewed conferences or journals. However, not all of your information will come from conferences or journals. You can also use internet sources (including Wikipedia) and other theses, provided you verify their statements. If you use important statements from these sources, you can look for other sources to legitimize these statements. As described above, in this case, you cite multiple sources.

Internet or other non-peer-reviewed sources can directly be used to illustrate current phenomena, e.g. for introductory statements like:

Recently, ransomware attacks have hit hospitals [1], educational institutions [2] and governmental bodies [3] in Germany.

[1] news article, [2] university website, [3] news article

However, for important main points in your report, you should look for more reputable sources.

Bibliography

The bibliography enumerates the details of all your references, such that your readers can easily identify and find the respective source. Depending on the source type, it states the authors, full title, publication year and location, the URL, etc.

---

1. Example taken from Whitten et al.: Why Johnny Can’t Encrypt: A Usability Evaluation of PGP 5. ↩︎

2. Example taken from Clark et al.: Why (Special Agent) Johnny (Still) Can’t Encrypt: A Security Analysis of the APCO Project 25 Two-Way Radio System. ↩︎