Deriving security requirements from crosscutting threat descriptions