overflows,” is both negative and non-actionable, but is necessary for software to be
secure. It would therefore need to be expressed as requirements forfunctionality
that prevents buffer overflows from happening, i.e., validation of input, good
memory allocation and management, exception handling functionality, etc.