8.16 Software Security Metrics
How much security is enough? At present, there appears to be no way to answer
that question. Most software security guidance is either excessively pragmatic
(do only just enough to get by) or excessively rigorous (do it all, or you’ll still