code—so the practices currently employed may need to be modified slightly
to provide adequate protection from both threats. Also, ACM, CSIS, and the
US Government agree that existing software certification mechanisms are
inadequate to assure software security.