support, and technical effectiveness—which are usually the driving factors
organizations use when deciding which approach to take. Most development
organizations do not consider security assurance to be a driving factor; security
is often seen as something to be considered only as the application is being