has, in fact, involved investigating already-defined information security and
software quality and reliability metrics, to determine whether any of these can
be applied to the problem of measuring software security assurance (and, if so,
which metrics). This is the approach of the DHS Software Assurance Program’s