mitigating risk with short-term, issue-specific application security approaches.
He also recommends considering software security and information security
risks in tandem, rather than separately.
Morana outlines a set of risk management activities that map directly to