the likelihood and number of vulnerabilities the application will contain, these
practitioners are not directly concerned with the application’s development
life cycle. By contrast, software security requires security to be seen as a critical
property of the software itself—a property that is best assured if it is specified