u Avoid design and implementation problems that would make the
software vulnerable to specific attack patterns
u Include attack pattern-based criteria and checks in design and
code reviews, security tests, and post-deployment vulnerability