software engineers who build those components. The result is that several
security threats, vulnerabilities, and countermeasures that are unique to
software components and best understood by software developers are not
reflected in the system risk assessment. The result is, at best, an inaccurate