common practice of postponing security analyses and tests until after the
software has been implemented and integrated, and even until after it has been
deployed (i.e., during its acceptance phase), makes it extremely difficult to
address in a cost-effective, timely manner any vulnerabilities and weaknesses