In October 2006, the Second ACM Workshop on Quality of Protection
was held in Alexandria, Virginia; it included a session devoted to software
security metrics during which other research into software security metrics was
presented. In June 2007, the third Workshop on Assurance Cases for Security