In the former case, the attacker may directly attack the software that is his
or her ultimate target, or may attack something contiguous to that software—
either a component of the software’s execution environment, or of an external
system that interoperates with the targeted software.