later in this summary, efforts have focused on developing software-specific
risk management methodologies and tools. Most existing risk management
techniques are not easily adaptable to software security, and system security
risk management is limited by focusing on operational risks.