To date, the approach to preventing software’s susceptibility to attack has
started with the understanding of the various types of sources of threats to that
software, how those threats manifest as attacks, and the nature and exposure
of vulnerabilities and weaknesses that are typically targeted by those attacks.