Abstract
For general applications, it is way too costly to aim for 100 % secure software; for complex systems it may even be impossible. To achieve effective software security at reasonable cost, it is thus necessary to identify which parts of the software are more critical regarding security, and determine which activities will be most efficient and effective in securing the software product.