Baking Security into Software