Cybercrime, data leaks and information security get more attention than ever in the news. Governments and companies dedicate more and more resources to these areas. However, most of that attention appears to be focused on reactive measures (“How do we catch the cybercriminals?”) instead of on preventive measures (“How do we make our systems secure?”). Although it is hard to measure, research reports indicate that building security in is worth the investment. Key in the software building p...