Now, painful as it seems, lessons learned are very valuable. Making mistakes, of course, we hope for in the test environment with the ability to fix them before harm is caused through the production world. We find then, that few things teach us as well as experience, painful, though it might be. Ideally, failures and mistakes, as I said, should occur in the lab and during testing so that they don't occur in production. But this, of course, is not always realistic. There may be too many variables, too many varying conditions to reproduce all of them or even most of them.

Now there is an old saying, a cat can be caught in any trap once. And what that really refers to is that making mistakes is generally unavoidable. It is the repetition of the same mistake that leads to security issues, legal troubles, loss of business, and reputation. And once it is learned what that trap the cat was caught in, is like, and how it functions, it should be relatively straightforward to avoid it in the future. This leads to the conclusion that the cycle must change from repetitive remediation, which produces all of the above consequences, to evolving improvement, which produces improved software quality, reliability, performance, and a fuller integration of security with the program goals and operations, again, on balance, as it should be with performance.

So this is the end of section two. We'll stop here, and then we'll pick up and move into our third and final section of domain four, entitled Secure Coding Operations.