Observation: security really does happen in low-level code quality like this. This is a hard notion to accept because it has to be built into the organization.

Observation: security really does happen in low-level code quality like this. This is a hard notion to accept because it has to be built into the organization. No silver bullet, no consultant, no five-step methodology. Just rigorous software engineering up and down the stack, and care, and attention to detail.