The security of information systems has not enhanced at a rate consistent with the growth & sophistication of the attacks being made. This work helps build security in from the start, rather than append it as an afterthought. It shows software developers how to build high-quality systems that are less vulnerable to even a catastrophic attack.