Many organizations creating security-critical code, especially those in the electronic commerce arena, have reputations to protect. Banks, for example, are reluctant to talk about security problems for good reason-bank customers expect their bank to have excellent security. The same can be said of any organization that has essential information assets to protect. Strong security assurance practices can help. The main objective behind software assurance is making sure that software does what it is supposed to do.
Software assurance encompasses more than just security.
The most effective way to make sure your code behaves itself and does not introduce unnecessary risk is to practice sound software engineering. Following a reasonable development process is a good start. Develop a software assurance plan simultaneously, so that problems are identified and removed as early in the development life cycle as possible. The earlier you remove problems, the more money you save. Unfortunately, many software organizations creating software for the consumer market have poor software development practices.