Art of Software Security Assessment, The door John McDonald & Mark Dowd