Software Security in Practice