“Start with the basics, make sure you have a security response process, and that you are capable of dealing with discovered vulnerabilities in the software you ship.”

Transcript evidence from Steve Lipner — The Past, Present, and Future of SDL.