Vendor Email Compromise is a specific variant of BEC in which an attacker compromises a legitimate vendor's or supplier's actual email account, then uses that trusted, authentic account to send fraudulent invoices, payment details, or payment change requests to the vendor's real customers, making the fraud particularly convincing since it originates from a genuinely compromised, previously trusted business relationship rather than a spoofed address.

The goal of software assurance in application development is to prevent the creation of vulnerable applications. Software assurance is the process of ensuring that the software is designed, developed, and maintained in a secure, reliable, and trustworthy manner. Software assurance involves applying security principles, standards, and best practices throughout the software development life cycle, such as security requirements, design, coding, testing, deployment, and maintenance. Software assurance aims to prevent or reduce the introduction of vulnerabilities, defects, or errors in the software that could compromise its security, functionality, or quality.

From a security perspective, input to an application must always be considered untrusted. This assumption is crucial because malicious actors can attempt to manipulate or craft input in ways that exploit vulnerabilities in the application. Treating all input as untrusted helps to ensure that proper security controls-such as input validation, sanitization, and verification-are in place to prevent attacks like SQL injection, cross-site scripting (XSS), buffer overflows, or other forms of input-based exploitation.

Public Key Infrastructure (PKI) is a system that provides the services and mechanisms for creating, managing, distributing, using, storing, and revoking digital certificates and public keys.
Digital signatures are a type of electronic signature that use public key cryptography to verify the authenticity and integrity of a message or document. A health care provider that is considering Internet access for their employees and patients should use PKI and digital signatures as the most secure solution for protection of data, because they provide confidentiality, integrity, authentication, non-repudiation, and accountability for the data exchanged over the Internet.

The action that must be taken if a vulnerability is discovered during the maintenance stage in a SDLC is to make changes following principle and design guidelines. Principle and design guidelines are the rules and standards that define the security objectives, requirements, and specifications of the system. They also provide the criteria and methods for evaluating and testing the security of the system. By making changes following principle and design guidelines, the organization can ensure that the vulnerability is fixed in a secure and consistent manner, and that the system maintains its functionality and quality.