Determining how much software assurance is enough? A value-based approach | IEEE Conference Publication | IEEE Xplore