Practical Core Software Security: A Reference Framework