Practical Core Software Security. A Reference Framework