What are the benefits of developing security assurance by focusing on the deliverable’s development environment versus its deployment environment?