Assessing Internal Software Information Security