On engineering secure software for cyber-physical systems in practice