Security is a measurement, not a characteristic Every application is insecure Security is a balance of risk and usability Make things easy for the good guys, hard for the bad Perform code reviews Know everything about your application