Security By Design Decision
Sarah Fluchs opens with a key question - what are you going to spend your security budget on? And she makes the case that security design decisions, building systems that are defensible, deserve more attention and resources.
Sarah then describes four security engineering simplifiers. Items that can help engineers build systems that are defensible without the need to become security experts.
Lots of gems in this, such as "management should decide what high consequence events should focus on".