Follow security best practices

Depend on the number of sources researched

Not depend on the technology of the application

Address as few threat types as possible