When a software system will be required to manage confidential information, the security protection mechanisms...

Security mechanisms for confidential information should be designed using risk-based protection. A practical security objective is to make the cost, effort, time, and risk of penetrating the system greater than the expected value of the information gained. This does not mean the system is impossible to attack; rather, controls should be strong enough to make compromise unattractive or impractical for likely threats. Password rules, non-sharing policies, and access restrictions can be useful controls, but each is too narrow to describe the overall design principle. Annual password changes alone may not provide adequate protection, and locking out non-administrators after hours may not fit all operational needs. The best general security design principle is economic deterrence through adequate protection.

================