How Well Do You Know Your Personae Non Gratae?

in many cases people perform only a cursory security analysis and produce rather generic security requirements. But is this the right way to build secure software? Are security requirements so similar across projects that we simply don’t need to invest the time to explore product-level needs or to document requirements at an individual level for each project? Can we instead rely on business-asusual, organizational security practices implemented at the networking and programming levels?