These are the things that keep most security people up at night. People are very smart and if there is a way to get around security they will, so what can we do? Start baking! No, not the food type of baking…the kind of baking that happens when a new product, service, application or system is added your organization. By including security and DR/BCP into the SDLC and Change Management process these types of things can be evaluated before they are released into production thus reducing risk. How does this work? If the company requires a security evaluation checklist and sign-off process early on in the SDLC then these security requirements and default settings are brought to light. At this point the company can either choose to move ahead with the product or scrap it. If the company moves ahead and requires security sign-off along the way then the company has a much better chance of having default settings still resident. The complete cycle would include a security or risk evaluation before and after release into production. Finally, don’t forget End User Testing since this is where you can discover areas in which a user might side step security.