What is at stake? Is this a finance app? Is it keeping track of people's dog sitting appointments? The money/time involved in the application should drive the

What is at stake? Is this a finance app? Is it keeping track of people's dog sitting appointments? The money/time involved in the application should drive the security measures. No need to put a padlock on your bag lunch. And don't keep $10,000 in your wallet. Another thing, try to balance actual cost with potential cost. Somewhere around 10:1 is a good place to start. Think insurance actuary tables. Are you constantly being attacked? Are your user accounts worth millions? Would a break-in reach international news?