4. Include security in the software lifecycle. This means something at Microsoft (security is a gating step at design, at implementation, and in testing), but d

4. Include security in the software lifecycle. This means something at Microsoft (security is a gating step at design, at implementation, and in testing), but doesn't mean something for a team that has gotten a minimum viable social network out the door with little to no testing. You might as well ask them not to be a startup. I'd agree with this. From my experience, the most effective part of Microsoft's security practice is that we had dedicated developers whose only job is to evaluate the security of proposed changesets. This doesn't really help a startup that doesn't even have a product yet and only a handful of developers.