>list of norms involving software security These norms are already well-known. However they are never followed 100% because they all rest upon a sandy foundati

>list of norms involving software security These norms are already well-known. However they are never followed 100% because they all rest upon a sandy foundation of: "Don't be clueless." Social engineering/phishing will always eventually work on someone somewhere in a company with more than 20 employees. Not to mention the other part, where passwords are allowed to be a vital link in the security chain, yet software vendors like Citrix simultaneously discourage password managers by getting in the way of using them and by forcing perfectly good passwords to be cycled endlessly. Resulting in people using passwords like Citrix20! (will change to Citrix21! in 90 days... iron clad security there guys.)