Obviously work in progress, but one important thing is missing here, IMO: "Make the right user behavior is the easiest for them." If you want users do somethi

Obviously work in progress, but one important thing is missing here, IMO: "Make the right user behavior is the easiest for them." If you want users do something, make it the easiest course of action for them and so that they have to go out of their way to do something else (that you don't want them to be doing). If there exists a convenient shortcut the users will be using it even if it has adverse security implications. For example, if you want them to be using SSL when connecting to your product, make that your client uses SSL by default and you need to specify additional option to do something else. In Linux kernel world, in the old times it took effort to be constantly updating the kernel. Now it is the opposite -- it does not take effort to keep it up to date and actually requires action to stay at a particular version. Now I understand to a large extent this is thanks to work done by distros, but this would not be possible without stability of APIs and drivers.