[candiodari]

You could also point out that it mostly consists of not giving untrusted users access to internal stuff, like webapps would.