[hoodoof]

Sorry I should have asked for specific ideas rather than references to OWASP which seems to be "the answer to all security architecture questions".