Default setting designed to minimize risk.

Access determined by user roles.

Process for handling security incidents.

Vulnerability caused by interpreted input.

Behavior that defaults to a safe state.

Access determined by attributes and policies.

Weakness that can be exploited.

Injection targeting SQL queries.

Multiple layers of security controls.

Component supplying authentication credentials.