3) Use of crude fuzzers and defenses for most vulns
4) Defense in depth; secure design that minimizes risk; independent review
Access Constraints. This considers what privileges or restrictions are needed for the
vulnerability to be exploited. The developer might be expected to take extra precautions