The talk will describe several of the security techniques that do not get a lot of publicity, but been found quite effective within our organization. Some of the techniques are quite simple, such as providing developers with a checklist, and asking the right questions to determine where to focus efforts. Together, they enable a rational process of security management within a large heterogeneous environment.