there are many #security experts on the Internet, writing blogs, giving talks, all telling pretty obvious things, but none of them mentions anything of this, for example

https://en.wikibooks.org/wiki/Security_Architecture_and_Design/Security_Models