The overall challenge in building more resilient applications that are better equipped to protect against threats is a decision that must address exposure coupled with risk. The general consensus is that no system can be 100% protected and that this requires important decisions when analysts are designing applications and systems. Indeed, security access is not just limited to getting into the system, rather on the individual application level as well. How then do analysts participate in the process of designing secure applications through good design? We know that many cybersecurity architectures are designed from the office of the chief information security officer or CISO, a new and emerging role in organizations. The CISO role, often independent of the CIO (chief information officer) became significant as a result of the early threats from the internet, the 9/11 attacks and most recently the abundant number of system compromises experienced by companies such as JP Morgan Chase, SONY, Home Depot and Target to name just a few.