You'll probably know the story of the three little pigs and the big bad wolf (maybe just the Disney version, but the story is basically the same). The three pigs want to build a house in the woods to live in. In some versions of the story they are warned of the big bad wolf that's living in the woods. The first pig builds a house of straw, the second builds a house of wood and the third pig builds a house of stone. Of course the wolf comes and easily destroys the house made of straw (by huffing and puffing). Then the wolf destroys the wooden house, but the wolf is unable to break down the stone house. Eventually the wolf tries to enter through the chimney, but fails because the pig has lit a fire in the fireplace. Obviously there are some morals in this story. And at least one of them has to do with security. Let's look at the three houses build by the pigs, these houses symbolise the way we handle security in software development projects.

Straw house
The straw house is quick and easy to build and provides enough functionality. Requirements are met: you can live in it and the house provides shelter and isolation. Projects almost always seem to be under pressure. There is no time, no budget and the software must be able to do everything. Of course this is an exaggeration. If IT-specialists on the project have no knowledge of what security entails there will be no secure foundation and the choice of building materials will not be the right one for every situations. There is complete ignorance of the big bad wolf (until it shows up of course).

Wooden house
The wooden house is a project with IT-specialists that have some idea of security. They know there is a big bad wolf and that there is a probability that the wolf will pay a visit. But, there is no fundamental knowledge of what security entails. This means that some measures will be taken: wood is a firm building material. But the software doens't have a good fundamental secure base. Even though there is input validation and other measures, security as a way of thinking and testing isn't fundamentally understood, so the right principles aren't in place to provide a good foundation.

Brick house
Yes... this project will take up more time. It will need more skill: a foundation is needed and the bricks need cement. But after these building principles are applied the house will be solid. Furthermore all the gaps in the house are known functional gaps: doors, windows and the chimney. Because they are known security measures can be applied. Security in IT needs a good foundation. So you need the right skills to apply the right security principles at the right time and place. You also need to know the 'attack surface' of you application. Only this way you'll be able to mitigate the risks for you company.