Don't forget to also compartmentalize things, because isolation is a more reliable approach to security than correctness, https://blog.invisiblethings.org/2008/09/02/three-approaches...