Another similar problem is that some security
mechanisms can be used to support multiple best practices.
In this case the choice is between emphasizing these
mechanisms or not. In other words, we had to decide if the
importance of a given mechanism should be somewhat
accumulated from different practices. For instance, “should a
mechanism required to implement three not very important
practices be considered more important than another
mechanism that can be used to support a single very
important practice?” In this case, we decided that yes. This
is because we believe that security should be exhaustive,
meaning that from a general perspective, in a trade-off
decision the higher the number of security precautions in
place, the better. We are aware that this is open for debate,
but the assumption seems to be reasonable. Anyway, this
decision had little impact on the overall benchmark, as there
are a very low number of mechanisms that are related to
more than one security practice (3 to be exact). In fact, we
performed several simulations on the calculation, and found
that choosing differently would make little difference in the
outcome.