Re: One big fail waiting to happen.
If you'd like to discuss some of my thoughts on the incorporation of security, I'd be happy to have a sit down with you. As for why I didn't go into the details on the "how", it is because there are multiple possible approaches, and which approaches vendors take will differentiate them one from another.
It should also be noted that privacy should be baked in from the start...something not all vendors will do. (See: Microsoft.)