So glad you wrote this Steve I couldn't agree with you more. But as you state it does need to start top down and I really believe that too many "managers" are clueless about the realities of software development much less leveraging the security enhancements of .NET and SQL server.

I hear a lot about "agile" and "scrum" but without the basis of a clear functional and design specification they are just buzzwords that make people feel good about what they are doing (or not doing). It is really all about leadership in the development department based inclusion, mentoring, training and standards.