In the spirit of the holiday season, we're laying out an application security "battle plan" for keeping out attackers — à la Kevin McAllister.