Kind of like Freakanomics meets InfoSec?
The only point I found a little controversial was #1, slowing down development hurts security. But Kelly Shortridge sells me on their logic. Maybe I would counter that there is an "optimum" pace for development or that the schedule should follow the development calendar, not the marketing/product one. But there is Freakanomic logic to the idea that you sooner you release, the sooner you can fix.
My own experience, having come into security from the development side, is that software development models rarely match software development practices. Now, I imagine there are some places that adhere to a very thorough process, but my sense is they are more the exception, and increasingly so given the embrace of Agile. Then again, I may have just been a really bad developer.
