Here is a good conversation on this subject: https://wiki.c2.com/?CapabilitySecurityDiscussion