I've been developing software for well over 20 years. During that time I've worked in Fortune 100 companies that had very specific security requirements developed by dedicated security professionals and tiny companies with no concept of security requirements whatsoever.
It seems to me that very often, the majority of the time even, the de facto security policy ends up being created almost incidentally by programmers and tightly integrated into the finished product. Most businesses seem to just buy something and use whatever the default/hardcoded rules are without further consideration.
My question is, in a perfect world what should the role of an enterprise application developer be in determining security policy for their software? Should a product implement ironclad "best practice" or focus on being configurable and allow the consuming company/organization to determine their own policy?
(I'm talking here about things like if and when two-factor authentication is required, password complexity requirements and how long timeouts are and how many bad passwords can be entered before a lockout.)
OK, just to reiterate, I'm not talking about actual vulnerabilities like XSS or SQL injection, but policy. Suppose for an example that I didn't know how long a password needed to be in order to be sufficiently secure for my context and I'm only allowed a few hours to work on the minimum password length code. Am I better off researching how long is long enough and hard coding my decision or writing code that let's the admin customize it themselves?