Don't keep sensitive files in the root directory. If using CGI, don't expose passwords. Use page expiry to ensure that sensitive information isn't viewable simply by using the Back button on a web browser. And offer a twin verification process with different passwords. None of this is rocket science, of course - yet many of these elements are often overlooked, or not considered.
Software design is just one part of the jigsaw, albeit a very important one.
If security is Cinderella at the e-ball, then software design is the glass slipper. At the end of the day, this isn't really about technology at all. It's about protecting your business, and looking after your users - colleagues, customers and suppliers. Yes, there are many ways to skin a cat. But rest assured, if you don't get there first, you could find that professional criminals, hackers and e-fraudsters are well on their way to skinning your cat for you.