SecurityInnovation/TMContentReview — Issue #6: A Strong Application Architecture Is Used
Author: SergeTruth
Created: 2011-11-07 22:10:04+00:00
State: open

The guidance in here is a bit general. I think another way of saying this is to have the admin interface in a totally separate application from the user application. This way if an internal attacker knew the URLs to attack they could not get access to them because the admin application requires a different session cookie.