  Engineering techniques to address the endless parade of security issues are
an important area of research. Properties of practices in industrial use are
rarely studied. Security workers satisfice. There is a widespread perception
that security work must be cumbersome, and thus there's no value to assessing
levels of effort. This is complemented by a belief that the nth day of work
will produce value equal to the first. These perceptions impact both practice
and research. This paper expands the acceptable paradigms for security analysis
to include the fast, cheap and good enough. "Nothing" is often enough for
industry. This paper makes a case for valuing lightweight ("fast and cheap")
methods, presents a set of case studies and evaluation criteria for such tools,
including card decks and role playing games.
