Read our Whitepaper By Rod Trent
Limiting the Scope of Application Permissions is critical to security.