Unpacking Best Practices for Security Priorities