Unfortunately it has been a few years since I have given the talk and I lost my demo site on an old machine.  Diniz Cruz on the OWASP project used to have a lot of great information on the subject but many of his links are now dead.  The security principle of least privelege should be the starting point for any discussion about the appropriate security level.  I have been working on computer security for many years and cringe whenever I hear someone say that we should just give our web apps full trust. That is akin to saying we should make every user account a superuser.

The link that Ian posted has good information on setting your own custom security settings and should at least help you craft a security policy that is applicable for your particular website given your mix of modules and custom code.