Why security is hard