Security isn’t just a technology problem—it’s about design, too