Designing for security