Part 3: Why design matters for security