The unintended consequences of good security

Security controls can reduce risk, but they also change behaviour. Are we paying enough attention to what our policies encourage users to do instead?