Security actually isn’t that hard. What is hardest is to separate the complex details from basic things like user workflow. Smart people make some of the dumbest decisions when it comes to security, because they geek out.