Friction Budget
The limited amount of security friction users will absorb before they work around it, making usability a security property rather than its opponent.
Security that is too inconvenient is bypassed, and the bypass is less secure than a moderate control
would have been. Password rotation policies produced Summer2024!; over-restrictive file sharing produced
personal cloud accounts; a slow access-request process produced permanently over-granted permissions.
So friction is a resource to be spent where it buys the most, not applied uniformly.
Spend it in proportion to risk. Step-up authentication for consequential actions — changing payment details, granting admin access — and nothing extra for reading a public page. Uniform controls spend the budget on low-risk actions and leave nothing for high-risk ones.
Prefer controls that reduce friction. Passkeys are both more secure and faster than passwords with TOTP. Single sign-on reduces the number of credentials and improves control. Automated certificate rotation removes a manual task and an outage source. These are the highest-value security investments precisely because they are not trades.
Move controls off the user. Device posture, behavioural risk signals, and network context can raise assurance without asking anything.
The diagnostic question for any proposed control: what will people do to avoid this? If the answer is plausible and worse than the risk being mitigated, the control is counterproductive however correct it looks on paper.