The Art of Painting Yourself into a Secure Corner

In this episode of The Agile Software Engineering Deep Dive, Alessandro Guida explores what happens when corporate security is added in layers without enough attention to workflow, usability, recovery, and productivity.

Using the metaphor of painting yourself into a corner, the episode looks at a familiar modern workplace problem: VPNs, tunnels, multi-factor authentication, device compliance, strict password policies, authenticator apps, app PINs, short screen timeouts, and repeated confirmation prompts that may each make sense in isolation, but together can create serious friction for employees.

This is not an episode against security. Quite the opposite.

It is an episode about designing security properly.

The discussion covers why security should be treated as an engineering system with real users, real workflows, measurable performance requirements, failure modes, and recovery paths. It also looks at common traps such as MFA recovery loops, where the system sends the confirmation code to the very phone that has just been lost.

The episode argues that security teams and engineering teams should ask a simple but often forgotten question:

How does the complete workflow actually work for the human being who has to use it?

From use cases and workflow testing to acceptable friction, hardware support, passkeys, biometrics, and better recovery design, this episode is a reminder that good security should not only reduce risk. It should also help people work safely without constantly fighting the system.

Because the most secure system in the world is not very useful if nobody can get their work done.

Transcript

SPEAKER_00 0:30

Welcome to the Agile Software Engineering Deep Dive, the podcast where we unpack the ideas shaping modern software engineering. My name is Alessandro Guida, and I've spent most of my career building and leading software engineering teams across several industries. Today we are going to talk about security. But perhaps not from the usual angle. This episode is not about why security matters, it does. It is not about why companies need VPNs, multi-factor authentication, device management, password policies, access controls, and compliance checks. They do. The question is different. What happens when we keep adding security layers without designing the complete workflow? What happens when every individual control makes sense in isolation, but the combined result becomes painful, slow, fragile, and sometimes almost impossible to use? There is an old funny image that describes this perfectly. Someone paints a floor very carefully, one stroke at a time, and only at the end realizes that they are standing in the corner. Fresh paint everywhere. No way out. That is the metaphor for today's episode: painting yourself into a secure corner. We will look at the corporate version of that situation. Laptops and phones secured almost to the level of Fort Knox, login flows that require multiple confirmations, recovery systems that send the code to the phone you have just lost, screen timeouts that interrupt meetings and policies that look excellent in an audit, but create daily friction for real people. And to be clear, this is not an argument against security. It is an argument for better security. Security is still engineering. It has users, it has workflows, it has failure modes, it has performance requirements, it has cost, it has side effects. A security control that nobody can use correctly is not a strong control. A recovery process that depends on the device you just lost is not a recovery process. A login flow that interrupts work 20 times per day is not free, even if nobody has calculated the cost. In this episode, we will explore why security should be designed with the same discipline we expect from any other engineering system. Use cases, workflow testing, recovery paths, measurable friction, hardware support, and a clear understanding of what problem we are actually solving. Because good security should make unsafe behavior difficult, but it should also make safe behavior easy. Let's dive in.

SPEAKER_01 3:21

So there is this mental image, um, a very specific scenario that I've always found just strangely hilarious, even though it's you know a total disaster for the actual person involved.

SPEAKER_02 3:33

Oh boy. Setting the stage right away.

SPEAKER_01 3:35

Yeah. Picture this you are painting a floor, and you're being incredibly methodical about it. Every single square meter is covered perfectly. The paint is fresh, it's smooth, the color is totally even.

SPEAKER_02 3:49

Right. You're doing a phenomenal job on the micro level.

SPEAKER_01 3:52

Exactly. But then you look up and you realize the actual problem.

SPEAKER_02 3:55

You've painted yourself into a literal corner.

SPEAKER_01 3:57

Yep.

SPEAKER_02 3:58

Like there is wet paint everywhere between you and the only door out of the room. So the job is technically 100% complete, but operationally it's a catastrophe.

SPEAKER_01 4:08

Because you've created a completely broken system result. And honestly, this is the absolute perfect metaphor for what we're exploring today. We're getting into the hilarious, infuriating, and just massively costly world of corporate IT security. Trevor Burrus, Jr.

SPEAKER_02 4:21

It really is a wild world, yeah.

SPEAKER_01 4:23

It is. We are doing a deep dive into issue number 40 of the Agile Software Engineering newsletter. And it's titled The Art of Painting Yourself into a Secure Corner.

SPEAKER_02 4:33

A very fitting title.

SPEAKER_01 4:35

Right. And hey, before we get our booth stuck in the wet paint here, I really want to ask you, the listener, to go read and subscribe to the full article. The original issue has these incredible illustrations and way deeper technical context that we well, we just can't convey through audio alone.

SPEAKER_02 4:51

Yeah, definitely go check that out.

SPEAKER_01 4:53

And also, just a quick reminder: while this deep dive is completely free, it is a massive help to us if you press like right now and subscribe to receive all future issues. It really helps us out.

SPEAKER_02 5:04

It absolutely keeps this whole thing going. So jumping in, the core tension we are analyzing today is really critical for any modern organization. I mean, we live in a world of ransomware, phishing, massive remote workforces.

SPEAKER_01 5:16

Right. Robust security is totally non-negotiable at this point.

SPEAKER_02 5:19

Exactly. But the failure point begins when security is treated purely as this accumulation of defensive layers instead of being engineered as a cohesive functioning system that human beings can actually navigate.

SPEAKER_01 5:33

Yeah. And the phrase that the article uses to capture this, which I love, is security by the kilo.

SPEAKER_02 5:39

Yes. Security by the kilo.

SPEAKER_01 5:41

Because we've all been handed that corporate survival kit on day one. Right. The laptop and the phone that are locked down tighter than a submarine. Oh, absolutely. And it's never just one tool. You get a VPN, then a secure tunnel, then two-factor authentication.

SPEAKER_02 5:55

Mobile device management.

SPEAKER_01 5:56

Right. 60 character passwords, authenticator apps, conditional access portals, device compliance checks. It just, I mean, it just keeps piling on.

SPEAKER_02 6:04

Well, the reason it piles on like that comes down to how organizations actually purchase and deploy enterprise software. Like security tools are typically bought in silos to address very specific isolated threats.

SPEAKER_01 6:17

Aaron Powell Right. So one vendor sells you endpoint protection, and another sells you identity management.

SPEAKER_02 6:22

Exactly. And another one handles the VPN. Each of those layers makes total sense in isolation. I mean, every single product is perfectly defensible if you are only analyzing the narrow vector it was designed to block.

SPEAKER_01 6:35

Aaron Powell But the friction happens because no one is stepping back to look at the overlap. It's like uh it's the equivalent of putting seven different deadbolts on your front door, but you have to unlock them with your hands tied behind your back while a timer counts down.

SPEAKER_02 6:48

That is a brutally accurate analogy.

SPEAKER_01 6:51

Aaron Powell And at what point do we stop counting the locks and start counting the hours we spend trying to open the door? Because the invisible cost of that friction is just staggering. We are looking at an estimated 10 to 20 percent drop in daily productivity across an entire workforce.

SPEAKER_02 7:07

Yeah. And you know, that drop isn't just about the physical seconds spent typing a PI encode. It is really about cognitive load and context switching.

SPEAKER_01 7:14

Oh, totally. Getting pulled out of what you're doing.

SPEAKER_02 7:16

Right. In software engineering, or honestly, any deep knowledge work, getting into a state of flow is critical. So when a developer is interrupted, say, by a forced session timeout or a random authentication prompt, it doesn't just cost them the two minutes to log back in.

SPEAKER_01 7:34

Right. It can take like 20 minutes to rebuild the mental model of the code they were working on.

SPEAKER_02 7:38

Exactly. It completely derails the train of thought.

SPEAKER_01 7:41

And when you multiply those lost 20 minutes by, say, 10,000 employees, I mean, you are essentially paying 1,500 people a full-time salary just to sit there waiting for loading screens, typing in authenticator codes, and trying to remember where they left off.

SPEAKER_02 7:56

It's a massive bleeding cost center.

SPEAKER_01 7:58

So why doesn't leadership see it? Why is this allowed to continue?

SPEAKER_02 8:01

Well, it's because of the metrics on the dashboard, right? Security departments are measured almost entirely on defense. They track audit findings, compliance gaps, zero-day vulnerabilities mitigated.

SPEAKER_01 8:12

Failed login attempts, stuff like that.

SPEAKER_02 8:14

Exactly. And you know the saying, what gets measured gets managed. They do not have a real-time dashboard displaying the thousands of microinterruptions that are destroying their employees' flow state.

SPEAKER_01 8:26

Right. So the incentives are skewed to reward absolute lockdown, completely regardless of the usability cost.

SPEAKER_02 8:32

Trevor Burrus, Jr. Precisely. Which brings us to some really painfully relatable real-world examples where these disconnected layers actually end up actively attacking the user.

SPEAKER_01 8:42

Oh man. Yeah. Like the classic multi-factor authentication trap.

SPEAKER_02 8:45

Yes, the MFA trap.

SPEAKER_01 8:47

Because look, MFA is essential. We all know it stops a stolen password from becoming a breached account, but the trap snaps shut when the recovery path isn't actually designed into the system.

SPEAKER_02 8:57

Right. The system breaks down.

SPEAKER_01 8:58

Like imagine you lose your phone while traveling. You go buy a new one, boot it up, and enter your cloud credential so you can, you know, remotely wipe the old phone. The system accepts your password and then proudly informs you it has sent an SMS confirmation code.

SPEAKER_02 9:12

Directly to the stolen phone.

SPEAKER_01 9:13

Yes. Directly to the stolen phone.

SPEAKER_02 9:15

It's maddening. And the technical mechanism failing there is a disconnect between identity management and device state.

SPEAKER_01 9:23

How so?

SPEAKER_02 9:24

Well, the cloud identity provider sees a valid login attempt from a new IP address, right? Which triggers the rule to challenge for a second factor, but it is completely disconnected from the mobile device management system.

SPEAKER_01 9:37

Uh, which might already have a flag indicating the primary device is compromised or missing.

SPEAKER_02 9:43

Exactly. The identity system lacks context, so it just falls back on its hard-coded rule send the text.

SPEAKER_01 9:49

Unbelievable. So you think, okay, I need a backup. You dig an old iPad out of a drawer, it hasn't been turned on since like 2018. You power it up, but the session token expired years ago.

SPEAKER_02 9:59

Of course it did.

SPEAKER_01 10:00

So you try to log in, and the system again sends the code to the stolen phone. You're completely locked out of your own digital life. The hacker can't get in, but neither can the legitimate owner.

SPEAKER_02 10:09

The system has successfully protected your identity from you.

SPEAKER_01 10:12

It's so absurd.

SPEAKER_02 10:13

It really is. And we see this exact same lack of context in daily corporate life through what the article calls policy theater, especially with aggressive screen timeouts.

SPEAKER_01 10:23

Oh, policy theater. Tell me about it.

SPEAKER_02 10:28

Well, zero trust architecture mandates continuous verification. It basically assumes the network is always hostile, but zero trust often devolves into zero context.

SPEAKER_01 10:39

Right. Like the system doesn't know you are sitting in a secure boardroom surrounded by your own team. It only knows you haven't touched the trackpad in 180 seconds. I have literally lived this nightmare. You're presenting in a meeting, someone asks for a specific metric from last quarter. You turn to your laptop, but the screen is locked.

SPEAKER_02 10:57

Naturally.

SPEAKER_01 10:58

Now you have to type in your insanely complex compliance-mandated password, but you're actively talking, answering the question, so you know you mistype it. Oh no. You try again. Now it triggers a conditional access policy and demands a biometric approval from your phone, which is in your bag across the room. The entire business conversation, the actual reason the company exists, just grinds to a halt while you wrestle with your machine.

SPEAKER_02 11:21

And hey, the machine remained secure, but the business objective totally failed. Security crossed the line into theater. Right. And you know, the behavioral consequence of these overly complex password rules requiring uppercase, lowercase symbols, minimum lengths, and mandatory 30-day rotations is actually decreased security.

SPEAKER_01 11:41

Because humans are not random number generators.

SPEAKER_02 11:44

Exactly. We cope with complexity by creating predictable patterns.

SPEAKER_01 11:48

We capitalize the first letter, put an exclamation point at the end, and just change the number from one to two when the 30 days are up. Or my personal favorite, we write it on a sticky note and put it right under the monitor.

SPEAKER_02 12:02

Which completely defeats the purpose.

SPEAKER_01 12:04

It really does. But let me push back on this a little bit. Sure. If I am the chief information security officer, my job is literally on the line if there is a data breach. My job is not on the line if the marketing department is annoyed by screen timeouts.

SPEAKER_02 12:17

That's a fair point.

SPEAKER_01 12:18

Right. So given how I am punished, isn't locking down the system to the point of absolute absurdity the most rational thing I could do? Like, I actually kind of want the trap.

SPEAKER_02 12:27

Well, it is entirely rational for the CISO's narrow set of incentives. Absolutely. But it is deeply irrational for the business as a whole. And the irony here is that extreme lockdown often creates more vulnerabilities through shadow IT.

SPEAKER_01 12:43

Oh, because people just find workarounds.

SPEAKER_02 12:45

Exactly. If you make the secure file transfer protocol so incredibly convoluted that it takes 20 minutes just to send a PDF to a client, your employees won't stop working.

SPEAKER_01 12:55

They'll just use their personal unmonitored Dropbox accounts to get the job done.

SPEAKER_02 12:59

Exactly. By making the safe path too difficult, you force users into unsafe, invisible workarounds that the security team can't even monitor anymore.

SPEAKER_01 13:08

Because IT is only looking at defense, they aren't looking at the cumulative user journey. And man, see how broken that cumulative experience is? We really just have to look at the daily remote work morning routine.

SPEAKER_02 13:19

Oh, the morning ritual, yes.

SPEAKER_01 13:21

Let's frame this using an agile user story because I think it perfectly highlights this lack of systemic thinking. The user story for a modern corporate morning essentially reads like this. As a user, I want to spend the first part of my morning proving repeatedly to several mutually suspicious systems that I am still myself so that I can finally open my calendar.

SPEAKER_02 13:44

That phrase, mutually suspicious systems, is really the absolute crux of the problem. Yeah. Just think about the architecture of that morning login. You wake the PC with a password, then you launch the VPN, which challenges you for a credential. The VPN sends a prompt to your phone.

SPEAKER_01 14:00

Aaron Powell But your phone has been asleep, so you have to unlock the phone with face ID or a PIN first.

SPEAKER_02 14:05

Right. Then you approve the push notification, then you open the specific corporate application, which, surprise, has its own application level PN because it doesn't trust the operating system.

SPEAKER_01 14:15

Aaron Powell And finally you go back to the PC, which might now challenge you again because the IP address changed when the VPN connected. It feels like being interrogated by five different detectives for the exact same crime, and none of them are allowed to share their case notes. Like the first detective asks for my alibi, I give it, he leaves. The second detective walks in and asks the exact same question. It is pure paranoia dressed up as protocol.

SPEAKER_02 14:39

That's a great way to put it. And that paranoia instead of protocol happens because there is no mechanism to pass the authentication state across the boundary of each system.

SPEAKER_00 14:49

Right.

SPEAKER_02 14:49

Like the VPN does not trust the local Windows, hello, login. The application does not trust the VPN. They were implemented sequentially without any overarching engineering plan for how a human being actually traverses those boundaries.

SPEAKER_01 15:03

Okay, so we have thoroughly diagnosed the disease here. Yeah. Unengineered security. But we are not just going to complain about the wet paint on the floor. Let's discuss how we actually apply basic engineering principles to fix this.

SPEAKER_02 15:15

Let's do it.

SPEAKER_01 15:16

And according to the source, it has to start before a single line of code or policy is written. It has to begin with mapping out actual human behavior.

SPEAKER_02 15:25

Precisely. You cannot engineer a system based on abstract policy documents. You really have to write real use cases.

SPEAKER_01 15:32

Like what?

SPEAKER_02 15:32

Like how does a remote worker authenticate when their home Wi-Fi goes down and they have to tether to their phone? How does a salesperson access the CRM while standing in the lobby of a client's building with spotty cellular service?

SPEAKER_01 15:46

Or how does an employee recover access when their physical hardware token falls into a storm drain?

SPEAKER_02 15:52

Exactly. If you haven't modeled those edge cases, you are building a fragile system.

SPEAKER_01 15:56

And once you map those out, you have to bring those invisible costs into the light by actively measuring friction. IT departments actually need to track the time it takes to complete a full login sequence.

SPEAKER_02 16:07

They do. They need to analyze the help desk ticket cues to see exactly how many hours are being burned, resetting locked accounts, or provisioning new devices.

SPEAKER_01 16:16

Because making that friction visible is what allows leadership to make conscious business decisions, right? Security is always a trade-off.

SPEAKER_02 16:24

Absolutely. A company might look at the telemetry and say, okay, implementing this new endpoint monitoring will add four seconds of latency to application launches, but it mitigates a critical zero-day threat so we consciously accept that cost.

SPEAKER_01 16:38

That is a mature engineered decision.

SPEAKER_02 16:41

Right. What destroys productivity is when that four seconds of latency is just an accidental byproduct of a misconfigured policy that literally nobody bothered to test in the real world.

SPEAKER_01 16:51

Exactly. And another big step, you also have to design recovery as a core architectural feature, not just as an afterthought. We talked about the MFA trap earlier with the lost phone.

SPEAKER_02 17:02

Right.

SPEAKER_01 17:02

Things fail. Batteries die, screens shatter, networks go offline. If your only recovery path depends on the exact piece of hardware that just failed, you haven't built a security protocol. You've built a logic bomb.

SPEAKER_02 17:14

Yes.

SPEAKER_01 17:15

Recovery is a guaranteed operational reality, and it needs to be as smooth as the primary login.

SPEAKER_02 17:20

Well, and the most effective way to smooth out that primary login and the recovery is by moving away from shared secrets entirely, which really brings us to the hardware layer. We are talking about biometric hardware keys, FIDO2 tokens, and pass keys.

SPEAKER_01 17:34

Okay, let's dig into the how of that for a second. How does a pass key actually solve the friction and the security problem simultaneously? Because to the user, a password feels pretty simple, even if it's annoying to type out.

SPEAKER_02 17:53

Well, a password is a shared secret. You know it, and the server knows it. If a hacker breaches the server or tricks you into typing it into a fake website, the secret is compromised.

SPEAKER_01 18:03

Right. They have the keys to the castle.

SPEAKER_02 18:04

Exactly. But pass keys use public-private key cryptography. When you register a device, it generates a mathematical pair. The private key never, ever leaves the secure enclave on your phone or laptop. Yeah. The server only gets the public key, which is completely useless on its own. So when you log in, the server sends a challenge, your device signs it locally using your fingerprint or face ID, and then sends the mathematical proof back.

SPEAKER_01 18:30

Ah, so it's fundamentally unsufficiable. Even if I go to a fake login page, my device's private key won't sign the challenge for the wrong domain.

SPEAKER_02 18:38

Exactly. The security is massively upgraded.

SPEAKER_01 18:40

But the friction is also reduced because I'm literally just looking at my camera or touching a sensor instead of typing a 16-character string of nonsense.

SPEAKER_02 18:48

You nailed it. You eliminate the cognitive load of remembering passwords, you eliminate the repetitive strain of typing them, and most importantly, you close the biggest vulnerability window. Human error.

SPEAKER_01 19:01

Okay, but here comes my pushback again, thinking from the perspective of the CFO this time. Brain on issuing physical security keys or upgrading the entire laptop fleet to machines with biometric scanners requires massive upfront capital. How do you convince a board to approve that hardware budget when the lost productivity costs we talked about earlier is totally invisible on the balance sheet?

SPEAKER_02 19:24

Well, this is exactly why measuring friction is the absolute prerequisite. You don't pitch the hardware as a security expense, you pitch it as an efficiency reclamation project.

SPEAKER_01 19:34

Oh, I like that. Efficiency reclamation.

SPEAKER_02 19:36

Right. Because if an IT leader brings data showing that the company lost, say, 40,000 work hours last year to password resets, locked accounts, and authentication latency, they can easily prove that a $100,000 investment in hardware keys will pay for itself in six months just in reclaimed wages.

SPEAKER_01 19:54

That is so smart. It shifts the entire conversation from we need to buy more locks to we need to stop paying our staff to stand in the hallway.

SPEAKER_02 20:03

Which leads to the ultimate golden rule of security engineering. Good security must make unsafe behavior difficult and safe behavior easy. Yes. The enemy is not security. I mean, we desperately need security. The enemy is unengineered security. You have to treat the security infrastructure as a product and the employees as your highly valued users. They have workflows, the system has failure modes, and frankly, forcing them through a daily obstacle course is not a badge of honor for the IT department.

SPEAKER_01 20:29

No, it's not. The most secure system in the world is utterly useless if nobody can get their actual work done.

SPEAKER_02 20:34

Yeah.

SPEAKER_01 20:34

Like we said earlier, if you paint everyone into a corner, sure the house is safe from intruders, but nobody can actually live in it.

SPEAKER_02 20:40

It requires a massive shift in mindset. It really requires IT, compliance, and executive management to break out of their silos, share their metrics, and design a holistic journey that respects both the threat landscape and human psychology.

SPEAKER_01 20:54

That is a brilliant synthesis. Before we wrap up today, I want to give one final shout out to you listening. Please make sure to hit like and subscribe to this deep dive so you don't miss our future explorations. And again, go find issue 40 of the Agile Software Engineering newsletter. Subscribing to their full feed will give you the diagrams and deep technical breakdowns that just perfectly complement what we've unpacked today.

SPEAKER_02 21:16

It really is essential reading if you want to understand how to actually implement these systems without breaking your company.

SPEAKER_01 21:22

Absolutely. And to send you on your way, I want to leave you with a final thought that builds on everything we've just discussed. We've talked extensively about what we know like passwords and what we have like phones or hardware keys. But as artificial intelligence becomes basically indistinguishable from human output, capable of mimicking our typing cadence, our voices, and even our faces on video calls, will the future of security even rely on discrete authentication events anymore?

SPEAKER_02 21:50

Oh wow. You're pointing toward a paradigm shift from active authentication to continuous passive behavioral authentication.

SPEAKER_01 21:57

Exactly. Just imagine a system that never asks you to log in. Instead, it constantly observes how you behave in the background, the micro movements of your mouse, the time of day you access certain databases, the specific phrasing you use in your emails. It calculates a continuous trust score. And if the score drops, it just quietly restricts access. It makes the entire concept of a login screen and all the friction that comes with it completely obsolete. So that's something to mull over the next time you're forced to change your password to include a special symbol and a sacrifice to the compliance gods, just to make sure you haven't painted yourself into a secure corner. Catch you next time.

SPEAKER_00 22:52

A colleague, your team, or your network. You can access all episodes by subscribing to the podcast and find their written counterparts in the Agile Software Engineering newsletter on LinkedIn. And if you have thoughts, ideas, or stories from your own engineering journey, I'd love to hear from you. Your input helps shape what we explore next. Thanks again for tuning in, and see you in the next episode.