Security vs. Usability vs. Cost: Real Trade-offs

Security does not exist in a vacuum. Every security decision impacts usability and cost. Ignoring this triangle leads to unusable systems or spending disproportionate to actual risk.

The Triangle

          Security
             /\
            /  \
           /    \
          /______\
    Usability    Cost

Maximizing one vertex puts pressure on the other two. The goal is finding the right balance for the context.

Trade-off Examples

Security vs. Usability

MFA required on every login:
  + High security
  - User friction, product abandonment

Balanced solution:
  MFA on first login from a new device
  Session token valid for 30 days on trusted devices

20-character password with maximum complexity:
  + Harder to guess
  - User writes it on a post-it → security is actually worse

Balanced solution:
  Long passphrase ("correct horse battery staple")
  Password manager recommended

Security vs. Cost

Enterprise ML-powered WAF for every microservice:
  + Advanced protection
  - Cost: $50k/year per service

Balanced solution:
  WAF only on internet-facing services
  Simpler internal controls for internal services

Usability vs. Cost

SSO (Single Sign-On) for all tools:
  + Excellent user experience
  - Implementation and licensing cost

Decision: justified if the company has 100+ employees and 20+ tools

How to Make Proportional Decisions

1. Classify the Risk

Probability × Impact = Risk

High probability + high impact → strong control mandatory
Low probability + low impact → accept the risk or use a simple control

2. Compare to Asset Value

Asset: database with 1M credit cards
Cost of a breach: regulatory fine + reputational damage = millions
Cost of the control: encryption + tokenization = tens of thousands
→ Control is justified.

Asset: internal wiki with HR policies
Cost of a breach: low
Cost of the control: basic auth + SSO = low
→ Does not need a dedicated HSM.

3. Security Proportional to Context

3-person startup ≠ bank with 10,000 customers
Hospital with patient data ≠ personal blog

Common Pitfalls

Security theater: controls that look secure but protect nothing
  Example: policy to change password monthly → users use "password01", "password02"

Over-engineering: controls too expensive for the actual risk
  Example: biometrics + smartcard to access the internal wiki

Under-engineering: ignoring risks because of cost
  Example: not encrypting customer data "because it's expensive"

Conclusion

The right decision depends on context: who are the likely attackers, what is the asset value, what is the business risk tolerance. Effective security is proportional, not maximal.