The security of a device or network often hinges on a single choice made by a non-technical user. This could be the choice to click a button to enable macros in a word document, the choice to enable flash on a page in chrome, or the choice to execute an attachment sent over e-mail. Each of these choices was designed for the user, in part, by a security practitioner. In this talk, we’ll examine the concept of choice architecture and the delicate balance that exists between allowing users to make choices that benefit them while also nudging them in a direction that keeps them from unwittingly unleashing disaster. We’ll go through several practical examples of common choices users make that have security implications and discuss a framework for architecting software and websites in a way that better aligns choices with security best practices. You’ll walk away from this presentation with a greater awareness of how security practitioners influence and impact user behavior.