Climbing back down: the challenge of reducing security levels