Understanding your duty of care in security practice