Embedding Security Into Systems After Their Design