Asymmetric Information, Security Design, and the Pecking (Dis)Order