> if you don't balance security theory with operational practice, critical business functions can fail

i.e. people will circumvent the secure-but-onerous path. (I don't think they can be faulted for trying to get their work done either, I'm agreeing with you)