Unraveling Incoherent Security Practices