Approaching Security with an Identity-First Mindset