What practical lessons does the lecture give for actually realizing security measures?

Just do it — in small, steady, digestible steps; convince rather than command; minimize friction; and re-check effectiveness regularly.

Hard-earned field experience for the implementation phase:

• Es tun! — just start; an 80% measure implemented beats a 100% measure planned
• In small steps, but steadily — continuous progress over big-bang projects
• Measures digestible in day-to-day business — don't overload operations
• Begreifen lassen, nicht vorschreiben — let people understand measures rather than just decreeing them (understanding produces compliance; decrees produce workarounds)
• Minimize obstructions — security that blocks work gets circumvented
• Regularly verify implementation AND effectiveness — maintaining security is a continuous process (Aufrechterhaltung), not a one-time project

Tip: The pattern behind all six: security succeeds as an ongoing, human-centered process — not as a decree or a one-off project.