By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
Isn't it really all about accounting for your assets, placing a value on each, (assessing the impact to your business if a breach occurs), calculating the risk, (threats, vulnerabilities and likelihood of occurrence), and then implementing security controls to minimize the risks starting with the highest? And to keep doing this as long as your security budget lasts. Oh and then starting over again. ISO 27001:2005 outlines this very approach.
How can I argue with somebody who quotes chapter and verse from one of the primary sources of guidance for compliance activity? But, as they say, "the devil is in the details" and indeed I see plenty of infernal influence every time I dig into same.