Insider threats are always the most insidious!

Good point. I guess, despite all our discussions against external and third party threats to our systems, the most vulnerable access point would be the remote users themselves. No matter how secure we make our servers, our systems, or our workstations. How do you defend your own system against the people who are supposedly using it? The person who is employed to be building your security may very well be the biggest threat to it in the future.

I think this is the point when one should realize that their previous choice was the wrong one. If you’re hit it doesn’t mean the odds have suddenly become worse for your business, if anything the odds may have somewhat lowered a bit (lighting doesn’t strike twice in the same spot kind of thinking) yet now the added security justifies the cost. To me that simply means that security justified the cost even previously; however, the business went with the unfortunate frame of mind that the specific risk couldn’t possibly happen to it.

Of course I am not saying that every single risk should be mitigated either. There is a line where the cost doesn’t justify the benefit; however, the ‘this can never happen to me’ frame of mind is dangerous when deciding where to draw that line.