Approaching Security White Paper - Complete Security: Out of Reach or Attainable Goal? A Guide to Su

A $20,000 firewall, VPNs, NAC, 2FA, DLP, FDE, or WAFs will not make you secure. Achieving regulatory compliance or passing a vulnerability scan will not make you secure. So what will? Nothing. Literally. If we have assets to protect, we can anticipate that threats and vulnerabilities put those assets at risk. Pursuing a goal of absolute security is unrealistic. Instead, security should not be considered a goal or a final destination, but rather a perpetually reiterative effort. We should look at information security in terms of risk management -- the practicable mitigation of risks to an acceptable level. Such an approach may help to usher in systems where security is a natural and integral component rather than an afterthought.