"I fear that the security business is rapidly becoming just that - a business where mitigating threats is based on ROI, which means that defending against such attacks just isn't feasible for most organizations."

Great! It is about time that security was applied based on risk -- we have limited resources and there is no other intelligent way to apportion them. The only issue I would have is that we have to make sure the security decision maker (ie company) pays the costs -- not the consumer -- so that the incentives are correct.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/318/31504#31504