We need to mature as an industry. As long as we allow communications within and beyond our networks, we expose ourselves to vulnerabilities. The communications of our networks must be symmetrical to allow commerce. Information Protection is about protecting the business process with Policies, Processes, and Technologies that provide Confidentiality, Integrity, and Availability. Our organizations cannot solve Information Protection problems by just adding technology and ignoring the fact that we are not monitoring for security incidents.
Additional technology adds complexity and room for misconfiguration.
Much of Information Protection is attained through a combined effort of Policy, Process and Technology that provides Protection, Detection and Reactionary measures. In order to measure the effectiveness of Information Protection, a common variable needed to be identified. It is has been stated that most human endeavors can be effectively measured in time. After some consideration it can be said that a very determined thief could potentially penetrate the vault. The point is that banks have taken additional security precautions by installing an alarm and arranging for either the police or an onsite security guard to handle the security event.