Large, bloated security models adversely effect management, communications, resource allocation, security operations, and employee productivity. Unfortunately, as information moves faster than corporate actions, so do threats, vulnerability, and risk. Confidentiality, integrity, and availability must be spelled out in documents approved by your senior management. This is the baseline for measuring the effectiveness of your security program and enforcing security procedures. However, some paranoia can strengthen your info-security plan.
Any organization operated by people has inherent vulnerabilities.
Therefore, to insure confidentiality of corporate information, start with your people. Deploy encryption, authentication technologies, and use automated confidentiality tools. Just remember that people will need to use these tools and people are vulnerable. Doctored data can create more damage than stolen data. Moving a decimal during an audit could prove disastrous.