It should evaluate physical issues, as well as logical issues. The risk assessment aspects of security should involve the organization's executive management, ensuring that the strategy and technologies to be implemented address the right risks. Once the risk assessment is completed, a strategy can be defined, targeting the risks to be addressed and establishing the type and level of protection to be used. Then technologies can be evaluated and solutions can be implemented as part of an overall plan. While security shouldn't be viewed as completely evil, it is important for everyone in the organization to understand that it is not free.
All security has a cost.
Every time you fumble for your car keys, you are paying a cost for the security of your car. If we didn't need to lock our cars, we would never have to look for our keys. Understanding that security has a cost, we should attempt to minimize its impact on users. Keyless entry devices for unlocking cars provide a great example of how security can be improved by minimizing user impact. Security as it applies to e-business represents some new challenges.