Information security specialists and risk managers are supposed to perform a cost-benefit analysis for security by looking at probabilities, estimating costs for prevention and for recovery from damage, and then computing annualized cost expectancies for different kinds of problems. However, neither part of this theoretical approach is typically known in any given situation. Worse, the methodology and the data such as they are are largely unknown to network and system managers in the real world. Certainly such data and methodologies are almost completely unknown to desktop computer and workstation users. In any case, users should not have to become security experts to avoid disaster any more than average automobile drivers should become mechanical and electronics engineers.
Practitioners face an enormous range of sources and types of risk , .
No single product is likely to be sufficient to protect against accidents and attacks. Complex combinations of tools lead to manifold interactions and the emergence of new weaknesses. Weakness at one level of the security architecture can profoundly damage the usefulness of other components at different levels. Information security is complicated further because some of the threat comes not from inanimate forces such as fire or flood but from dishonest or malicious people who expend enormous effort to defeat the current generation of security measures. As a result, information security in today's world of intranets, extranets, and the Internet is a dynamic struggle against a tidal wave of new vulnerabilities, changes in network configuration, addition of new products, changing patterns of use by old and new users, and inevitable upgrades to software and hardware.