If people and premises aren't included in a total security picture, the problem probably isn't changed appreciably. In security, we concern ourselves with the triplet, confidentiality, integrity, and availability. In order to create a reasonably secure environment, we need to look at each of these areas. My team and I have been asked on numerous occasions to put together complex and sophisticated information security solutions. We have found that we have created a sound security system for our clients only when all three classes of tools are applied, usually in equal measure.
Security is achieved by balancing all three factors.
It is my opinion that an organization that places a strong emphasis on employee security awareness training is the most secure. I strongly believe that you get the most bang for your buck in this area. However, you can only take that so far before you need to step in with strong physical and logical security as well. VPN technology is a great thing. It can make a WAN very private.