They've been screwed a lot of times. Detect and Respond Detection response is much more effective than prevention. Schneier recommends that CIOs outsource security detection and response. You never know when a fire is going to break out. It makes no sense for you as a business to have your own fire department.
Security is inherently a people problem because people are the network.
CIOs need to educate employees about security risks and threats, from e-mail viruses to protecting proprietary information, Tritak says. Employees who would never consider leaving their house key under the doormat don't think twice about posting their network passwords under their mouse pads. Most employees are also unaware of simple security risks, such as sending proprietary information by e-mail. The CIO of the Fortune 1000 manufacturing company tells of an executive who wanted to work on a document containing proprietary information over the weekend and e-mailed the document to himself at home. Who knows what route it traveled over the world, what servers it hit or who saw it.