Your perceived security is only as strong as your perceived weakest link. Concentrate on known and probable threats. Security is directly related to the education and ethics of your users. Security is not a static end state, it is an interative process. There are few forces in the universe stronger than the desire of an individual to get his or her job accomplished.
Security is a people problem.
In the absence of other factors, always use the most secure options available. Security through obscurity is wrong. Don't use security to fix social problems. This false dogma comes as a push-back from someone who is annoyed at being asked to block certain web sites. If you can't trust your own employees, you have bigger problems than Internet threats.