To win the dollars you need for security, conduct a threat analysis based on your company's business model, Mudge says. Then build a business case for senior management, presenting security as a revenue generator, not an expense. An incentive approach, as opposed to a liability approach, gives you a much better chance of getting an adequate security budget. If you look at your company's operating system and network, and you can't tell what it's designed for, your company is accepting undue risk, Mudge says. Your business model should define your security stance, and your security must mirror your business.
Security is a state of mind engineered and designed into the infrastructure, rather than vice versa.
A well-designed architecture eschews superfluous services and unnecessary risk, Mudge says. They knew what their business was. It's also much more efficient if you design security into your infrastructure from the beginning, Schneier says. The Net is the same way. As in the real world, if someone really wants to break in, they'll find a way to do it.