Too Lest you think the simplicity rule applies only to hacking, let's look at malicious code issues. The Melissa virus surprised us all. Remember that it was a .doc Macro virus that caused the local mail client to mail it to the top 50 people in the local address book. We learned a lot from these viruses, but paid little attention to resolving the core problem. Users who actually need these file types can get the sender to zip them or ask their e-mail administrator to manually forward them.
Simplicity also works in preventing internal attacks.
Ask users to use any password at all. A four-character PIN will do nicely. Ask users to make it something they can remember and to change it yearly-if at all. None of these measures is particularly invasive, expensive or high maintenance. Together, they are stronger than any new technology, firewall, architecture, IDS or almost any other defense we can throw up on the digital perimeter.