Rather than setting a universally high security bar across all systems in the enterprise, an enterprise might segregate systems into different 'zones,'

There's also usually a black hat contingent at most mainstream security conferences. Since information security and hacking are two sides of the same coin, many hackers go to security conferences and many security professionals go to hacker events -- neither community seems to mind.

The best security organizations I've worked with understand and attempt to quantify the risk-management decisions they make on an ongoing basis.

This helps to explain why trying to prevent the possibility of security breaches entirely is a losing battle.

Getting the threat of breach entirely to zero is effectively impossible, even in relatively small enterprises. And the closer we aim toward zero, the more expensive and time-consuming it becomes.

I'm cautious about taking a functioning known quantity and turning it into something else -- at least without a full understanding of what the ultimate goal is.