This helps to explain why trying to prevent the possibility of security breaches entirely is a losing battle.

Rather than setting a universally high security bar across all systems in the enterprise, an enterprise might segregate systems into different 'zones,'

There's also usually a black hat contingent at most mainstream security conferences. Since information security and hacking are two sides of the same coin, many hackers go to security conferences and many security professionals go to hacker events -- neither community seems to mind.

The best security organizations I've worked with understand and attempt to quantify the risk-management decisions they make on an ongoing basis.

There is a possibility of the killings being related to the ongoing security guard strike.

Getting the threat of breach entirely to zero is effectively impossible, even in relatively small enterprises. And the closer we aim toward zero, the more expensive and time-consuming it becomes.