The one question I continually come back to in my thinking is, "why does security fail?" Sure, there are a multitude of foes where blame could be (and, in some cases, should be) placed. Some are real, some are fantasy: faulty technology, faulty policies and procedures, faulty awareness. Superior adversaries. But, for me, such arguments are straw man fallacies. Colloquially, they are just trimming branches. Let's hack at the roots, shall we?