Too Much Security?

I like this post by Chief, The Security Monkey. It's true that too often companies just throw "solutions" at problems without really understanding what the problem is and how the solution will help mitigate the problem or how it will work with or against other "solutions" in place. Not only that but often they will put in a "solution" without really considering if it is necessary. They get calls from vendors who often use FUD ,or ignorance on the part of the company, to sell something that isn't needed or that isn't the best fit for the problem at hand. Nothing should be implemented without considering how it will work with other things that are in place. It's also not necessary to implement something just because someone, vendor or consultant, says that it is necessary. Companies need to get out of "panic" mode and take time to investigate different solutions to find the best product for their needs.