Getting the threat of breach entirely to zero is effectively impossible, even in relatively small enterprises. And the closer we aim toward zero, the more expensive and time-consuming it becomes.

This helps to explain why trying to prevent the possibility of security breaches entirely is a losing battle.

Rather than setting a universally high security bar across all systems in the enterprise, an enterprise might segregate systems into different 'zones,'.

By doing all these things, ... the enterprise will know how to respond to a threat in ways that minimize downtime and keep digital assets secure, even in a world where threats are almost guaranteed.

In general, black hats learn their tricks the same way that everybody else does: through a network of informational Web sites, magazines, conventions and advice from peers. There's even hacker radio.

There's also usually a black hat contingent at most mainstream security conferences. Since information security and hacking are two sides of the same coin, many hackers go to security conferences and many security professionals go to hacker events -- neither community seems to mind.

If the trends continue, I think it is likely that game platforms will become a more attractive target for attack in the future. Looking far enough ahead, game platforms might ultimately become an even more attractive target than general purpose PCs.

I'm cautious about taking a functioning known quantity and turning it into something else -- at least without a full understanding of what the ultimate goal is.

The best security organizations I've worked with understand and attempt to quantify the risk-management decisions they make on an ongoing basis.