The list of human errors goes on and on. Sensitive information that someone has left someplace is just as significant a problem as someone breaking into your system to get that information.

Someone with inside knowledge is going to be able to do more harm than your standard run of the mill hacker. We know that the majority of harm, at least things that cost a lot of money, occur because of insiders. If they have the same access as before, they have motive, means and opportunity.

You don't just willy-nilly give the devices out. You have to do the proper requirements analysis [of each group].

What does security allow you to do that you couldn't do before? How does it open a new area of the business?

Management and security vendors were doing the same thing and suddenly all noticed it. Good management or good systems management gives you security benefits.