Bottom Line Up Front:

STOP FOCUSING ON PRODUCTS, AND START FOCUSING ON PROTECTION OF INFORMATION AND ASSETS.

WHAT ARE YOU TRYING TO PROTECT? WHAT IS CRITICAL TO THE SURVIVAL OF YOUR BUSINESS & YOUR REPUTATION?

This is a CEO issue. IT CANNOT BE DELEGATED TO THE IT DEPARTMENT!
The key is PROTECTING INFORMATION, not protecting systems.
The DoD admitted that they can’t keep perpetrators out, they can only manage what is accessed. Find out what information is really important – keep asking ‘Why is that?’…
The average data breach costs $188 per record. Most breaches involve tens of thousands of records. ($20M+). You are legally required to report a breach.
Protect, Detect, Respond. Most don’t have ‘Detect’, which severely limits ‘Respond’. Due diligence and due care apply in determining legal liability.