The reality is that, as any ISO will find after a few weeks on the job, information security is an extremely complex area. There is no way to guarantee perfection, to eliminate all risks of loss to our information. Security technology is constantly changing and the bad guys are always finding new ways to break in. Most importantly, information security is ultimately dependant on people who, despite their best or worst intentions, do not always follow the rules. The best security technology in the world can be rendered ineffective by an inadvertent programming mistake by a developer or system administrator. The most sensitive information can be unexpectedly revealed on the front page of the New York Times, because a senior executive mistakenly left a laptop behind on a restaurant table. Thousands, even millions, of dollars can be lost because a disgruntled employee abuses their authority and defrauds the company. Therefore, as long as information security is dependent on imperfect measurements of risk, technology that is constantly evolving and fallible humans, we will all have a very challenging job.