When does too much security become, well, too much? According to Steve Riley, senior security strategist at Microsoft, it becomes too much when the cost of mitigating the risk outweighs the cost of that which you are trying to protect.
Steve's approach to security spans all horizons, not just information technology. He elaborated on this theory in an afternoon session today at Microsoft Tech.Ed entitled "Making the Tradeoff: Be Secure or Get Work Done".
The cost of securing an asset is not simply the absolute cost of purchasing an enterprise firewall or business-wide malware software, according to Riley. It's measured against the current cost of leaving things as they are - if a couple of machines go down every week because of security vulnerabilities, that is a cost which can be measured and taken into consideration. However, if the cost is actually less than the cost of removing the problem, bizarre as it may sound, it might not actually be worth it.