Security is about risk management. Risk management is about minimizing and controlling risk, your exposure to risk, and your losses in the event of a security incident. The basic tenet of risk management is that it is impossible to completely eliminate all risks facing you; therefore, you must live and cope with them. You have to know their nature and protect yourself against them. Protection should be adequate to the risk and the value of the assets you are trying to protect. This might sound obvious (and it is), but this simple fact often gets disregarded.