So why haven’t information security professionals adopted a risk management approach? "Because it’s harder," McCreary says. "It takes more time and effort and, of course, more knowledge."

To Do:

1. Spend for education and risk management training instead of technology.

2. Take better advantage of the technology you have by analyzing the data it generates, not simply viewing the technology as a tool to block attacks.

Why No One Hits .400 Anymore

The late evolutionary naturalist Stephen Jay Gould contended that complex systems (like nature or information security) evolve from wild variation in their youth to relative uniformity in maturity while maintaining an overall constant average in both.

To make his point, Gould, as was his wont, used baseball. In Full House: The Spread of Excellence from Plato to Darwin, he noted that throughout the history of the game the aggregate batting average of major league hitters has remained constant at about .260 but that there used to be a much higher incidence of .400 hitters than there is now. In fact, the .400 hitter could be said to be extinct. Ted Williams was the last player to hit over .400, and that was in 1941. Previously, Ty Cobb and Rogers Hornsby each did it three times.

How come no one hits .400 anymore, despite the fact that hitters are stronger, use better equipment and have access to advanced training technologies like video? The reason, Gould asserted, is because everything has improved around them, notably pitching and fielding. When baseball was young, no one knew the optimum way to pitch to a batter, or the best strategy for positioning fielders, or even what degree of success or failure was of professional caliber. But, over time, data has been assembled and analyzed, and best practices have emerged. Everyone gets so good at what they do, Gould asserted, that it becomes more difficult either to fail or to excel.

Information security in 2003 is where baseball was in 1922, a year in which three players hit over .400, many hit in the high .300s, and still more hit in the .100s.

Today, there’s wild variation in how well companies secure their enterprises. But over time, Gould would argue, data will accrete, best practices will emerge, information security will normalize, and everyone will move toward the mean.

Until then, however, some companies are Ty Cobb, and many, many others can’t bat their weight.