It's all about defense in depth. Local root exploits are part of why I run my stuff chrooted on an OpenBSD system. It's not perfect, but it's pretty much the be

It's all about defense in depth. Local root exploits are part of why I run my stuff chrooted on an OpenBSD system. It's not perfect, but it's pretty much the best you're going to do. Still, you can't just stop there. Having a one-time-password setup (SecureID, for example) to a cental "admin" system that can access the remote servers directly is one layer of defense against certain workstation compromises. Using properly-configured RBAC (or better, Mandatory Access Control) with separation of duties and remote logging gives security staff tools to enforce and analyze policies and incidents. I'm not saying it's possible to be 99% secure. To that end, I suppose Security is a "failure" (rolleyes) and as was mentioned before: you don't need 99% security, but you certainly should be able to go back and look at that other 1% after the fact. The truth is that you really don't see security's boundaries when it's working properly. You can tell when it's getting in the way, but security is truly the most visible when it fails.