Threat modeling is the most important part of this discussion, but will fall by the wayside in this discussion as well. Normal folks are really bad at risk ana

Threat modeling is the most important part of this discussion, but will fall by the wayside in this discussion as well. Normal folks are really bad at risk analysis. I personally use a paper storage system and diceware ( http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html ) - because, at the end of the day - low tech is the best tech. <edit> - also am a CISSP