Authentication in general is the process of proving that something is 'true' or 'genuine', in this case an assertion of identity. You say endpoint security is

Authentication in general is the process of proving that something is 'true' or 'genuine', in this case an assertion of identity. You say endpoint security is obvious, and I usually agree with you. But I can't count the number of times I've had to retrace this methodically with when talking about systems with very smart people. The distinction between authentication and authorization too. Like you're saying, classical risk management says the $10 asset isn't worth $20 of security. Sony learned the fallacy of that reasoning the hard way. If you have a database of 100K usernames, passwords, and email addresses of folks who entered a contest to win free movie tickets, you might not value that asset particularly highly. But if you don't secure, it properly could cost you $M to clean up later. Personal information doesn't always behave like an typical 'asset'. Sometimes it's more like having a surplus of toxic waste. Shoot, I could talk about this stuff all day. :-)