I agree w/ Mr. Atwood's assessment that people are, have always been, and will continue to be the weak point. I strongly disagree w/ his statement that no atta

I agree w/ Mr. Atwood's assessment that people are, have always been, and will continue to be the weak point. I strongly disagree w/ his statement that no attackers still attempt frontal assaults. Thinking that way promotes a dangerous complacency, not unlike the complacency that I see created after a company spends a large sum to install some security product. "Now that we have <firewall / security scanner / NIDS / SEIM / log aggregator / patch management> product we are 'secure'!" In my work I continue to see Internet-facing machines with shockingly poor security posture in companies large enough to "know better". Those vulnerabilities are, of course, still "people problems" at their heart (sysadmins who end-run good security process, developers who won't allow patches to be installed, etc) and they're still out there en masse.