I think for me this boils down to 'Unknown unknowns' First I need to have a high level overview of all the different areas that are impacted by security. Then,

I think for me this boils down to 'Unknown unknowns' First I need to have a high level overview of all the different areas that are impacted by security. Then, I need to know which ones are 'mission critical' so to say. Once I kind of know the big picture, and where I should focus my efforts first, I can go and learn by myself and then come to you when I hit bumps in my understanding. For example, I am trying right now to build my first web app. I know certain 'things' eg don't store user passwords in plain text, don't try to build my own crypto solutions etc. But I have no idea of what possible attack vectors exist, which ones are critical, which ones are covered by using best practices, good frameworks etc. In other words, I have no idea where to start, literally because I have no idea! I am currently going through the matasano challenges, but I can't (at the moment as I have just gotten the first set of challenges) for the life of me see how I should apply this new knowledge to building a web app. Regarding your question, I see you have maybe already outlined the sections of your high level overview presentation: 1: physical 2: network 3: application 4: operations 5: business risk management But in all honesty, I really don't even know enough to answer you: What do I wish I knew? Because I didn't even think about those 5 areas even.