A point that was brought up in an offline conversation: while at TechEd last week I had a few discussions with companies that claim to "fully protect" your data by doing things like blocking the transfer of files to USB-attached devices, prohibiting access the the "print" command from specific apps, content analysis on all outgoing emails, all kinds of convolutions.
However, the recent ID theft bank attacks (Wachovia Corp., Bank of America Corp., Commerce Bancorp Inc. and PNC Bank NA) were a lot more low-tech, and thus effective even if the systems are fully locked down: the employees would bring up a person's data, and then either printscreen or copy the data out by hand (!!). Talk about the analog hole!
Any company that claims to provide you with "complete security" (as several did last week at TechEd) is either lying or doesn't know what the hell they're talking about.
