This is not a retail - specific story, but is certainly relevant…

OK - I spend a lot of time working with executives to help them understand that although PCI and related compliance requirements are tangible, mentally ‘packageable’ concepts that can be (relatively) easily understood (at least at a high level) by the company as a whole, they are just the beginning of what should be looked at in terms of security.

So much of what we do is to open people’s eyes to what a real, operational approach to security can and should look like.  This was forwarded to me by one of our consultants because the security failure here is in HR policy or policy execution - not in an IT-driven ‘infrastructure’ effort that failed.

Unless companies start understanding how important ‘holistic’ security is, how critical it is to incorporate security into your daily corporate lives they are going to continue to miss the forest for the trees…  Thanks Ryan.

Fannie Mae Logic Bomb Would Have Caused Weeklong Shutdown | Threat Level from Wired.com.