"Defense in Depth" is always important. The article I linked to above[2] about how it's incredibly stupid to try an enumerate badness (aka "default permit") has in it's list other stupid excuses we hear all the time:

    "We don't need a firewall, we have good host security"
    "We don't need host security, we have a good firewall"

I bet the people that say that kind of nonsense have a lock on their server room door even after hiring a guard that watches the building's main entrance.

This kind of practical defense isn't the only thing we've been skipping. We need a lot more basic research into how to secure modern technology. We need a design culture that isn't building features that require insecurity.

It is limiting top think of this problem as a "cybesecurity" problem. These same technologies will create problems in all areas of life, so we need a lot more education about what capabilities exist how they can be used. We need to be teaching people - from a very young age - what happens to your {meta,}data in a world with permanent data storage and powerful machine learning analysis. We need this education "yesterday", as these problems are not theoretical anymore[5].

[5] http://www.nytimes.com/2012/02/19/magazine/shopping-habits.h...