Threat modeling is the most important part of this discussion, but will fall by the wayside in this discussion as well. Normal folks are really bad at risk analysis. I personally use a paper storage system and diceware ( http://world.std.com/~reinhold/diceware.html ) - because, at the end of the day - low tech is the best tech.

<edit> - also am a CISSP