Bruce Schneier address this very topic in his post on CYA security.

http://www.schneier.com/blog/archives/2007/02/cya_security_1...