I remember when I thought security is a technical problem. I was shocked to see people neglecting "basic" principles. Don't get me wrong, doing secutis important. But we need to see the reason and work within our constraints.
So I've written up my thoughts on the topic. Since we're distributing limited resources to achieve the priorities decided, security is in fact a political problem.