Ask an administrator of a small LAN what he or she needs to watch and defend, and he or she will probably identify the servers. Ask the network administrator of a midsize organization where the biggest threats lie and he or she might point you toward the firewall. Ask a security officer in a Global 2000 company where the most valuable assets reside and how secure they are, and between bursts of laughter he or she might toss a few tidbits of ancillary knowledge your way. The fact is, many of the defenders of data aren't entirely sure where their most valuable assets reside, or how secure they are. This is a problem.

Computer criminals know this. In fact, they rely on this. Many times they play the odds, and they bet that the basics haven't been covered. They bet that administrators don't watch the attempted policy violations on the firewalls. They bet that machines aren't patched. They bet that logs aren't read and that important files aren't audited. They bet that unless they jump up and down, openly trash systems or delete data, they will go unnoticed. And most of the time, they are right on the money.