There are a number of discussions happening regarding the differences in risk based security vs compliance based security. These mostly have grown from discussions around PCI and other imposed standards of control. My opinion is that risk and compliance are two necessary actions. Agusto, over at securitybalance blog is the latest to discuss the merits of compliance based security. I share his opinion that creating prescriptive measurable requirements goes a long way to improve the security of a large number of organizations. This is a given - I compare this other compliance programs like laws regarding the use of seat belts in automobiles. They exist because it is better to protect everyone to the same level of protection than it is to measure the specific protections required based on the roads that are being driven on that day, or the specific use of the vehicle, etc. What this doesn't mean is that there isn't some degree of risk management being performed - its just th