I was happy to find Anton Chuvakin's post about the issues of doing security based on risk management a few days ago. As I said on my twitter, "discussions about decision making (risk based vs.