As a consultant I constantly come across organizations that are more than willing to throw millions of dollars at their information security problems. Almost invariably this money is spent on technology: elaborate IDS/IPS deployments, expensive SEM solutions, etc. All this, but I seldom see any real security improvement as a result of adding high-end security products. Too often…