I’ve been thinking a lot recently about the usefulness of risk assessment. A while back I had an interesting conversation with Marcus Ranum about the issue. His opinion was basically that risk assessments give companies a false sense of security more than anything else, and that they aren’t ultimately very useful in the long run due to their…