Getting the threat of breach entirely to zero is effectively impossible, even in relatively small enterprises. And the closer we aim toward zero, the more expensive and time-consuming it becomes.

The best security organizations I've worked with understand and attempt to quantify the risk-management decisions they make on an ongoing basis.

I'm cautious about taking a functioning known quantity and turning it into something else -- at least without a full understanding of what the ultimate goal is.

If the trends continue, I think it is likely that game platforms will become a more attractive target for attack in the future. Looking far enough ahead, game platforms might ultimately become an even more attractive target than general purpose PCs.

There's also usually a black hat contingent at most mainstream security conferences. Since information security and hacking are two sides of the same coin, many hackers go to security conferences and many security professionals go to hacker events -- neither community seems to mind.

In general, black hats learn their tricks the same way that everybody else does: through a network of informational Web sites, magazines, conventions and advice from peers. There's even hacker radio.