Hear hear, I second this! You must read this posting on Bruce Schneier’s blog… and be sure to follow the link of the example on how to get the risks wrong!