1. Admit that you cannot be in full control of your systems and networks
There will always be NSA to break your elliptic curves, or a new zero day in a library inside a library that you forked, modified and then used in your code. And if you say "defence in depth", I'll ask you to show me your "perimeter".
2. Recognise that this is not a defeat
Attackers are people too, and are driven by economic motives. If it is too hard and not worth the effort, they will not go after you. Unless they want to make a point, of course.
Make breaking into your stuff not worth the effort. That is, ensure the required effort is hard enough that "the bad guys" will give up.
3. Examine, with the help of others, your past efforts to "secure", "risk manage", "protect" everything to the level of "best practice"
"Best practice" is partly management speak for "I have no idea how to deal with specifics of my business environment" and partly vendor sales pitch. Risk management is good in theory but does not work in practice for infosec, beyond very basic qualitative judgements.
Talk to others, inside your business sector and outside it. Etsy, Facebook, Twitter, and even Salesforce are doing awesome things. Talk to me, I'll buy you a beer! :)
4. Make amends for these errors (or efforts)
Don't be a business prevention specialist. Be nice to your developers, they are generally smarter than you - learn from them. Listen to your network admins, they are often more protective of their hosts than you think.
5. Learn to live a new life
Give people what they need to do their jobs and get out of the way - figure out a "secure enough" method of doing what people need without disrupting their jobs. Set yourself specific time limited goals and don't fall into the trap of "best practices" again (see point 1)
Make your own informed decisions. You cannot outsource understanding to consultants, whitepapers and Google.
6. Help others who suffer from the same addiction to total control
Run an exploit or two for them... Teach them about the halting problem, just because it's fun to see people realising what it entails, at least in theory. Send them a few links:
- http://sparrow.ece.cmu.edu/group/731-s08/readings/ptacek-newsham.pdf
- http://sparrow.ece.cmu.edu/group/731-s09/readings/Axelsson.pdf
- https://community.qualys.com/servlet/JiveServlet/download/38-10829/Protocol-Level%20Evasion%20of%20Web%20Application%20Firewalls%20(Ivan%20Ristic,%20Qualys,%20Black%20Hat%20USA%202012)%20SLIDES.pdf
- https://www.nsslabs.com/system/files/public-report/files/Correlation%20Of%20Detection%20Failures.pdf
PS A vaguely related preso I gave is at http://www.slideshare.net/agelastic/security-vulnerabilities-for-grown-ups-gotocon-2012-15479294
