Information security tends to rely on defensive measures, for pretty obvious reasons. A virus outbreak occurs, a patch is released. However, as many organizations are discovering the best defense is really a good offense. Enterprises need to get proactive to defend themselves effectively against threats such as bots that take over systems without the user's permission.

The trend in recent years has been toward for-profit malware such as spyware and away from the showy, high-profile viruses of the past which were designed to show off the perpetrators' technical prowess. Phishing and pharming are much more than inconveniences; systems administrators have to be on guard or they run the risk of jeopardizing the security of their systems - and their data.

For that reason, it seems to make good logical sense that systems administrators become more proactive about security. That means mounting a defense that starts with an accurate risk assessment that assigns importance to various resources and puts up adequate protections for those resources. That means making some hard decisions about access rights. But most importantly, that means understanding the whole picture.