This artcile is actually pretty good…

http://www.securityabsurdity.com/failure.php

Where I think it doesn’t do enough justice is by neglecting to note that security transcends technology…meaning in my view that most of the technical and security laspes that we experience today start first with social engineering….click here to see XYZ celebrity without clothes, a businessman in Nigeria just needs a small amount of money to unlock a vast fortune…open this attachment urgently and without delay…and so on and so forth.

I feel that we have a fundamentally flawed security model that says make security passive towards the user…it just works in the background.  But that is only part of the solution.  The real solution is to get the user base educated and aware of security, so that the next time they get an offer in the mail that’s too good to be true, they would instinctively know that the offer probably is too good to be true.