If I\u2019ve learned anything in my two decades of working in the InfoSec industry, it\u2019s that the practical application of securing data can be challenging. Every time I start to feel like I have a pretty good grasp on how to protect my data, something will occur that makes me realize how much a seemingly simple error can cause big problems.I\u2019ve found no better metaphor for these errors than my constant battle to keep our farm animals contained. In certain circles, it\u2019s a common truism that "if your fence won't hold water, it won't hold a goat." Many of us who\u2019ve tried to protect data for and from humans will recognize this sentiment. Both critters and computer-users are astoundingly adept at going through barriers in creative and unexpected ways.No matter how complex or how old the vulnerability is, patch it anywayWe became aware of a hole in our fence that was accessible only by entering a narrow alley that was protected by a gate, which was bungeed in place. Our goats had gotten stuck in this alley a couple of times, and it unnerved them so much that I figured they wouldn\u2019t bother exploring it further. A few months later, one of the goats figured out that not only could he move the gate if the sheep offered \u201cassistance\u201d (read: head-butting the goat because he\u2019s in the way), but if he stood up and turned the other way round, he could comfortably shimmy his way out of this hole.While it might seem like this convoluted turn of events would be a one-time fluke, it happened twice in 12 hours. If the reward is sufficiently great, they will find a way.Understand and explain the reasoning behind recommended guidelinesWhile raising our first clutch of ducklings, I had read that you should wait a few months before clipping their flight wings. So we waited the recommended period of time, erring on the side of waiting a little longer just to be safe. Two days after the specified date, the ducks flew into the neighbor\u2019s yard.In retrospect, it seems obvious that I should have investigated further to see if there were a way to visually assess when they were ready. When a subject is new and sensitive, it can be tempting to just accept the word of experts without question or to draw incorrect conclusions based on mistaken assumptions. When you train users, or get training yourself, make sure that \u201cwhy\u201d is covered as well as \u201cwhat\u201d, \u201chow\u201d and \u201cwhen\u201d.Risk assessment should be an ongoing taskOne morning as I was feeding the chickens, I accidentally startled a hen. Her alarm calls unnerved a twitchy, young rooster, who flew towards the netting around their enclosure. I hadn\u2019t realized that during the previous night a leaf had fallen onto the netting and created a gap between two sections that was just wide enough for him to fly out.It doesn\u2019t take much to make a change big enough to cause problems: by constantly monitoring our assets, we can help mitigate new risks.Multiple defenses can balance security and functionalityIt would be lovely if we just could let our animals roam as they please. But I have it on good authority from the local rabbits and deer that our neighbors\u2019 roses are delicious, and that there are hungry predators nearby. As such, we deploy multiple levels of protection for the benefit of our critters and for the neighbors\u2019 gardens, considering their relative level of risk and need.The risk of predation is greatest at night, which is also when their need to roam (and our ability to supervise) is lowest, so we lock our beasties in secure enclosures before sunset. During the day, our critters have access to larger areas, but can still hide in their shelter if need be. Beyond that, our whole property is fenced in case they escape their individual enclosures. In each of the incidents I describe, no harm came to the critters because we had a series of barriers and alerts, so there was no one point of failure.We also can\u2019t underestimate the psychological angle: our animals all know where their safe areas are and will go there if they feel they are at risk. If they get out of those areas, they quickly get our attention and we put things right.No matter whose statistics you use, you\u2019ll find the majority of security breaches are due to human error. Those mistakes are often made by accident, not by malice. By understanding the risks, preparing for mishaps, and letting our users know they can come to us in times of trouble, we can make our workplaces safer for everyone.