Conversation

@jonw Good point -- physical security should get more attention -- although I see some good reasons for emphasis on code, procedures, controls, infrastructure, and configuration / implementation.

Many, many attacks and threats are remote. Almost every (maybe all) device and application connected to the Internet, for example, has been probed or attacked in some way -- probably many times -- while physical attacks are less common (though they definitely happen).