Read this great column on security management
Myth 1: Security Guides Make Your System Secure
Myth 2: If We Hide It the Bad Guys Won’t Find It
Myth 3: The More Tweaks the Better
Myth 4: Tweaks Are Necessary
Read the MSRC Blog