This is pretty much all a work in progress.
I take the position that "strong" passwords and good firewalls create adequate security for a small office.
I refuse to get paranoid about this -- if I have to spend mega$$ on "security", then I'll just go back to paper. Electronic media is inherently insecure.
When we take backup data out of the office, I suppose it should be on an encrypted disk/flash drive. I haven't got there yet, but that would solve the "lost my laptop" data breach problem that even big organizations seem to have.
