Information security is about more than just securing the "enterprise

network", but when we start to consider the security of our

applications and infrastructure, we typically just implement some

number of "cool security gadgets" $($like firewalls, IDS, A$/$V$,$ etc$).$ Isn't

this a contradiction $-$ acknowledging that security is more than

technology, but $($all$)$ our security efforts revolve around implementing

technology?