How are information security priorities decided? While some organizations have definitive security projects that enable business initiatives, others approach the question of securing corporate assets haphazardly.