That's a hard problem to solve, and I don't think there are any easy answers. It depends on many factors. What kind of business, what the risk/threat model is, cost/benefit analysis, all that kind of stuff.