Security assumptions and the countermeasures that spring from them are in constant flux, yet there remains beneath them a rock-steady foundation of standard business practices essential to security group operations.