Re-thinking security fundamentals: How to move beyond the FUD