David will review some of the key experiences and lessons from implementing 2FA in a banking context. He will hopefully answer the question whether 2FA actually does improve security. He will also use that experience to highlight the bigger context of the many changes in approach necessary to properly secure the highly networked business world. He will suggest some fundamental changes in thinking about security models that will help lay the path for many more steps in the right direction.