There's a huge disconnect between what's sexy in Infosec right now - threat intelligence, information sharing, next-generation everything - and what's at the root of so many breaches lately - lack of two-factor authentication, phishing, failure to recognize breaches despite all the logs and alarms in our expensive security software. We talk so much about the failures at this essential level, without any concrete suggestions for fixing it! So - let's change the conversation. This will be an open discussion, under Chatham House rules, about what's working - and what isn't - when fundamental Infosec best practices collide with layer-8 (political/financial/ideological layer) issues. Please come prepared to share one real-world fundamental issue that your organization is struggling to solve, on which we could put our heads together and see if we can suggest anything useful, and/or one real-world example of a fundamental problem that you _did_ solve, so we can learn together what worked and why.