alasta:

 

It really scares me that IT departments seem to be running around telling people that there is no way that this dangerous single point of failure can be mitigated. 

 

They're not saying that. They work very hard to prevent/mitigate those attacks. They spend large amounts of money on malware scanners.

But it's always an artillery vs armour battle, and artillery always wins that in the end. Armour will defend you against the known, and perhaps expected, artillery. But it won't protect you against the novel, unexpected attack. After someone finds their armour is inadequate, everyone upgrades their armour. But there will always be someone in armour who loses. Malware scanners can only find *known* malware.

Yes, you can put on more and more armor, but that limits your own ability to do useful work. So you could probably prevent malware attacks entirely if you didn't allow people to open email attachments or plug in USB sticks, and disconnected your network from the Internet (except maybe email). And even then, people will try to find ways around the rules. But locking everything down reduces your capability enormously, so a calculated? risk has to be taken. Use a firewall to exclude as much of the Internet as possibly, whilst allowing necessary services to get through. Run malware scanners and keep them up to date so that you're not vulnerable to any known malware.