The tremendous benefits of computing in the Internet Age have come at a price. Viruses, worms, Trojan horses, DDoS attacks, spyware, phishing -- the list of network-based threats seems to grow longer every day. In response, IT managers pile security countermeasures onto servers and workstations, malware authors find ways around them, and the cycle continues.

Will we ever see an end to this arms race? "Probably not," says George Myers, director of product management at end-point security vendor Symantec. "To be certain, anti-virus technology alone does not provide adequate protection for today's threat landscape."

Securing network end points takes processing power, however -- cycles that could otherwise be devoted to running applications. Loaded up with spyware scanners, active virus screening, personal firewalls, and layers of encryption, a PC that was designed to be a race car ends up feeling more like an armored personnel carrier: It's safe, but hardly nimble.

Still, the cost of having too much security is outweighed by the consequences of having too little. Advanced, modern malware, including rootkits, can be extremely difficult to detect, and once it takes hold, it can be even harder to remove. With not just productivity but also sensitive data potentially at risk, locking down workstations is easily justified.

So what to do? How can IT organizations ensure that employees' PCs are protected without bogging them down with too much security?

"The right balance is really specific for each individual customer," says Myers. "Security is important to everyone, but the cost of security has to be weighed. Some security technologies are too costly to maintain and burdensome for users, but others are both simple and effective."

In other words, cross your fingers. Security vendors must constantly revisit and rethink their approaches to stay abreast of the latest threats, but they can only do so much. So long as the nature of network-based security threats is in constant flux, formulating an appropriate security policy for any given company will always involve trial and error -- with end-users caught in the crossfire.