When securing extant data-processing systems and networks, one is confronted with a serious conflict between theory and practice. While theory provides watertight strategies for securing data processing, defining proper naming conventions, using passwords responsibly, inspecting log-data sets effectively, and selecting only programs which are secure, practice shows many pitfalls. It is fact, that many well-intentioned security projects fail due to an unrealistic approach, lack of manpower and ill-assigned priorities. Equally, data can hardly be classified due to historical pollution and many users flout security rules, e.g. those concerning passwords. Moreover, weaknesses are introduced by lack of proper auditing tools, by micro-mainframe links, and by sloppiness of staff. This paper will critically review the gap between theory and practice, and will justify some bold statements by quoting examples from the author's practice.