If you can't be 100% secure, when is a breach acceptable? When has a reasonable amount of work been done to make a system secure?

Thanks for the book recommendation. I'll check it out.