The debate about the sharing of responsibility between system security and information security continues, and it is still unclear, which of the two should be responsible for what type of intrusion.